• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 808
  • Last Modified:

E-mail server verification and DNS

Our exchange server is getting disconnected by other servers recently, here is an example:

554-Your access to this mail system has been rejected due to the sending MTA's f
ailure of the following host DNS verification measures:
554-1) The host PTR record doesn't exist in DNS (there's no hostname associated
with the connecting MTA's IP address)
554-  OR
554-2) A reverse DNS lookup of the connecting MTA's IP address (PTR) does not ma
tch the forward DNS lookup (A Record) of its hostname.

I've checked and my DNS and reverse appear to be working ok (mail.nativeconnections.org I used http://mxtoolbox.com/SuperTool.aspx to check my server and get a "banner doesn't mach rDNS" error. But it does, what am I missing?
1 Solution
Shreedhar EtteCommented:

Refer this article:

Hope this helps,
Rich WeisslerProfessional Troublemaker^h^h^h^h^hshooterCommented:
Don't know if this helps.  Hitting my local DNS servers, everything looks perfect.

However, when I point at the only server that's listed as authoritative for your domain, I get a server failed.
        primary name server = NS17.WORLDNIC.COM

> set type=ptr
Server:  ns17.worldnic.com

*** ns17.worldnic.com can't find Server failed

Open in new window

nac_Author Commented:
I've  updated my PTR with my ISP. So should this propagate to ns17.worldnic.com or do I need to do something else?
Train for your Pen Testing Engineer Certification

Enroll today in this bundle of courses to gain experience in the logistics of pen testing, Linux fundamentals, vulnerability assessments, detecting live systems, and more! This series, valued at $3,000, is free for Premium members, Team Accounts, and Qualified Experts.

Rich WeisslerProfessional Troublemaker^h^h^h^h^hshooterCommented:
Okay, stretching my knowledge this evening.
I apologize... airband is authoritative for 192.26.69.in-addr.arpa, and it is responding with what appears to be correct information.  I assume ns17.worldnic.com is configured not to accept recursive queries.  That whole line of thought may have been erroneous.  (In other words, worldnic.com doesn't need anything else... it's not concerned with your reverse lookup.)

The default TTL on the 192.26.69.in-addr.arpa zone is a day.  How recently did you make the change?  (Default TTL on your worldnic SOA is 1 hour...)
nac_Author Commented:
I made the change about 8 hours ago with airband. Maybe I just need to wait a day.
Rich WeisslerProfessional Troublemaker^h^h^h^h^hshooterCommented:
For the sites that had a cached copy, yes.  Like I said, checking against my local servers, it all looked good.  :-)
nac_Author Commented:
The interesting thing is that www.mxtoolbox.com will report my PTR correctly (mail.nativeconnections.org) and my SMTP banner (220 mail.nativeconnections.org) but then displays "banner != rDNS".

I'll check back and report once 24 hours goes by.
Rich WeisslerProfessional Troublemaker^h^h^h^h^hshooterCommented:
I think your mail server got tired of me prodding it.  Sorry about that.
Your banner looks correct.  The next thing I was going to try was to see what it responds after a ELHO command -- it looks like it should pass:
250 <your.server.again> Hello <my.domain> <IP>, pleased to meet you.
(I've always loved how polite email servers are)
But I'm curious if that's the banner mxtoolbox.com is complaining about... 'cause the first one I see sure looks correct.
Is this a constant problem or an intermittent one? It's possible the recipient servers are just having temporary name resolution problems. I just tried resolving both forward and reverse and it all looks good on my end too.
nac_Author Commented:
I'll looks good now. Must have been cached for the mxtoolbox site somewhere. The other e-mail server that was refusing my connection is working now too. I guess I should be more patient. Thanks for your help Razmus
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now