How does SMTPSVC on Hotmail set hostname in SMTP header?

Question

The daily spam to my Hotmail-account today contained a message with a forged sender addresssuspicious enough for me to check the SMTP header.

The only "Received" entry was:

Received: from grogrol ([192.184.84.162]) by COL0-MC4-F51.Col0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900);
     Mon, 12 May 2014 13:43:36 -0700

What kind of hostname is "grogol" ? A DNS lookup does not find any name. Could it be a local hostname known to the SMTPSVC server?

The message ID was:

Message-Id: <E1Wjx4R-0007I1-Kz@grogrol>

Is that where SMTPSVC got "grogol" from?

Answer 1

This has nothing to do specifically with Hotmail, or really SMTPSVC even.

The canonical form for the Received header goes like:

Received: from HELO-NAME (RDNS-NAME [IP]) by SERVER-NAME with PROTOCOL; DATETIME

(It is formally defined in RFC 5321, section 4.4, and called trace information.)

So grogrol would appear to be the name the remote server used in the HELO or EHLO SMTP command. That agrees with it being used in the host-part of the message ID as well.

The RDNS-NAME part of the received header is not included if the IP address of the connecting host does not have a reserve name record in DNS, which it does not.

It follows that the only part about the host specification that you can actually rely on (and the only part you should rely on, generally speaking) is the IP address of the connecting host, which in your particular case is given as 192.184.84.162.