Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running a dovecot/postfix mail server on debian and am having some issues. Everything is working fine except all emails to are being deferred.

The error code gave me: "The Reverse DNS lookup for your IP address is failing."

I'm running a site (I'll be calling it in this post) on server A. I'm then running this mail server on server B. I have a A record pointing to server B in my domains DNS, as well as an MX record pointing to

I've set the PTR record of my mail server to and this is the dig output:

*I've substituted for the IP of my mail server

AND as my main server IP

dig -x @

; <<>> DiG 9.3.6-P1-RedHat-9.3.6-20.P1.el5_8.6 <<>> -x @
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48367
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;  IN      PTR


;; Query time: 58 msec
;; WHEN: Tue Jul 22 14:30:23 2014
;; MSG SIZE  rcvd: 75

In's domain DNS settings I have:

A  |  -> (main server ip) 
A  | -> (mail server ip)
MX | ->

I don't have any SPF or TXT records. When I ping it correctly returns the IP of my mail server.

Why am I still getting bounce backs?


I changed

MX | ->


MX | ->

Also, as @sebix suggested I had to confirm my HELO was set as (it was set to as well as confirm my PTR of my mail server was set to (it was set to

share|improve this question
up vote 1 down vote accepted

Yes, you need to make sure that

  1. Your HELO string is a domain that resolves to your IP.
  2. There is a PTR record for the IP of your sending mailserver that resolves to that domain.

The domain in the PTR and your helo must correspond. It's not exactly according to RFCs, but large providers such as AOL have been expecting it for a long time. It does help spam prevention.

share|improve this answer
I edited your answer and clarified which IP is important and that PTR and Helo should correspond. If you don't agree, don't hesitate to revert my additions. – sebix Jul 22 '14 at 16:05
@sebix well done, thanks. – Felix Frank Jul 22 '14 at 16:06
I've updated my PTR record at digitlocean (mail server host) to Will it take some time to propigate? Because dig still isn't showing a valid PTR record. – Jonny07 Jul 22 '14 at 16:18
UPDATE: Nevermind it just needed a few minutes to update. I've updated my post with the most recent dig response. So I should be good to go now? – Jonny07 Jul 22 '14 at 16:20
The obfuscation isn't exactly helpful, but from what I gather, the PTR you created is for the IP of the server not doing SMTP, so I don't see how it's going to be helpful. – Felix Frank Jul 22 '14 at 16:23

The quick search directs you to the AOL Postmaster where error 421 should have been followed by an additional error code indicating the actual reason your connection is (temporarily) rejected:

421 DNS:NR
    The Reverse DNS lookup for your IP address is failing.

421 RLY:B3
     The IP address you are sending from has been temporarily rate limited due 
     poor reputation.

421 RLY:CH
     A computer or computer(s) on your network may be compromised and is sending mail 
     that matches the signature of known spam.

421 RLY:CH2
    Your IP address has generated AOL member complaints 

421 RLY:NW
    The IP address you are sending from has been temporarily rate limited because the 
    IP is new or has been idle for a long time

421 RLY:SN
    This error indicates you are sending email using a disallowed AOL.COM screenname as 
    your FROM or REPLY-TO address

etc. etc.

Edit after adding the complete error response: 421 DNS:NR to your question we can conclude the Reverse DNS lookup for your IP address is failing.

Typically you need to contact your hosting provider to set up a correct reverse DNS record for the ip-address of your mail server (serverB). A simple check with dig -x <your-ip> @ should return 599 IN PTR where is of course the correct hostname of serverB.

share|improve this answer
Sorry I should have included that. It's the first one. 421 DNS:NR "The Reverse DNS lookup for your IP address is failing." But if you ping, it will resolve to the IP of my main server, not my mail server.. If my mail was on the same server as site, I wouldn't have this issue, but I guess I'm confused as to how you run a separate mail server without having this problem. – Jonny07 Jul 22 '14 at 15:25
Does dig -x <your-ip> @ return a correct reverse DNS record? And check AOL's own trouble shooting page – HBruijn Jul 22 '14 at 15:28
I've updated my question with the dig output. – Jonny07 Jul 22 '14 at 15:38
And from that we see that no, your mail server does not have a valid PTR record. Get Digital Ocean to fix that. – MadHatter Jul 22 '14 at 15:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.