Note: There's some opinionated ranting in this. You're free to ignore it :)
Ok, this is email we're talking about, so we should start by saying there is simply no way to guarantee deliverability of a message. SMTP was devised in a quieter, more trusting time. Since then, many people have implemented what they see as the final solution to spam, only to be amazed that it hasn't worked; or that the spammers have figured out how to defeat it; or that it relies on everyone having done it to be effective. (or dozens of other reasons). What we have now is mess of balkanized systems and half-implemented ideas that mean that it's practically impossible to ensure your message will get through.
My opinion is that most of the best practice should be centred around receiving email, rather than sending it. As as sender, it's not your job to ensure it meets whatever random measures the recipient has in place. It's their job to ensure their filtering doesn't block legitimate mail based on assumptions about what a mail message should look like; many of which don't take full account of the interesting ways in which mail can be routed and delivered.
First, what I can't find anywhere is
whether or not the domain name of the
From: email address needs to match the
domain name of the SMTP server.
In principal, no. There are many legitimate reasons why an MTA will send mail from addresses that have nothing to do with its own domain. You might come across systems that reject your mail for this reason, but this is not your problem. It doesn't hurt to have your PTR records match your domain and for the HELO announcement to match those, at least at the TLD; but anything that rejects purely because the From:
domain doesn't match the PTR TLD is broken.
If so, then I am confused by the
advice given here, specifically (in a
listing of bad case scenarios):
No SPF record for the domain being
used in the HELO command.
SPF records are another of these "it sounds right in principal" ideas (See here for another rant on that subject) that has gained a lot of weight. The main problem for me is that a lot of MTAs unfairly punish domains that simply don't publish any SPF at all. Again, this is not your problem.
That said, I've put one in place for our domains, because it's not done to get mardy with customer sysadmins too frequently. It ends up being a political decision, rather than a technical one.
If you're going to use SPF and leave your PTR and HELO as abc.def.linode.com
; then the SPF record for all of your From:
domains should list that server as a sender. If you don't have control over foo.com
and bar.com
DNS, then you'll have to talk to someone who does.
I'm currently using the linode.com
SMTP+PTR domain and example.com From:
address combination without much of
any deliverability issue
and neither should you have. If you publish SPF at all and the linode.com
seerver isn't listed, then you'll get bounced a lot. However, if you have listed it, or if example.com
doesn't publish any SPF records at all, then you should be fine. (I repeat my earlier point that MTAs rejecting mail because there's no SPF published at all are broken and probably bouncing a lot of legitimate mail).
That's not what it does. It doesn't really care what the hostname is in the HELO/EHLO. Even if this matched a PTR
look up, that proves nothing because it could be spoofed (and if you lied in the HELO then you're probably going to lie in your PTR
as well, so that would be a doubly useless check.).
What it does do a PTR
look up on the client address. It then does an A
(or AAAA
) look up for the name returned in the PTR
record. If this matches then you know that the owner of the DNS zone is also the owner of the IP.
It's then up to the rest of the configuration to act on this status. It's almost never enough to get a blanket OK, but if there is no match it's a good indicator that mail can be refused.
Best Answer
The
HELO
hostname should match the server's hostname; at least withA
, but it's even better if theA
also has matchingPTR
. It's also good to have at least somePTR
record. Also notice that the receiving MTAs may decide individually how much value they put on these checks, so it's not an absolute truth.The
HELO
hostname doesn't need to match the domains on sender email addresses. Instead, Sender Policy Framework (SPF) is designed for evaluating whether the server is allowed to send mail for the domain or not. Just have one hostname for the server and forget this idea completely. Learn how to set up SPF, DKIM and eventually DMARC.