How does a Reverse DNS lookup work with regards to spam filters?

Question

I have heard that most spam filters use a reverse DNS lookup on the originating IP address of the sending SMTP server (or something like that) as part of the verification process. I want to make sure my emails will pass this check. How exactly can I verify that my emails are OK?

In researching it, I've noticed that if I look at the header of a valid email message coming from Gmail, I will see something like this:

Received: from mail-pz0-f185.google.com (mail-pz0-f185.google.com [209.85.222.185])
        by mx.google.com with ESMTP id 10si2346996pxi.164.2009.07.22.22.26.19;
        Wed, 22 Jul 2009 22:26:19 -0700 (PDT)

When I do an nslookup on 209.85.222.18, it responds with mail-pz0-f185.google.com, which is what I would expect. If it responded with a different domain, then I assume that would indicate a problem and it would fail the check.

Is this what the reverse DNS lookup is all about or am I barking up the wrong tree? If I am incorrect in my assumptions, please enlighten me.

EDIT 1: Also, mainly out of curiosity, what exactly would stop someone from putting a false, yet real, IP address and domnain in the header? For example, what if a spammer put the Gmail info in their header? Is it somehow impossible to put a fake IP address in there?

EDIT 2: OK, I think I sort of understand now. It's not so much what's in the header, but whether the connecting IP address can be reversed DNS'ed and then forward DNS'ed back again. Thanks all.

Answer 1

The test isn't normally comparing against the SMTP envelope (like you describe as your eyeball-based process), but finding the reverse DNS hostname of the connecting host (if any), running that through forward DNS and seeing if it resolved back to the original IP number.

So what you need is 1) to have reverse DNS set up (for the first step) and 2) to have it set up correctly (for the second step).

There's nothing to stop anyone from comparing with the SMTP envelope as well, even if that's frequently seen as too paranoid, so you'd also want anyplace your hostname appears in your mail transmission to use the DNS name that appears in your reverse DNS.

Answer 2

Exactly so. You check whether the mail server who just talked to you is not pretending to be someone else by corelating the forward DNS query (the A record of the domain) with the reverse query (the PTR record of the IP address).

If they match, bravo. If they don't, boo, hiss.

This, of course, implies that any server with multiple host names on their IP address should just use the address specified in the PTR when sending mails.

Answer 3

The reverse DNS record has to exist, but I don't think it's too particular about the hostname - as long as the domain matches.

We SNAT all of our outgoing communication so that it all comes from 1 IP address. We also have all of our mailservers' records set up in reverse-DNS, but I think it just responds in a round-robin fashion, so there's no guarantee which host record it will get.

Nevertheless, this setup works nicely.

Answer 4

You are correct in stating that a Reverse DNS query does not check against SMTP server hostname. However it is important to note that some mail servers do actually check this. My last job was at an exchange hosting company and we would occassionally run into issues because of this. As a mail recipient it should be noted in this discussion that the reverse side of this equation is also becoming popular now - SFP records. Basically an SPF records covers the host name/SMTP server IP by stating which servers are authorized to send mail as your domain. If a spoofed server attempts to send the recipient will refuse the message since it is from an incorrect IP.