0

I am trying to set up a mailserver alongside my webserver, example.com, at IP address 192.0.2.1

  • I have installed the usual suspects; Postfix, Dovecot, Roundcube, ClamAV milter, and OpenDKIM. I believe I have them all functioning.
  • I have set A records for example.com and mx.example.com both pointing to 192.0.2.1
  • I set the MX record for example.com to point to mx.example.com
  • I have made CNAMEs for mail and smtp pointing to example.com
  • I set up an SPF record allowing A MX and rejecting everything else -all
  • The SMTPd banner indentifies as example.com

Should the PTR for 192.0.2.1 resolve to mx.example.com or mail.example.com or example.com ?

More importantly, what determines which particular domain a PTR should resolve to?

1 Answer 1

3

Your PTR record is recommended (not required) to

  • have a valid corresponding A record (against SMTP Reverse DNS Mismatch)

    The forward lookup (A) of the hostname hostname did not match the reverse lookup (PTR) for the IP Address. Some receiving mail servers may use this as an indication of a possible spam source in a scoring system. Most will not reject incoming mail solely on this basis.

  • be the same as the one introduced in your SMTP banner (against SMTP Banner Check).

    Email servers answer connections on port 25 with a string of text called an SMTP Banner whose purpose is to announce the server and any information that the administrator would like to convey to the world.

    It is best practice to put the name of your server in your SMTP banner so that anybody who connects via your IP Address has a clue as to who they are talking to. You will get this warning if the name you present yourself as is not in the same domain as the hostname we get when we perform a PTR lookup on your IP Address.

If you can change the PTR record, the SMTP banner having example.com, this would be:

example.com.              IN   A    192.0.2.1
1.2.0.192.IN-ADDR.ARPA.   IN   PTR  example.com.

Notice that e.g. mx.example.com or mail.example.com would be ok too, as long as they all match.

If you can't change the PTR record, you can always change your SMTP banner to match the PTR. Even if your contract doesn't allow free PTR records, an ISP should have a matching A/PTR pair. If they don't, it wouldn't make a huge difference, as most won't reject mail solely on this basis.


As your question is about following best practices, there's one thing to fix: your PTR record. You currently have "v=spf1 +a +mx -all". This requires additional DNS queries for A and MX.

  • As you have everything on the same server, it's useless to have both a & mx listed.
  • It's recommended to use direct ip4 mechanism, instead: "v=spf1 +ip4:192.0.2.1 -all"
2
  • Thanks for the advice on the +ip4 in the SPF. Right now we have a /27 that's kinda crowded, but if we can get an upgrade on that, I may actually segregate the mail and the web in the future. Pending progress delays on that I'll implement that suggestion in the meantime.
    – Xaekai
    Jul 1, 2018 at 9:19
  • 1
    You may still use ip4 as it also supports CIDR notation and multiple entries. :) Jul 1, 2018 at 9:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .