I have tried reviewing the spam that is making it past spamassassin, and entering the HELO greeting in /var/qmail/control/badhelo and /var/service/qpsmtpd/control/badhelo. I am using the format "domain.com" for the entry. However, I notice that HELOs of the format "mx.domain.com" are being accepted anyway. Does anyone know for sure what the address format should be in badhelo to catch addresses with subdomains?