554 .5.7.1 Reverse DNS lookup failed.

I got the following error while sending emails to a particular customer:

554.5.7.1 Connection rejected. Reverse DNS lookup failed. Sending IP address does not match existing 'A', 'AAAA' or 'PTR' record. Connection to host lost.

I do have two Reverse DNS records set up in my ISP:
173.210.10.114  mail.mydomain.com
173.210.10.115  mail.mydomain.com

The A record for my mail server is :
mail.mydomain.com  173.210.10.114

Can you tell what causes my mails being rejected?
Thanks.
CastlewoodAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Lime SparxOwnerCommented:
How long has it been since you had the revDNS record set up?  It could be that it hasn't propagated to your client's DNS sources yet.

*sparx*
0
stu29Commented:
What IP address does your mail leave your network on?  Does it match one of your reverse IP's?
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
footechCommented:
I think stu29 is on the right track.  If your mail is leaving from the .115 IP, then your A record doesn't match up.  You would either need to create another A record for mail.mydomain.com to point to that IP (and make sure you can accept mail sent to that IP), or adjust your PTR record to use another name, and then create a matching A record.
0
Webinar: What were the top threats in Q2 2018?

Every quarter, the WatchGuard Threat Lab releases an Internet Security Report that describes and analyzes the top threat trends impacting companies around the world. Are you ready to learn more about the top threats of Q2 2018? Register for our Sept. 26th webinar to learn more!

CastlewoodAuthor Commented:
"What IP address does your mail leave your network on? "
How to tell? Is there any way to tell?
0
Lime SparxOwnerCommented:
Send an email to an outside email address and then examine the headers in that email for the IP address that your mail server used to send it.
0
stu29Commented:
If this IP address turn out to be different from your RDNS records, you should create an outbound NAT rule on your firewall to force your mail traffic out one of those IP addresses.  This way your originating and reverse IP's will match and should cure this issue for you.
0
CastlewoodAuthor Commented:
Just figured that we use port forwarding via the Cisco ASA whose IP is .114 -- which is the IP to receive mail and is the IP the A record mail.mydomain.com points to. The Exchange server IP is .115 and it is the IP our mail is leaving from. So far the solutions suggested are:
1. (per footech) Skip port forwarding and directly use .115 to receive mails. And create another A record and PTR to match this IP.
2. (per footech) still use port forwarding and IP .114 to receive mail. But simply change PTR for .115 and also create an A record, say server1.mydomain.com for .115.
  Do you think this will work since the receiving and sending are through different IP?
3. (per stu29) create an outbound NAT rule on ASA to force mail traffic out from .114 instead of .115.
  Can you tell me how to do this?
0
footechCommented:
#2 is probably easiest to implement.
2. Yes that is perfectly fine.  It is no problem to send and receive through different IPs, the records just have to match up.  One other thing, it's good practice to have your SMTP banner match to the same name that you use in the PTR and matching A record.  Most servers don't block you when there's a mismatch, but some do.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
DNS

From novice to tech pro — start learning today.