5

So I see the following error Helo command rejected: Host not found; in /var/log/syslog, but when I do forward and reverse lookups on the host in question, the DNS records appear reasonable. The mail server in question, endor, seems to otherwise be receiving mail just fine.

Why is Postfix saying this (and bonus second question, is there a setting I should change to fix it?

Email addresses changed for privacy:

Jul 20 23:35:20 endor postfix/smtpd[1503]: NOQUEUE: reject: RCPT from
bdmrob01-2.metavante.com[206.71.18.21]: 450 4.7.1
<bdmrob02.metavante.com>: Helo command rejected: Host not found;
from=<bbankingonline@mybank.com>
to=<myemail@fqdn.org> proto=ESMTP
helo=<bdmrob02.metavante.com>

But DNS looks ok:

endor% dig bdmrob01-2.metavante.com

; <<>> DiG 9.11.3-1ubuntu1.1-Ubuntu <<>> bdmrob01-2.metavante.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32487
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;bdmrob01-2.metavante.com.  IN  A

;; ANSWER SECTION:
bdmrob01-2.metavante.com. 600   IN  A   206.71.18.21

endor% dig -x 206.71.18.21

; <<>> DiG 9.11.3-1ubuntu1.1-Ubuntu <<>> -x 206.71.18.21
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40586
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;21.18.71.206.in-addr.arpa. IN  PTR

;; ANSWER SECTION:
21.18.71.206.in-addr.arpa. 600  IN  PTR bdmrob01-2.metavante.com.

I should mention, main.cf says:

smtpd_helo_restrictions = 
reject_non_fqdn_helo_hostname,reject_invalid_helo_hostname,reject_unknown_helo_hostname
  • grep -iE "dns|include" main.cf please. – Wesley Jul 21 '18 at 2:06
  • No output from that. – Adam Shostack Jul 21 '18 at 3:18
  • Interesting, and is there anything from postconf | grep lookup – Wesley Jul 21 '18 at 3:22
  • disable_dns_lookups = no empty_address_default_transport_maps_lookup_key = <> empty_address_relayhost_maps_lookup_key = <> ignore_mx_lookup_error = no lmtp_host_lookup = dns lmtp_tls_force_insecure_host_tlsa_lookup = no smtp_host_lookup = dns smtp_tls_force_insecure_host_tlsa_lookup = no smtpd_null_access_lookup_key = <> smtpd_peername_lookup = yes – Adam Shostack Jul 21 '18 at 4:59
8

The answer was staring us in the face the whole time.

Postfix is looking for the A and PTR records for the host greeting it with HELO. Or, more precisely, the host that the host says it is in its HELO message. Let's break it down:

Jul 20 23:35:20 endor postfix/smtpd[1503]: NOQUEUE: reject: RCPT from
bdmrob01-2.metavante.com[206.71.18.21]:

A host named bdmrob01-2.metavante.com that resolves to the IP address 206.71.18.21 makes a TCP connection to your mail server.

So you checked the IP address for an A record:

endor% dig bdmrob01-2.metavante.com
[...]
;; ANSWER SECTION:
bdmrob01-2.metavante.com. 600   IN  A   206.71.18.21

And then you checked it for a PTR record:

endor% dig -x 206.71.18.21
;; ANSWER SECTION:
21.18.71.206.in-addr.arpa. 600  IN  PTR bdmrob01-2.metavante.com.

That all looks good. So what's the problem? The host that connected was certainly identified by the above hostname and IP address, but it didn't say that's who it was. It said:

helo=<bdmrob02.metavante.com>

That host has an A record:

$ dig a bdmrob02.metavante.com
[...]
;; ANSWER SECTION:
bdmrob02.metavante.com. 0   IN  A   92.242.140.2

BUT, its IP address has no PTR record:

$ dig -x 92.242.140.2
[...]
;; ANSWER SECTION:
2.140.242.92.in-addr.arpa. 84155 IN PTR unallocated.barefruit.co.uk.

This is a problem on their end. Until then you'll have to either live with it, or change your postfix server to not bother with forward and reverse lookups on HELO commands.

  • Thanks! You're right, it was there, and I didn't see it. Thank you for your help! – Adam Shostack Jul 21 '18 at 15:59
1

In the spirit of having the useful information in one place, I want to add a bit to @wesley's correct answer, which is that there's a mid-point between not doing forward and reverse lookups, which is whitelisting, described here:

Postfix: whitelist host for specific sender

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.