0

I'm currently trying to figure out how to configure my rDNS to be SpamAssassin friendly.

SpamAssassin's documentation only seems to provide the following;

https://wiki.apache.org/spamassassin/Rules/CK_HELO_DYNAMIC_SPLIT_IP

"The HELO appeared to be suspicious. This is typically the result of a poorly configured email server advertising itself as XXX-XXX-XXX-XXX.hostname.tld (where XXX is an IP address)."

Currently, my rDNS is set as follows on the ISP's side;

XX.XXX.XXX.XX.static.domainname.com

domainname obviously being my domain name. Originally, it was that but without the "static" part, I tried doing this as the documentation on what is an acceptable "static" and "non-generic" rDNS would be. Didn't seem to fix the issue. I've also tried using the following service; https://www.debouncer.com/reverse-dns-check

I'm currently Postfix/Dovecot on FreeBSD, and using cloudflare for my DNS (Exclusively in DNS only mode as cloudflare itself doesn't support email traffic), I've set up an A record to point my reverse DNS towards my server's IP so that it resolves.

What should I do to mitigate this issue? My guess currently would be to remove the IP entirely from the rDNS record.

1

To pass the PTR check, you'll have to make sure the IP matches the expected hostname. If your mail server is mail.example.com, it should look like this when doing host or dig:

mail.example.com has IP 1.2.3.4
4.3.2.1.in-addr.arpa domain name pointer mail.example.com

If your mail domain isn't XX.XXX.XXX.XX.static.domainname.com then you need to change it. If you control the DNS for the domain, you should be able to create a PTR record to match.

  • And it does resolve. The PTR record points to XX.XXX.XXX.XX.static.domainname.com. Do you mean to say that the MX record needs to point to static.domainname.com? – Sefam Mar 2 '18 at 19:39
  • Assuming that your MX record is set to static.domainname.com, then you should make sure the PTR record matches is setup to the same name. Try something like mxtoolbox.com to run some basic checks. – Andrew Mar 2 '18 at 21:25
  • PTR records are maintained by the ISP controlling the network block, not the domain owner. Therefore domain DNS control doesn't help with getting the PTR record correct. – Tero Kilkanen Mar 2 '18 at 23:08
  • This is true. Hence my ‘if’. But yes, he will likely need to reach out to the ISP to update this. – Andrew Mar 2 '18 at 23:10
  • Yes, we have asked the ISP to change the record twice now, which is why we're wondering what to change it to to fix this problem. – Sefam Mar 6 '18 at 19:17
0

This complaint is specifically about the IP address appearing in some form in the PTR record. This is not advisable for a variety of reasons, one of which as you've discovered is that many destinations will mark your mail as spam or reject it outright.

Set the PTR record to something appropriate, which does not include the IP address. The actual FQDN of the server is usually the best bet.

  • This server hosts many services though. Is the FQDN the web server? The mail server? Some other protocol used on the server? Or in this case, just static.domainname.com? – Sefam Mar 6 '18 at 19:18
  • @Sefam How you name your servers is up to you. – Michael Hampton Mar 6 '18 at 21:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.