8

So I see the following error Helo command rejected: Host not found; in /var/log/syslog, but when I do forward and reverse lookups on the host in question, the DNS records appear reasonable. The mail server in question, endor, seems to otherwise be receiving mail just fine.

Why is Postfix saying this (and bonus second question, is there a setting I should change to fix it?

Email addresses changed for privacy:

Jul 20 23:35:20 endor postfix/smtpd[1503]: NOQUEUE: reject: RCPT from
bdmrob01-2.metavante.com[206.71.18.21]: 450 4.7.1
<bdmrob02.metavante.com>: Helo command rejected: Host not found;
from=<[email protected]>
to=<[email protected]> proto=ESMTP
helo=<bdmrob02.metavante.com>

But DNS looks ok:

endor% dig bdmrob01-2.metavante.com

; <<>> DiG 9.11.3-1ubuntu1.1-Ubuntu <<>> bdmrob01-2.metavante.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32487
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;bdmrob01-2.metavante.com.  IN  A

;; ANSWER SECTION:
bdmrob01-2.metavante.com. 600   IN  A   206.71.18.21

endor% dig -x 206.71.18.21

; <<>> DiG 9.11.3-1ubuntu1.1-Ubuntu <<>> -x 206.71.18.21
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40586
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;21.18.71.206.in-addr.arpa. IN  PTR

;; ANSWER SECTION:
21.18.71.206.in-addr.arpa. 600  IN  PTR bdmrob01-2.metavante.com.

I should mention, main.cf says:

smtpd_helo_restrictions = 
reject_non_fqdn_helo_hostname,reject_invalid_helo_hostname,reject_unknown_helo_hostname
4
  • grep -iE "dns|include" main.cf please.
    – Wesley
    Jul 21, 2018 at 2:06
  • No output from that. Jul 21, 2018 at 3:18
  • Interesting, and is there anything from postconf | grep lookup
    – Wesley
    Jul 21, 2018 at 3:22
  • disable_dns_lookups = no empty_address_default_transport_maps_lookup_key = <> empty_address_relayhost_maps_lookup_key = <> ignore_mx_lookup_error = no lmtp_host_lookup = dns lmtp_tls_force_insecure_host_tlsa_lookup = no smtp_host_lookup = dns smtp_tls_force_insecure_host_tlsa_lookup = no smtpd_null_access_lookup_key = <> smtpd_peername_lookup = yes Jul 21, 2018 at 4:59

2 Answers 2

10

The answer was staring us in the face the whole time.

Postfix is looking for the A and PTR records for the host greeting it with HELO. Or, more precisely, the host that the host says it is in its HELO message. Let's break it down:

Jul 20 23:35:20 endor postfix/smtpd[1503]: NOQUEUE: reject: RCPT from
bdmrob01-2.metavante.com[206.71.18.21]:

A host named bdmrob01-2.metavante.com that resolves to the IP address 206.71.18.21 makes a TCP connection to your mail server.

So you checked the IP address for an A record:

endor% dig bdmrob01-2.metavante.com
[...]
;; ANSWER SECTION:
bdmrob01-2.metavante.com. 600   IN  A   206.71.18.21

And then you checked it for a PTR record:

endor% dig -x 206.71.18.21
;; ANSWER SECTION:
21.18.71.206.in-addr.arpa. 600  IN  PTR bdmrob01-2.metavante.com.

That all looks good. So what's the problem? The host that connected was certainly identified by the above hostname and IP address, but it didn't say that's who it was. It said:

helo=<bdmrob02.metavante.com>

That host has an A record:

$ dig a bdmrob02.metavante.com
[...]
;; ANSWER SECTION:
bdmrob02.metavante.com. 0   IN  A   92.242.140.2

BUT, its IP address has no PTR record:

$ dig -x 92.242.140.2
[...]
;; ANSWER SECTION:
2.140.242.92.in-addr.arpa. 84155 IN PTR unallocated.barefruit.co.uk.

This is a problem on their end. Until then you'll have to either live with it, or change your postfix server to not bother with forward and reverse lookups on HELO commands.

1
  • Thanks! You're right, it was there, and I didn't see it. Thank you for your help! Jul 21, 2018 at 15:59
1

In the spirit of having the useful information in one place, I want to add a bit to @wesley's correct answer, which is that there's a mid-point between not doing forward and reverse lookups, which is whitelisting, described here:

Postfix: whitelist host for specific sender

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .