DNS/ReverseDNS Question

[mylesw]

I hope this isn't too off-topic, but I'm trying to work out what to instruct my ISP for my Linux web server DNS configuration. We use an external managed DNS provider for all of our domains (www.zoneedit.com) and have 4 co-located servers at a data center here in Phoenix. The data center have allocated us 20 IP addresses, and I have configured DNS for our domains with our DNS provider.

The DNS provider, however, cannot handle ReverseDNS setup for us because we don't own the entire class C subnet and has suggested that we have our ISP setup reverse DNS for us. I've instructed them to do this, but its not working correctly.

I believe my problem is in what I have asked them to do. My configuration is as follows:

1. Main domain ABC.COM is hosted on Apache 2 on Fedora Core 5 Linux
2. ABC.COM, through SendMail, relays all outgoing email to a seperate mail server on its own IP address (a different box also co-located). This box we will call MAIL.ABC.COM

In my DNS setup, I have the A record for ABC.COM pointed to the IP address of the Linux box. I have the MX record set to MAIL.ABC.COM for the email handling. Sendmail is set to route to MAIL.ABC.COM for any outgoing email on the ABC.COM box.

My understanding of reverse DNS is that under this situation, it would be setup as follows:

PTR record created for ABC.COM to resolve back to the IP address of the box that the web server is running on
PTR record created for MAIL.ABC.COM to resolve back to the IP address of the box that the mail server is running on.

Therefore a recipient mail server, on receiving an email from INFO@ABC.COM would do a reverse DNS lookup of ABC.COM and get its IP address. But as the email was sent through a relayed mail server, the IP address would be different. It would therefore check the MX record of the domain that it reversed to and see that the mail server is MAIL.ABC.COM and resolve the IP address that it came from to be from that domain, and therefore accept the email.

Am I deducing this correctly, or is there a flaw to my understanding of how reverse DNS and mail servers work in regards to this?

All help and comments greatly appreciated.

Regards,
Myles

[ccrvic]

Therefore a recipient mail server, on receiving an email from INFO@ABC.COM would do a reverse DNS lookup of ABC.COM and get its IP address.

Not necessarily.

When the SMTP conversation starts, the sending MTA says HELO, and gives its name.

The receiving MTA *generally* resolves the name given in the HELO & checks to see if it is the same IP address as the one being used. If these don't match, it may do a number of things (ranging from nothing at all, to marking the mail with a "may be forged" tag, to outright rejecting the conversation).

But note that the hostname given in the HELO is *not necessarily the same as* the enevlope from address.

Vic.

[mylesw]

OK, thanks. So if I'm understanding this correctly, the mail server will announce itself in the HELO msg, and its address should have a reverse DNS that maps to the same IP that it is coming from.

Is that correct?

Myles

[ccrvic]

OK, thanks. So if I'm understanding this correctly, the mail server will announce itself in the HELO msg, and its address should have a reverse DNS that maps to the same IP that it is coming from.

Its hostname should resolve to an address that has a rDNS to the same hostname (which is what I think you said).

Vic.