DNS and PTR for SMTP: shared IPs and subdomains

domain-name-systemptr-recordsmtp

This question is similar to others about PTR and DNS for SMTP, but one specific aspect was unanswered: what if one machine does SMTP and HTTP on the same IP address. For example:

SMTP at mail.example.com, also HELO. (1.2.3.4)
HTTP at www.example.com (1.2.3.4)
general access like ssh at example.com (1.2.3.4)

What are the requirements for the PTR record on the address 1.2.3.4 to be accepted by spam filters? The 'main' hostname for 1.2.3.4 is example.com, but if reverse DNS lookups require an exact match, I have to set it to mail.example.com. That's stupid. I mean, reverse lookups of 66.102.13.106 don't result in mail.google.com.

Or, is it enough if a reverse lookup finds example.com and mail.example.com as MX record on it? In other words, should I set the PTR to example.com?

One could argue that I should make SMTP access and the HELO example.com, but that causes inflexibility, because then I can never move SMTP to another machine by simply changing the A record.

Edit: it seems unclear what I mean, so let me clarify:

The server in question hosts DNS, SMTP, WWW and a lot more. It does all of it's own DNS. Example.com points to that machine, say 1.2.3.4. Because mail is not its main thing, I don't want 1.2.3.4 to reverse resolve to mail.example.com

The server runs postfix and its HELO is mail.example.com, which also points to 1.2.3.4. For the PTR to match, 1.2.3.4 should reverse resolve to mail.example.com, but as I said, I want it to resolve to example.com, because mail is not the server's main task.

Does that mean I have to change the mailname to example.com, and having it at mail.example.com will cause some spam filters to reject it, even though mail is an mx record of example.com?

Best Answer

  • You can have as many A RRs as you want point to 1.2.3.4.
  • You must have one PTR point back to a name.
  • Therefore all you need is to make sure that the PTR points to the name you want and that this name points back to 1.2.3.4.

This means that you can have:

example.com. IN A 1.2.3.4

example.com. IN MX 10 mail.example.com.

server.example.com. IN A 1.2.3.4

www.example.com. IN A 1.2.3.4

mail.example.com. IN A 1.2.3.4

and:

4.3.2.1.in-addr.arpa. IN PTR server.example.com.

Why is this the requirement? Because when your SMTP server connects to a remote SMTP server to deliver mail the SMTP server knows only the address of your server and not the name. With the address at hand (1.2.3.4) it queries the DNS and gets the PTR response (server.example.com). The remote server now will ask the DNS again "what is the address of server.example.com" and it expects that answer to be 1.2.3.4.

What you send in the HELO string should not frighten you. You can read about the purpose of the SMTP HELO and find about the exceptions where it is allowed to block based on what is given in the HELO string.

Related Topic