Security by obscurity (which is what the practice of not having a PTR record accomplished) is an added bonus on top of whatever security you have in place.
However, not having a PTR record doesn't mean that someone wont be able to launch attacks, break in, etc. It just means that they'll have a harder time associating that particular IP with your organization. That being said, in the modern day, we're seeing a lot of unauthorized activity concerning the use of a domain name - specifically for SPAM. It helps to have your PTR and A records defined well, as some mailers will reject valid messages without this. What you're encountering is the "greater" evil of all of this - that without the PTR/A record defined, a mailer will just assume that whatever the sender says is their domain is indeed their domain. The result is that a lot of people are able to spoof emails as if they came from your organization, which, in my mind, is a greater security risk than having your firewall remain obscure. -----Original Message----- From: Katsumi, Fred [mailto:[EMAIL PROTECTED] Sent: Monday, March 08, 2004 12:10 PM To: [EMAIL PROTECTED] Subject: [FW-1] PTR record for the firewall I apologize for this basic security question but would like some input from the pros. I don't have a public DNS record created for my external interface of the firewall and I think from years ago this was a good practice. I am using the NG R55 SMTP security server and have been receiving some reports that some destination mail servers are rejecting messages from our system due to failure to reverse lookup the originating address. How would I go about solving this? I guess the simplest thing to do is to create a DNS record and a pointer for the firewall interface but I'm not sure if this would increase the security risk. Thank you. --- Fred Katsumi Director, Information Technology CBC (AMERICA) Corp. ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
