1

Using several different "DNS health tests" today, I've had two report that the SMTPD greeting is wrong/mis-configured.

For example, the test at http://www.dnsqueries.com says I fail this specific test, and then follows that up with:

Spam recognition software and RFC821 4.3 (also RFC2821 4.3.1) state that the hostname given in the SMTP greeting MUST have an A record pointing back to the same server.

I'm running Bind as the nameserver for ns1.smoothstoneservices.com and ns2.smoothstoneservices.com, and the mail server is running Postfix.

OS is CentOS.

Looking at the smtpd_banner directive in /etc/postfix/main.cf, it is set to: mail.smoothstoneservices.com

DNS includes A records for both "mail.smoothstoneservices.com" (smtpd greeting), as well as myers.smoothstoneservices.com (hostname).

Here's the contents of my zone file:

$TTL    1H
@               IN      SOA     ns1.smoothstoneservices.com.      admin.smoothstoneservices.com. (
                        2012021115; serial
                        1800 ; refresh
                        400 ; retry
                        1209600; expire
                        3600 ; Minimum
                        )
                IN      NS      ns1.smoothstoneservices.com.
                IN      NS      ns2.smoothstoneservices.com.
@               IN      MX      0       mail.smoothstoneservices.com.
@               IN      A       69.164.221.183
@               IN      TXT     "v=spf1 a mx ip4:69.164.221.183 -all"
localhost       IN      A       127.0.0.1
myers           IN      A       69.164.221.183
ns1             IN      A       69.164.221.183
ns2             IN      A       66.228.59.103
mail            IN      A       69.164.221.183
{Some info snipped that you don't need to know}

A test on http://mxtoolbox.com for MX and mailserver health indicate everything is OK.

But since I've seen similar "errors" with two separate "dns health" tests / websites, I'm suspicious that I might be missing something.

I'm confused. Do you see any problems? What's your opinion?

2
  • 1
    smtpd banner must inform SMTP supported version (the string SMTP means RFC821 (without EHLO support) and the string ESMTP means RFC2821 (with EHLO support)). Your banner is '220 mail.smoothstoneservices.com' but should be '220 mail.smoothstoneservices.com ESMTP Any text' Feb 12, 2012 at 17:01
  • After skimming a bit of RFC2821 and doing a bit more research, I updated the smtpd_banner, although this didn't resolve the issue. Thank you - it was a needed change anyway. (Issue is resolved- I'll be responding to Lazy Badger's answer in a second...)
    – David W
    Feb 13, 2012 at 2:08

2 Answers 2

0

OK, now about your troubles with your SMTP-greeting

  • If you send OUTgoing mail from 69.164.221.183
  • If you EHLO as mail.smoothstoneservices.com

you may have troubles with some scrupulously pedantic perfectionists, because, formally, for 69.164.221.183, named in EHLO as mail.smoothstoneservices.com we'll see

Quering 8.8.4.4 for {183.221.164.69.in-addr.arpa.,PTR}
...
Answers for 183.221.164.69.in-addr.arpa.:
  -> [PTR] myers.smoothstoneservices.com. 

and mail.smoothstoneservices.com!=myers.smoothstoneservices.com and you can't change in you domain's zone, it have to be changed by maintainer of 221.164.69.in-addr.arpa zone

5
  • Actually, it's you, not the questioner, who has made the error conflating SMTP Relay client with SMTP Relay server that you talk about in the removed text. Notice that the questioner is talking about the initial 22x greeting set by smptd_banner, not about EHLO.
    – JdeBP
    Feb 12, 2012 at 12:19
  • @@JdeBP - why, instead of censorship, nobody mention the fact, that SMTP-session MUST NOT be terminated on greeting stage from client side and only response code (220) is really important. Why nobody show PTR RR?! Feb 12, 2012 at 16:04
  • 3
    @LazyBadger: The censorship is required for the general good running of the site. Please read the faq in particular etiquette which your general demeanor falls short of.
    – user9517
    Feb 12, 2012 at 19:12
  • @LazyBadger: Although your answer confused me at first, and wasn't originally appreciated for some of the comments and assumptions you made, I thank you for it. In the end, you at least got me on the right path, and by skimming a couple RFCs and then learning more about PTR zone files, I have resolved the "problem" that dnsqueries.com was reporting. So you get the accepted answer award. Thanks again. (Side note: I'll be the first to admit that I'm here to learn. That doesn't mean I know everything, and I didn't intentionally add "useless" information to my original question).
    – David W
    Feb 13, 2012 at 2:14
  • ... As a summary of what was wrong (for any who come looking), I was indeed missing the PTR file for the host. I learned today that PTR records go into separate Zone files on the name server, and that they are used for rDNS. By querying this file, external receiving mail servers can determine the host name of the sending machine. This is why dnsqueries.com was complaining to begin with.
    – David W
    Feb 13, 2012 at 2:21
2

Bizarre - I've just tried the smtp test at http://www.dnsqueries.com/ for you and and I got an all clear.

Connection Test I was able to connect on port 25 to mail.smoothstoneservices.com 
HostName in Greeting The hostname in the greeting message is 
mail.smoothstoneservices.com 
Accepts Null <> Sender The SMTP server is accepting NULL <> Sender 
Accepts Mail to Postmaster The SMTP server is accepting mails to [email protected]. This is a good thing, as this addres is used to send out system communications 
Accepts Mail to Abuse The SMTP server is accepting mails to [email protected]. This is a good thing, as this address is used to send out abuse communications 
Accepts Mail to domain literals The SMTP server is accepting mails to postmaster@[IP_ADDRESS]. This is a good thing, as this address is used by people that don't know your domain name! 
Is Open Relay I have tried to send out email through the SMTP server and i wasn't able. This is a good thing, as it seems that your server isn't an open relay. 

Also I've just telnetted to port 25 at 69.164.221.183 and got 220 mail.smoothstoneservices.com

I'm wondering if something was previously wrong and you are now getting a cached result when you check.

Edit: Even stranger - I've just checked www.dnsqueries.com with a test setup where the A record doesn't match the hostname specified in the SMTP greeting, and it was happy with that.

1
  • Very Bizarre. Yes, I just ran the SMTP check, and got the same all clear. But their DNS check still says the Host Name in greeting fails. Even more bizzare is the fact that I haven't changed either the hostname or the smtpd_banner on this machine in several months! Thanks for the response though, this makes me feel better.
    – David W
    Feb 11, 2012 at 22:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .