PTR Record with different incoming and outgoing IPs for the mail server.

ddsvi
ddsvi used Ask the Experts™
on
We have a SPAM server that incoming email goes to. Our MX record points to this address.

Then we have our mail server going out on a different IP address.  My question is which IP address do I need to have my PTR record set to. Right now it is set to the same address as my MX record, but we are getting blocked by several mail servers for not having a PTR record.

When I look at the header of an email, it shows that it is coming from the IP of the mail server, which I would expect. So do I need to have 2 different PTR Records or just 1 from the Mail Server?

In my senario, do I need to have a PTR record at all for the incoming SPAM server?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
George SasIT Engineer

Commented:
So let's say your domain name is  ABC.net

You will have the spam filter named : mail.abc.net
Let's say the public IP address of it is 80.80.80.80
Then the MX record pointing to mail.abc.net
Make also a reverse dns on this 80.80.80.80 pointing to mail.abc.net

Then you will go into exchange system manager , find your bridgehead server (the one that sends the mails out) go to the SMTP protocol , and choose properties.
At the delivery tab select "Advanced"
In the "Masquarade Domain" add "abc.net" and at the Fully Qualified domain name put "mail.abc.net"
Ok , Ok

This should solve your problem.
you need the ptr on the ip address used for outbound SMTP connections. when your SMTP server connects outbound the recipient server will typically do a reverse DNS lookup against the ip address the connection comes from.


G

Author

Commented:
I am sorry about posting in Exchange section, but the mail server we are using is a Gordono mail server. Not sure if it has the Masquarade Domain option.


grahamet_uk : Do I need to have any reverse DNS Record for the incoming address? Since mail is not going out that address?

Thanks
Success in ‘20 With a Profitable Pricing Strategy

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

no its not necessay if it is not being used for outbound SMTP
George SasIT Engineer
Commented:
You NEED a reverse DNS for the 80.80.80.80 ip pointing to your SPAM filter as I described.
Some mail servers WILL do a reverse DNS check and if it does not match the A record will just reject the mail.
Been there been trough this hell. More and more mail servers will do a reverse dns check this days.

Author

Commented:
OK, Since I dont beleive I have a Masquarade Domain option.  Can I have a PTR record for 2 different IP addresses point to the same name?

Or do I have to point them to seperate names?

Currently I have mail.mydomain.com and a PTR record for 1.1.1.1 to mail.mydomain.com.

My outbound mail goes out on 1.1.1.2.

Do I just put a PTR record for 1.1.1.2 to mydomain.com or to mail.mydomain.com or something completely different? Of course these are not my real ip :D.
Agreed i too have been through this hell, to reiterate, irrespective of any relaying what ever public IP address your server makes outbound SMTP connections on, that IP address needs to have a PTR record your inbound IP address does not if it is a different address to the outbound one, but why not just put a PTR on all of your public IP addresses. the PTR does not have to match exactly the hostname of the mail server.

Author

Commented:
So I could just put a PTR record of Outbound.mydomain.com on 1.1.1.2 as long as it resolves to a name with our domain correct?
George SasIT Engineer

Commented:
Your IP could never be that :)

make a PTR for both 1.1.1.1 and 1.1.1.2 pointing to mail.mydomain.com or only on 1.1.1.2  pointing to mail.mydomain.com

When the receiving server will check the reverse it will see your mal.mydomain.com which is also your MX record.
With regards to what the PTR record should be the requirements are simply that you have a PTR record that points to a valid hostname on the internet. It does not need to reference any specific domain at all. It does need to be "fully qualified" to a hostname though, so you shouldn't just have domain.com, but rather host.domain.com.

These are some useful links regarding setting up a PTR record:

http://www.simpledns.com/kb.aspx?kbid=1052
 
http://postmaster.aol.com/info/rdns.html 
 
http://www.amset.info/exchange/dnsconfig.asp (Courtesy of EE member Mestha)

Shaun
GeoSs you are not quite correct, the PTR can be outbound.mydomain.com in the case of most of my customers who have multiple Internet lines load balanced outbound so SMTP connections outbound originate from a single server but can come from any of the individual IP addresses allocated, for them i use mail1.mydomain.com, and mail2.mydomain.com the mx could be entirely different say post.mydomain.com

that way large organisations have the flexibility to use different servers for different roles in the enterprise.  RDNS lookups will succeed with a generic hostname like outbound.mydomain.com

G
This is correct. The PTR does not have to relate to the MX OR any particular domain name. It is acceptable for a MTA to deliver mail for multiple domain names, so you would typically set your PTR record to include your primary domain name OR just a valid hostname on the internet, which could be a host in a completely unrelated domain.

Shaun

Author

Commented:
Thanks guys, I just submitted my PTR Record for my outbound IP as outbound.mydomain.com.

I will let you know how everything comes out after the change has propagated.
Good luck im sure it will all be fine, i enjoyed the "discussion"


G
George SasIT Engineer

Commented:
grahamet_uk:You are correct and  I was reffering to his situation where he has only one host and I was just pointing out that his mail.mydomain.com is also his MX record.

I do use load balanced servers for both incoming and outgoing mailflow.

Author

Commented:
Looks like this resolved my issue, Thanks for the help.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial