Why do email headers show the wrong IP address from my Exchange server?

Question

Please help me re-frame question for positive use if needed, thank you

I use two domains mail.hpdist.com and mail.hpsteaks.com. I am a little unsure how to properly walk through the testing as it seems to me it is setup correctly. Both domain names resolve to the correct IP address 66.**.60.115, but an example email header sent to a gmail account shows the following

    Delivered-To: [email protected]
Received: by 10.64.60.103 with SMTP id g7csp486489ier;
        Wed, 11 May 2016 17:48:44 -0700 (PDT)
X-Received: by 10.202.224.138 with SMTP id x132mr3366323oig.28.1463014124271;
        Wed, 11 May 2016 17:48:44 -0700 (PDT)
Return-Path: <[email protected]>
Received: from mail.DOMAIN.com (66.**.60.114.nw.nuvox.net. [66.**.60.114])

I can test Reverse DNS successfully with both domain mail addresses which resolve to 66.**.60.115 properly, but as you see the header does not represent the same.

The address 66.**.60.114 is not used for email, and is forwarded to another server altogether via the zone file. I have checked that my Send Connectors are using External DNS Lookup, I'm just not sure what else I should be looking at

Answer 1

Received: from mail.hpsteaks.com (66.49.60.114.nw.nuvox.net. [66.49.60.114]) - Isn't a reverse lookup of the name mail.hpsteaks.com. The ip address 66.49.60.114 is the ip address that your email server uses for outbound SMTP traffic (and probably all outbound traffic) and is the ip address that destination email servers see as connecting to them for the SMTP "transaction". The fact that you have a different ip address NAT'ed/port forwarded for inbound traffic doesn't mean that the server uses the same ip address for outbound traffic. Open a web browser on the server and go to www.ipchicken.com and you'll see the ip address is 66.49.60.114.

I have checked that my Send Connectors are using External DNS Lookup - This is how your server locates the MX records for domains that it is sending email to. It has nothing to do with the DNS records for your domain.

Answer 2

joeqwerty is absolutely right, but I think this is a good opportunity to also point out another problem.

No Received: from mail.hpsteaks.com (66.49.60.114.nw.nuvox.net. [66.49.60.114]) isn't a reverse lookup of the name mail.hpsteaks.com however, it does show that the IP address your exchange server is sending mail from the wrong public IP address.

If mail.hpsteaks.com resolves to 66.49.60.115 then your mail needs to be coming from 66.49.60.115. Why does it matter what IP address your mail comes from? Because if you send email from an IP address that is different than the IP address of the host used to send the mail then the PTR lookup will fail and some email providers may not accept your email.

To fix that you will need to make sure that your router is configured to perform outbound NAT from the exchange server so that emails from the exchange server are properly translated from the private IP address of the exchange server to the public IP address 66.49.60.115. Because your router is not properly configured to NAT the packets from the private IP of the exchange server to the public IP address 66.49.60.115 it is using the router's default public IP address which is 66.49.60.114.