We are using Google Apps for our email service, and send a bulk of around 15k emails a day from our internal relay server (its outbound only, no open-relay) to customers.
Recently, we ended up getting the three outbound IP Addresses listed on the CBL Blacklist, and nothing else.
The first reason it mentioned was it detected mail similar to a botnet, but after checking it later the exact reason changed to:
This IP address is HELO'ing as "localhost.localdomain" which violates the relevant standards (specifically: RFC5321).
That seemed to be correct - and our internal mail relay is using IIS 6.0 SMTP Virtual Server, and relaying mail from a bunch of systems internally for us to customer notifications as well as server/system notifications for internal use.
The FQDN of the SMTP Virtual server was the local servername which lets just say was mail.company.local (yes our internal domain is
.local - sigh). I changed the FQDN to
company.com instead - and then checked a show original and I saw that the SPF record was listed as
= pass, instead of
= neutral. And I thought that fixed it.
Another problem that I see is with the Reverse DNS record. Currently we do not have one, and the CBL notes to us that a Reverse DNS record isn't necessary - but still makes me wonder if it wouldn't be that bad of an idea to get setup. Problem is our configuration is going to be confusing to get setup. Our main website at
company.com (which is also our email domain that we send email from -
company.com) is not hosted by us, and has a completely different IP range than our internal systems outbound IP address that we send mail from. If I set a reverse DNS record for company.com on our outbound IP address, the reverse lookup will not match the IP that resolves for company.com - for our companies website not hosted by us. Confusing - and possibly not required.. but it's something I'm trying to think about getting fixed in case it is a variable in this. The CBL is our main priority right now, and unless this is related (which CBL says they don't care about rDNS) then I'd rather worry about CBL for now.
Next day ended up getting relisted again, and I'm not really sure where to go from here. It's our only port 25 traffic going out those IPs, but something isn't matching up. I can't find any sort of best practices document or items to check for Google Apps + internal SMTP Relay, only best practices for Google Apps + using your internal server to smarthost relay to
smtp-relay.gmail.com - which would be fine but they only accept 10k emails a day on their hosted relay per client.
I'm essentially looking to see if anyone has any sort of general/best practice configuration or items to check for someone using Google Apps with an internal SMTP Relay. It doesn't have to be IIS SMTP - and honestly I'm not opposed to switching it to something like Postfix or another (free ideally) server I could run to do the internal mail relay. Just wanted to throw this out there. I appreciate any assistance or things to check for in advance - thank you!