> Does anyone have exact info on how this is done?
> Is the lookup based on the info pulled from the MX record or
> the domain of the sender?
There are a couple of different things you may be lumping together here.
The first is a reverse DNS lookup. A reverse DNS lookup takes an IP address and lets
you know the host name of that IP address, if there is a reverse DNS entry for that IP
address.
The other is some tests that can be run against your mail server for spam testing.
> If the MX record is mail.domain.com, does it look for the entire name
> or just domain.com?
The reverse DNS doesn't involve MX records. It simply returns the host name
associated with an IP address.
> What about Firewalls and Spam software that does extensive checks to
> validate, what do they look for?
They can look for anything they want. The most common test, given just the IP address
of the remote mail server, is to verify that there *is* a reverse DNS entry for that
IP address. The idea is that if someone runs a mail server and doesn't have a reverse
IP address for it, they don't know what they are doing or don't have enough control
over their mail server. Not always true, but some people feel that way.
Given the reverse DNS entry, they can go beyond that, and do things like check the A
record and make sure it matches the IP (that the forward and reverse DNS entries
match; that 10.10.10.10 resolves to mail.your_domain.com and mail.your_domain.com's A
record is 10.10.10.10). They can also check to make sure that something later in the
SMTP transaction (the HELO name, for example) contains part/all of the string (perhaps
either mail.your_domain.com or your_domain.com would be acceptable).
FYI, we don't include those kinds of tests because we haven't found a strong
correlation between those tests and spam (and our customers haven't requested it).
Apparently, AOL checks to make sure a reverse DNS entry exists, and may check it
further as part of their secret "points" system.
--
-Scott
Declude: Anti-virus and Anti-spam solutions for IMail. http://www.declude.com
--
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
