Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If setting up a mail server. What is the best domain to use for the IP's PTR record?

Is it usually better to use "" or just "" ?

I understand that If the PTR record is set, some mail providers will attempt to get a HELO response from the origin address? Because I'm sending mail from my own server only AND is done via my code, I didn't think it was necessary to have port 25 open on the iptables settings. But it seems like I might need to for the mail providers to do the HELO, right? Are there any security implications to opening up port 25 even if I'm sending mail from my own server?

share|improve this question
up vote 8 down vote accepted

The PTR record should point to a host name. Do not point it to a domain name. If the name of the mail server is mail in the domain, then: ->
and ->

Most mail servers will attempt to verify that the above relationship is true.

When the mail server connects, it opens the conversation with "EHLO". The receiving mail server then checks the forward and reverse lookups (usually, it's not required but most do).

If you want to receive e-mail you must accept it on port 25, and that would have to be configured in your firewall (iptables) too. If you are not receiving e-mail on this server then you do not have to have port 25 open (for incoming connections). It is a perfectly acceptable configuration for a mail server to only send e-mail. Most commonly in this situation another server handles receiving e-mail for the domain, but this is not required. Your firewall will have to allow outgoing connections to the destination port 25. It's pretty common for firewalls to not filter outgoing connections (though it is common is high security environments).

Every single port you open on your firewall potentially exposes you to new threats. Never open a port unless you know that it's necessary. Even then it should only be done once reasonable measures have been made to secure the server against common attack vectors for the relevant service.

share|improve this answer
If the DNS records have point to, why is it not good to have the PTR point back to but rather – lamp_scaler Oct 1 '11 at 3:21
It's possible and mildly valid to have your server named after the domain. It's not common and some spam filters will hold it against you. Whatever names are used, it is most important that they match forward and reverse. – Chris S Oct 1 '11 at 3:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.