Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to find out if i need and how to set up PTR in the zone for my mail server and I refer to this qoute from

Now, let's look at what happens when a mail server receives mail. A mail server receives mail from an IP address. The mail server then does a PTR look up on that IP address and retrieves a domain name. It then does a DNS lookup on that domain name and retrieves another IP address. If that IP address that it retrieves matches the IP address that the mail originated from, the mail passes the Reverse DNS check, and the mail is delivered. If the IP's do not match, or a PTR is not set up, or the domain does not resolve, then the mail is not delivered.

If my mail server is behind a firewall, would my IP still appear to the receiving server as the IP for Wouldn't it appear as the IP of the firewall?

EDIT: Sorry for the bad question, the truth is i am suddenly quite confused.

According to my understanding there are 2 ways to reach my (mail) server behind a firewall.

  1. I have 1 WAN IP (static or dynamic) assigned by ISP. External servers connect to me at that IP and firewall port forward to the mail server at LAN IP.
  2. I have a range of WAN IP (static) assigned by ISP. ISP forwards all the IP to my firewall. My firewall checks the IP and forward/switch to my mail server which we internally assign it the IP.

What will the IP appear to other servers if instead my mail server connects to them in each case?

EDIT 2: OK everyone, thanks for the responses, but really, my question is not "How to set up PTR for mail server"; it is "What is the IP of mail server behind firewall" in the above 2 cases stated. I think I wasn't clear enough, sorry about that.

share|improve this question
It sounds like you're referring to forward-confirmed reverse DNS, which I've never run into and am doubtful of its use by receiving email servers – joeqwerty Dec 1 '11 at 2:18
It is likely that you may be forwarding a port at minimum or that email server has a public IP. Could you please edit your question if that is true. – anzenketh Dec 1 '11 at 2:27
@anzenketh edited my question. – Jake Dec 1 '11 at 3:51
up vote 2 down vote accepted

In the case of option 1, your firewall will be doing NAT. What NAT does is mangle the IP header. So when your mailserver makes an outgoing connection, NAT will change the SourceIP in the header, from the private IP assigned to the mailserver to the public IP assigned to the firewall.

In option 1, other mailservers will see your single public IP as the source address. You will want to assign a PTR record for this IP.

In the case of option 2, if your firewall is not performing NAT, then your mailserver will be assigned an IP out of the range of public IPs, and the firewall is just acting as switch (transparent firewall). In this case, other mailservers will see the IP assigned to your mailserver as the source address. You will want to assign a PTR record for the IP address assigned to the mailserver.

In short, if your firewall is performing NAT, other mailservers will see whichever public IP address your firewall is using as the source address of your mailserver, regardless of which IP is actually assigned to your mailserver. If your firewall is not performing NAT, they will see the actual address of your mailserver as the source address.

share|improve this answer
I just checked my NETGEAR ProSafe VPN Firewall FVX538 for outbound connections. I am surprised to see outbound NAT, something which I never came across myself. So now i see it is possible to send outbound connections on one host and receive inbound connection on another host behind the firewall, all appearing as a single IP to the remote server. – Jake Dec 2 '11 at 7:53
Although the other two answers are slightly different from yours, I think you are right. Thanks. – Jake Dec 2 '11 at 7:56

First off all, as joe said in his comment, it's not the case that all mail servers do that sort of lookup before accepting mail. But you do want a PTR for the public IP of your mail server, regardless of whether you have a distinct IP for it or the public IP is also used for other services. Whether your ISP has given you a few or a lot of routable IPs, your firewall will do the NATing, so you want a PTR for the specific public address your mail server uses.

share|improve this answer
I know the firewall will do the NAT, I am just confused which IP is "public" to set PTR for. My ISP probably sets the whole range of IP dedicated to me already and each domain returned by the PTR query can be subsequently resolve to the respective IP. I am just curious and confused as to which IP (refer to qoute) will the receiving server query for the PTR in the first place. (please see edit) – Jake Dec 1 '11 at 3:17
You will need to confirm that you are indeed getting static IPs and not dynamic. With the lack of IPs ISP's generally do not hand out a range of IPs any more you have to pay for them one by one. – anzenketh Dec 1 '11 at 19:17

The IP that the PTR needs to be set for (done by your ISP) is the public ip (Needs to be static IP dynamic not feasable) to the FQDN that the server identifies itself in the SMTP HELO command(commonly the hostname). You also need a A record pointing to that FQDN.

This can be done with either option 1 or 2 for the connection to reach the firewall that you specified. The question is if you have multiple static IP's. Option 2 is ideal. The IP that you are forwarding to your mail-server though your firewall/router if you have multiple static IP's is the IP that you will set the PTR for.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.