>As i understand it, the ptr record can return the host for an ip.
not "can", does, or at least "should"
>If it returns the wrong host then folks who do reverse lookups will
>reject your email.
sometimes. Most DNS software only works with one/the first PTR
record for an ip.
>If this is correct, can you have virtual ipless mail hosts from a
>practical standpoint?
You can't. Sometimes the reverse is used just to verify that any
PTR record just exists, ie, reverse delegation for the ip has been done.
>(won't they all yield a mismatch on the reverse lookup?). Or do you
>add cname records for each. Or do you just add ptr records for each?
>Both? None?
one PTR per ip, but try to make it your default hostname for Imail
machine. and make sure the forward A record matches the PTR
record. Get those out of sync and you can get rejected.
;reverse zone file
ip PTR mail.domain.com
The reverse is done on the ip address, not the ehlo/helo
hostname. The EHLO/HELO hostname is where Imail puts the virtual
mailhost name, I think.
my mailserver is ms1.meiway.com, 212.73.210.73
a reverse lookup gives:
# dig -x 212.73.210.73
; <<>> DiG 8.2 <<>> -x
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 4
;; QUERY SECTION:
;; 73.210.73.212.in-addr.arpa, type = ANY, class = IN
;; ANSWER SECTION:
73.210.73.212.in-addr.arpa. 1D IN PTR ms1.meiway.com.
but that's NOT the mailserver that sends my mail. vbg The mailserver
that sends mail is IMGate: mgw1.meiway.com, 212.73.210.75. That's
the sending ip address that gets reversed by the receiving MTA and
perhaps rejected, but mine is ok:
# dig -x 212.73.210.75
; <<>> DiG 8.2 <<>> -x
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 4
;; QUERY SECTION:
;; 75.210.73.212.in-addr.arpa, type = ANY, class = IN
;; ANSWER SECTION:
75.210.73.212.in-addr.arpa. 1D IN PTR mgw1.meiway.com.
;; AUTHORITY SECTION:
210.73.212.IN-ADDR.ARPA. 1D IN NS ns1.meiway.com.
210.73.212.IN-ADDR.ARPA. 1D IN NS ns2.meiway.com.
210.73.212.IN-ADDR.ARPA. 1D IN NS as1.meiway.com.
210.73.212.IN-ADDR.ARPA. 1D IN NS ms1.meiway.com.
and the receiving MTA can do this forward lookup:
#dig mgw1.meiway.com a
; <<>> DiG 8.2 <<>> mgw1.meiway.com
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 4
;; QUERY SECTION:
;; mgw1.meiway.com, type = A, class = IN
;; ANSWER SECTION:
mgw1.meiway.com. 1D IN A 212.73.210.75
... so my forward and reverse records match for my mail server that
sends all my virtual mailhosts' mail.
My sending MTA's reverse delegation is done and a PTR exists, but the
PTR hostname of the ip has nothing to do with any Imail virtual
mailhost that I route through that ip address.
>Also, my upstream dsl provider has my ip addresses listed to them in
>a reverse lookup.
For overlooked.com's mx:
# dig -x 64.32.195.27
; <<>> DiG 8.2 <<>> -x
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2
;; QUERY SECTION:
;; 27.195.32.64.in-addr.arpa, type = ANY, class = IN
;; ANSWER SECTION:
27.195.32.64.in-addr.arpa. 0S IN PTR 64-32-195-27.chi2.phoenixdsl.net.
;; AUTHORITY SECTION:
195.32.64.in-addr.arpa. 0S IN NS ns1.pnix.net.
195.32.64.in-addr.arpa. 0S IN NS ns2.pnix.net.
and then the forward query:
# dig 64-32-195-27.chi2.phoenixdsl.net
; <<>> DiG 8.2 <<>> 64-32-195-27.chi2.phoenixdsl.net
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2
;; QUERY SECTION:
;; 64-32-195-27.chi2.phoenixdsl.net, type = A, class = IN
;; ANSWER SECTION:
64-32-195-27.chi2.phoenixdsl.net. 1H IN A 64.32.195.27
;; AUTHORITY SECTION:
chi2.phoenixdsl.net. 1H IN NS ns1.pnix.net.
chi2.phoenixdsl.net. 1H IN NS ns2.pnix.net.
So they have correctly set up their forward and reverse zone records,
it just has nothing to do with you! vbg
>They sort of know that this is a problem, cause when i asked about
>the hemmed and hawed and said yes, we did this temportarily, bla bla bla.
They have defined a generic PTR hostname for your DSL ip, and it's
not mail.communityspirit.net. If your are having mail rejected for
that reason, ask them to put change their PTR to your hostname.
btw, send me a mail and we'll see if IMGate/postfix spits out a
warning. I am not currently rejecting when the reverse lookup is bad,
just logging a waring.
>So another question, is, is it enough to have them add a ptr record
>to refer to my name servers to get the mail to work correctly,
They have to delegate in their DNS the reverse authority for your ip
blocks to your NS:
# dig overlooked.com soa
; <<>> DiG 8.2 <<>> overlooked.com soa
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; QUERY SECTION:
;; overlooked.com, type = SOA, class = IN
;; ANSWER SECTION:
overlooked.com. SOA dell1300a.communitynic.net.
gatekeeper.communityspirit.net.
;; ADDITIONAL SECTION:
dell1300a.communitynic.net. 20M IN A 64.32.195.100
Then you can set up your reverse zone files on
dell1300a.communitynic.net and Internet will consult your NS as
authoritative for your ip block.
> or must they add every virtual mail host (seems unreasonable)
only one PTR hostname per ip. I suggest that you a) obtain reverse
authority for your DNS, and b) put the default Imail mailhost as the
PTR hostname, and make sure that the forward A record
matches. Forget about the virtual mailhosts as PTR data.
But for your Imail virtual mailhosts, make sure every one has both an
A and MX records, so that MTA's that validate the hostname in
EHLO/HELO virtualmailhost.com
.. sent by Imail, will be happy.
Also, make sure all the "senderdomains" as in
MAIL FROM:<[EMAIL PROTECTED]>
... have both A and MX records.
Len
http://BIND8NT.MEIway.com: ISC BIND 8.2.2 p5 installable binary for NT4
http://IMGate.MEIway.com: Build free, hi-perf, anti-spam mail gateways
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
