1

I have set up Postfix on an Ubuntu 18.04, with a view to sending emails from two different domains, which I will refer to here as abc.com and xyz.com. I'm trying to configure everything so that emails are not rejected. I have created the SPF record OK in the control panels for both domains, so that is not a problem.

What I'm having difficulty with is a seeming conflict between DKIM and Reverse DNS. If I set up Reverse DNS for my server to be 'mail.abc.com', I can send out mail from 'xyz.com', correctly signed with the right DKIM key, and when I check with a verification address like 'check-auth@verifier.port25.com', it passes the DKIM validation fine but fails an 'iprev' check because the Reverse DNS is wrong (it resolves to mail.abc.com). But when I set the from address of my 'xyz.com' mail to 'abc.com', it passes the iprev check OK, but doesn't get a DKIM signature (and potentially has a misleading From address in the email).

So is it possible to set things up on this single server so that I can send out emails from 2 different domains and have iprev and DKIM checks work OK? If so, how do I configure this?

Improve this question
1
  • Note that a single A or AAAA record query can return multiple IP addresses and a single reverse DNS (PTR record query) can return multiple names. If your server needs to handle services for multiple domains, its reverse DNS should respond all those domains at the same time and each of the domains should point to correct IP. And if you have redundant servers, you should have multiple IPs for each domain and reverse IP for all the IPs should return ALL the domain names hosted by those IP numbers. Note that iprev authentication recommends default limit of max 10 results per DNS query.
    – Mikko Rantalainen
    Jul 7 at 12:03

1 Answer 1

Reset to default
2

Of course you can do this. The things that must match are: the name Postfix announces itself as to other mail servers, and the forward and reverse DNS records for that name. The domains used in messages are completely irrelevant to this check.

If you configure Postfix to say it is mail.example.com then the hostname mail.example.com must resolve to the same IP address as the server, and the reverse DNS (PTR record) for that IP address must also resolve to mail.example.com.

You need to configure:

  • In Postfix main.cf set myhostname= to the fully qualified domain name of the mail server. Do not use a naked domain name as this can break mail delivery in some circumstances.
  • In DNS, set the AAAA and A records of that fully qualified domain name to the IPv6 and IPv4 addresses of the server.
  • In DNS, set the PTR records of the server's IPv6 and IPv4 addresses to that fully qualified domain name.
Improve this answer
6
  • Given that the iprev reported contains this ID(s) verified: policy.iprev="2a01:4f8:c17:ddce::1", I'm thinking that the absence of an AAAA record for the FQDN may be the issue?
    – John Moore
    Jul 30, 2020 at 16:13
  • @JohnMoore That very well could be it.
    – Michael Hampton
    Jul 30, 2020 at 16:19
  • I've never dealt with IP v6 before, so I'm a little confused. According to the control panel for this virtual private server, the v6 address is 2a01:4f8:c17:ddce::/64, but my domain name control panel will not allow this for an AAAA record.
    – John Moore
    Jul 31, 2020 at 11:35
  • @JohnMoore That's the address and the CIDR prefix. You should enter only the address.
    – Michael Hampton
    Jul 31, 2020 at 14:47
  • Shouldn't the address have 5 parts?
    – John Moore
    Jul 31, 2020 at 15:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.