1

We are using Google Apps for our email service, and send a bulk of around 15k emails a day from our internal relay server (its outbound only, no open-relay) to customers.

Recently, we ended up getting the three outbound IP Addresses listed on the CBL Blacklist, and nothing else.

The first reason it mentioned was it detected mail similar to a botnet, but after checking it later the exact reason changed to: This IP address is HELO'ing as "localhost.localdomain" which violates the relevant standards (specifically: RFC5321).

That seemed to be correct - and our internal mail relay is using IIS 6.0 SMTP Virtual Server, and relaying mail from a bunch of systems internally for us to customer notifications as well as server/system notifications for internal use.

The FQDN of the SMTP Virtual server was the local servername which lets just say was mail.company.local (yes our internal domain is .local - sigh). I changed the FQDN to company.com instead - and then checked a show original and I saw that the SPF record was listed as = pass, instead of = neutral. And I thought that fixed it.

Another problem that I see is with the Reverse DNS record. Currently we do not have one, and the CBL notes to us that a Reverse DNS record isn't necessary - but still makes me wonder if it wouldn't be that bad of an idea to get setup. Problem is our configuration is going to be confusing to get setup. Our main website at company.com (which is also our email domain that we send email from - company.com) is not hosted by us, and has a completely different IP range than our internal systems outbound IP address that we send mail from. If I set a reverse DNS record for company.com on our outbound IP address, the reverse lookup will not match the IP that resolves for company.com - for our companies website not hosted by us. Confusing - and possibly not required.. but it's something I'm trying to think about getting fixed in case it is a variable in this. The CBL is our main priority right now, and unless this is related (which CBL says they don't care about rDNS) then I'd rather worry about CBL for now.

Next day ended up getting relisted again, and I'm not really sure where to go from here. It's our only port 25 traffic going out those IPs, but something isn't matching up. I can't find any sort of best practices document or items to check for Google Apps + internal SMTP Relay, only best practices for Google Apps + using your internal server to smarthost relay to smtp-relay.gmail.com - which would be fine but they only accept 10k emails a day on their hosted relay per client.

I'm essentially looking to see if anyone has any sort of general/best practice configuration or items to check for someone using Google Apps with an internal SMTP Relay. It doesn't have to be IIS SMTP - and honestly I'm not opposed to switching it to something like Postfix or another (free ideally) server I could run to do the internal mail relay. Just wanted to throw this out there. I appreciate any assistance or things to check for in advance - thank you!

1

You can certainly configure Google Apps to use an internal SMTP relay -- but, as you've discovered running an e-mail server is filled with caveats. Generally, I recommend offloading the SMTP service to your external provider.

At the minimum, you want to setup:

  • Valid hostname
  • Reverse DNS (PTR record in the ARPA zone)
  • DKIM (Domain Keys Identified Mail) DNS records
  • SPF DNS records
  • TLS required for clients -> your internal SMTP server
  • Enforced TLS between your SMTP server and major e-mail providers like gmail, yahoo etc as a nice touch

It sounds like you can deal with the DNS issue just by making a third level domain -- e.g. smtp.whatever.com rather than plain company.com You'll have to work with your ISP to get the PTR records either delegated to your DNS provider or updated via the ISP's support.

Note that Google's smtp relay service accepts more than 10k e-mails a day; it's 10k recipients that it's limited to.

If you're sending mail to more than 10k recipients a day, I would recommend using a third-party mail hosting provider like mailchimp, mailgun, etc etc. In the end, the hassle of an internal SMTP relay is generally not justified with the low cost of hosting providers these days.

  • I noticed an issue when I changed it to smtp.company.com that showing the email headers revealed this though: X-Original-Authentication-Results: mx.google.com; spf=neutral (google.com: x.x.x.x is neither permitted nor denied by best guess record for domain of smtp.company.com) smtp.mail= And the SPF record that I have set right now is as follows: v=spf1 ip4:x.x.x.x include:_spf.google.com ~all One other question I have, is I wanted to clarify what the 10k emails a day means. Are you saying that is sending to 10k unique email addresses a day, not 10k emails sent then? – Keegan Jacobson Jun 11 '15 at 0:44
  • Yes, the SMTP relay limit is 10k unique email addresses rather than simply 10,000 individiual e-mails. – Herringbone Cat Jun 11 '15 at 4:44
  • I think the lack of the PTR record is what is confusing the best guess SPF. I'd try using some spf checker tools to validate, without the real IP/domain it's hard to validate. – Herringbone Cat Jun 11 '15 at 4:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.