0

Ok, so the question name is a bit weird but I wasn't quite sure how to word it. I have a machine with the hostname foo.example.com with an SSL certificate for the domain mail.example.com. I have also have the following DNS records for example.com:

A     foo.example.com  12.34.56.78
CNAME mail.example.com foo.example.com
MX    mail.example.com

Now I have recently learnt that the RFC 2181 (section 10.3) states that the value of an MX record "must not be an alias".

My first attempt to fixing this would be to change the value of the MX record to foo.example.com, however this would cause problems as the name on the certificate is mail.example.com and I can not presently afford the expense of purchasing a new certificate.

My second attempt would be to add an A record for mail.example.com to point to 12.34.56.78 but the problem here is that the hostname provided by the SMTP server (Postfix) would not match the domain in the MX record and this may cause problems with some mail clients. Also, the reverse DNS record would not match.

Unfortunately changing the hostname of the machine itself to mail.example.com isn't an option as it is used for other things that use the other hostname.

Is there any other solution to this that I haven't thought of? Oddly enough it seems to have worked quite fine for the past year or so but as my configuring is actually invalid I'd like to correct it in case it is causing issues somewhere.

8
  • 1
    I believe this should be a Postfix question on "How to setup Postfix to use hostname different from the machine hostname". This is because you should be able to tell your mail server, which domain should it represent without changing DNS. So the correct way to go is to setup A record for mail.example.com to point to your IP and change Postfix settings.
    – Wapac
    Jul 8, 2015 at 10:20
  • Ah right. I didn't think of that, that should be fairly straightforward. Would it matter that the reverse DNS record would not match? Jul 8, 2015 at 10:22
  • With mail server you always want make sure that the PTR record points to that mail.example.com. Some (target) systems require the PTR record to start with things like "smtp", "mail", "mx". So "foo.example.com" is not a good PTR record.
    – Wapac
    Jul 8, 2015 at 10:41
  • Mmm, that's potentially a problem as the machine is primarily foo.example.com and it wouldn't make logical sense for it's PTR record to say mail.example.com. Is it documented anywhere that this is a requirement? Jul 8, 2015 at 10:42
  • We normally set our records as follows: MX[example.com]=mail.example.com, A[mail.example.com]=12.34.56.78,PTR[12.34.56.78]=mail.example.com this turned out to be the best settings for mail server for us. There is no problem that the primary name of the machine is foo.example.com
    – Wapac
    Jul 8, 2015 at 10:43

1 Answer 1

4

Yes, an MX should not point to a CNAME. In this case simply make another A record for mail.example.com:

 A     foo.example.com  12.34.56.78
 A     mail.example.com 12.34.56.78
 MX    mail.example.com

Since the certificate is for mail.example.com it thus matches the name used for connection and thus the certificate can be successfully validated. The PTR record should point back to mail.example.com to play well with spam filters.

8
  • The PTR record for 12.34.56.78 should return mail.example.com if you are sending email from this server. This will allow rDNS (reverse DNS) validation.
    – BillThor
    Jul 8, 2015 at 12:22
  • @BillThor: you are right, they might be relevant for SPF or spam filters. Updated the answer accordingly. Jul 8, 2015 at 13:06
  • As mentioned in my comment above, I'd prefer not to update my PTR record as such as mail.example.com is "the canonical name" for the IP address. Furthermore, none of Apple, Google, Microsoft, or StackOverflow have such a PTR record so I don't think it will be a problem. Jul 8, 2015 at 20:10
  • @DanielGibbs: the PTR records might be used by spam filters to adjust the spam level, see mxpolice.com/email-security/…. Jul 8, 2015 at 20:13
  • @DanielGibbs rDNS validation passes for Google, Apple, Microsoft and StackOverflow. Microsoft has a problem getting their servers to identify themselves by the name in their PTR record. I gather stats and >99% of hosts sending me ham pass rDNS, and >90% identify themselves the name in the PTR record. A few large server farms that trace back to Microsoft skew the last certificate. Both failures get penalized in my spam filtering (and catch most spambots). It is not necessary (or recommended) to change the hostname, just publish the MX name and related PTR.
    – BillThor
    Jul 9, 2015 at 4:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .