Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am struggling to understand the correct DNS settings for my server setup.

I have a web server with a single IP and 6 domains hosted on it. I got IIS6's SMTP virtual server working yesterday and sent out a single email from my server to my gmail account which got put in the spam folder because the gmail check for Received-SPF: failed.

I changed some DNS records as per a tutorial I was following, sent another email which was marked as spam with a Received-SPF: softfail. I made some more changes to my DNS records, sent a third email from my server which didn't get put into the gmail spam folder and, according to the gmail email header was declared a Received-SPF: pass.

Great, or so I thought, because today I installed hMailServer and quickly realised that my DNS settings were still not right, so I began trying to work out why I couldn't send or receive any email.

In doing so I found out that, according to mxtoolbox.com and some other DNS record checking sites, my IP address is now blacklisted by CBL (the only one in a long list but not a good start). I checked at the cbl.abuseat.org lookup utility and it claims the last instance of SPAM being sent from this IP was recorded at the same time I was testing the SMTP server on my web server yesterday. Annoying because we are literally talking 2 test emails that were stamped SPAM by google and 1 that was ok.

Anyway, not wanting to make matters worse, I wanted to make sure ALL my DNS records are in order before I ask to be de-listed and again attempt to send and receive emails.

DNS records:

domain1.co.uk

(A records all pointing to my single IP Address)

mail.domain1.co.uk    A    1.2.3.4
pop3.domain1.co.uk    A    1.2.3.4
smtp.domain1.co.uk    A    1.2.3.4
imap.domain1.co.uk    A    1.2.3.4

MX record for domain1.co.uk pointing to mail.domain1.co.uk

TXT record for mail.domain1.co.uk containing the following: v=spf1 a:mail.domain1.co.uk ~all

I want to be able to send and receive emails on all my domains so I have set others up like this:

(A records all pointing to my single IP Address)

mail.domain2.co.uk    A    1.2.3.4
pop3.domain2.co.uk    A    1.2.3.4
smtp.domain2.co.uk    A    1.2.3.4
imap.domain2.co.uk    A    1.2.3.4

MX record for domains.co.uk pointing to mail.domain1.co.uk

There is NO txt record with spf information for domain2.co.uk

Where should I go from here?

share|improve this question

2 Answers 2

  • Check your logs, make sure your SMTP server has only sent out the mail you think it has. Otherwise, we've all just learned to not test our email configurations with GMail addresses...
  • Your SPF record as it stands appears to be correct.

I suggest taking a couple hours and setting up a mail server on Amazon EC2 or the like. You can use a micro instance, pay a few cents for the machine, and hit delete when you're done. Then you can have something that is running SPF verification rules and see both side of the transaction from the mail server's point of view.

share|improve this answer
    
Hi Jeff. Thanks for getting back. Checked logs & that was the only set of emails sent. I only set the server up a couple of weeks ago & only installed SMTP a few days ago. I don't know what Amazon EC2 is (I am new to web hosting and even newer to mail hosting). If I need to I will dedicate the hours you suggest but for now I want to understand the DNS problems I have. I used www.mxtoolbox.com/SuperTool.aspx to check my IP (89.200.138.74) and my domain (smtp.distinguisheddesign.co.uk) Everything is reported as fine except I get this message: Warning - Reverse DNS does not match SMTP Banner –  user1001107 Oct 19 '11 at 15:33

Your DNS is correct. No worries about that. Probably there are PTRs missing but this can only be done by the IP address provider. This affects deliverability.

What you should worry about is the fact that you are blacklisted. This has nothing to do with your DNS setup. And really nothing to do with your particular test mails. This is just a timely coincidence. Probably you opened your firewalls for your tests and now it revealed that you have one (or more) rogue machines in your network which are infected with malicious code.

The CBL listings are serious. They don't occur just because you mail some samples to Google. CBL and Google are not affiliated. CBL runs their own fully automated Spam traps without user interaction (or Google interaction). If the CBL site states that you are infected with some kind of trojan you can be sure that this statement is correct with more that 95% probability.

share|improve this answer
    
My server is a virtual server hosted with a company called Memset. It's a completely fresh setup. I am confused as to how I could have picked up a trojan almost immediately. There were no logs of any emails other than mine being sent out from my server. You say PTR's are missing, do you mean for my other domains? –  user1001107 Oct 19 '11 at 17:17
    
@user1001107 I said "probably". As you do not provide the domains and IPs this was just a guess. –  mailq Oct 19 '11 at 19:33
    
I was wary of posting actual IP's and domain names. I have 6 domains and a single IP. IP: 89.200.138.74 various .co.uk domains. –  user1001107 Oct 19 '11 at 19:38
    
@user1001107 This IP has a PTR. So no problem with that. –  mailq Oct 19 '11 at 19:45
    
@ mailq I have gone through the various checks listed here: cbl.abuseat.org/advanced.html and although I'm not an expert, I can't see any tel-tale signs that my server is being abused. –  user1001107 Oct 19 '11 at 21:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.