Email – Is Rejecting Mails from Servers Without RDNS Too Draconian?

domain-name-systememailpostfixreverse-dns

I've recently dropped SpamAssassin and am now basing spam rejection on DNSRBL's, grey-listing and other basic tests and I'm wondering whether I should also block hosts that don't have a valid RDNS matching the EHLO?

If I do this, am I going to make trouble for much legitimate mail and upset my customers? I've heard people griping that AOL do this, which makes me think it's perhaps too uncommon for me to do.

I'm also wondering if I can compromise by checking that RDNS is at least set to something, but not try to match it to the EHLO. Is this possible with Postfix (and is it useful)?

Best Answer

I have tried multiple approaches with the HELO/EHLO checking with a fairly decent sized customer base of between 100k-200k users and ended up going with a solution that does the following:

  • Check that the HELO/EHLO contains a domain name. -- This mostly boils down to does the name have a dot in it. Checking the DNS on the name led to MANY failed servers as its not uncommon to have the server present an internal name or something you can't resolve properly.
  • Check that the IP has a reverse DNS record. -- Again this is a lax setting as we don't check it against the HELO/EHLO. Checking against the HELO/EHLO created so many tickets this setting didn't last even a single day.
  • Check the senders domain name is valid. -- This is a basic check to make sure if we do have to bounce the message there will at least be some way to find a server for it.

Here's the Postfix block we use for these checks:

smtpd_recipient_restrictions =
    reject_non_fqdn_sender,
    reject_unauth_destination,
    reject_unknown_reverse_client_hostname,
    reject_invalid_helo_hostname,
    reject_non_fqdn_helo_hostname,
    reject_unknown_sender_domain,
    reject_non_fqdn_recipient
Related Topic