Why does postfix say ‘Helo command rejected: Host not found’ when dig finds the host

domain-name-systememailpostfix

So I see the following error Helo command rejected: Host not found; in /var/log/syslog, but when I do forward and reverse lookups on the host in question, the DNS records appear reasonable. The mail server in question, endor, seems to otherwise be receiving mail just fine.

Why is Postfix saying this (and bonus second question, is there a setting I should change to fix it?

Email addresses changed for privacy:

Jul 20 23:35:20 endor postfix/smtpd[1503]: NOQUEUE: reject: RCPT from
bdmrob01-2.metavante.com[206.71.18.21]: 450 4.7.1
<bdmrob02.metavante.com>: Helo command rejected: Host not found;
from=<bbankingonline@mybank.com>
to=<myemail@fqdn.org> proto=ESMTP
helo=<bdmrob02.metavante.com>

But DNS looks ok:

endor% dig bdmrob01-2.metavante.com

; <<>> DiG 9.11.3-1ubuntu1.1-Ubuntu <<>> bdmrob01-2.metavante.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32487
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;bdmrob01-2.metavante.com.  IN  A

;; ANSWER SECTION:
bdmrob01-2.metavante.com. 600   IN  A   206.71.18.21

endor% dig -x 206.71.18.21

; <<>> DiG 9.11.3-1ubuntu1.1-Ubuntu <<>> -x 206.71.18.21
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40586
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;21.18.71.206.in-addr.arpa. IN  PTR

;; ANSWER SECTION:
21.18.71.206.in-addr.arpa. 600  IN  PTR bdmrob01-2.metavante.com.

I should mention, main.cf says:

smtpd_helo_restrictions = 
reject_non_fqdn_helo_hostname,reject_invalid_helo_hostname,reject_unknown_helo_hostname

Best Answer

The answer was staring us in the face the whole time.

Postfix is looking for the A and PTR records for the host greeting it with HELO. Or, more precisely, the host that the host says it is in its HELO message. Let's break it down:

Jul 20 23:35:20 endor postfix/smtpd[1503]: NOQUEUE: reject: RCPT from
bdmrob01-2.metavante.com[206.71.18.21]:

A host named bdmrob01-2.metavante.com that resolves to the IP address 206.71.18.21 makes a TCP connection to your mail server.

So you checked the IP address for an A record:

endor% dig bdmrob01-2.metavante.com
[...]
;; ANSWER SECTION:
bdmrob01-2.metavante.com. 600   IN  A   206.71.18.21

And then you checked it for a PTR record:

endor% dig -x 206.71.18.21
;; ANSWER SECTION:
21.18.71.206.in-addr.arpa. 600  IN  PTR bdmrob01-2.metavante.com.

That all looks good. So what's the problem? The host that connected was certainly identified by the above hostname and IP address, but it didn't say that's who it was. It said:

helo=<bdmrob02.metavante.com>

That host has an A record:

$ dig a bdmrob02.metavante.com
[...]
;; ANSWER SECTION:
bdmrob02.metavante.com. 0   IN  A   92.242.140.2

BUT, its IP address has no PTR record:

$ dig -x 92.242.140.2
[...]
;; ANSWER SECTION:
2.140.242.92.in-addr.arpa. 84155 IN PTR unallocated.barefruit.co.uk.

This is a problem on their end. Until then you'll have to either live with it, or change your postfix server to not bother with forward and reverse lookups on HELO commands.

Related Topic