{"id":260,"date":"2009-08-13T15:58:03","date_gmt":"2009-08-13T14:58:03","guid":{"rendered":"http:\/\/marc.storck.lu\/blog\/?p=260"},"modified":"2013-12-14T13:04:48","modified_gmt":"2013-12-14T12:04:48","slug":"how-to-solve-dns-and-email-validation-problems","status":"publish","type":"post","link":"https:\/\/marc.storck.lu\/blog\/2009\/08\/how-to-solve-dns-and-email-validation-problems\/","title":{"rendered":"How To Solve DNS and EMail Validation Problems"},"content":{"rendered":"
This article was initially published by Mr Roger Buck on 01 Aug 2001. As the original URL http:\/\/www.saas.nsw.edu.au\/solutions\/dns.html does not provide the article anymore, I temporary provide the text here.<\/address>\n
A archive version of this article is also available here<\/a>.<\/address>\n
\n

Solving DNS & Email Server Validation Problems<\/h4>\n
Is my DNS a Mess ...? \u00a0 \u00a0 \u00a0 Most Probably, Yes!<\/strong><\/pre>\n
\n
Surveys Show that 80% of DNS Domain Name Servers are Misconfigured.<\/a> Chances are high that many email messages are blocked… or possibly lost forever…. without mail administrators being any the wiser.  This article shows you how to analyse and solve most DNS related MTA configuration problems  Original source for this article is BIND8 for NT and other sites by Len Conrad<\/a>… on how to build and configure, relay-only mail hubs for aggressive anti-spam defense with increased reliabiilty and throughput.  This is just a re-hash of what you will find there.<\/p>\n
\n
How to stop DNS from Blocking Valid EMail Delivery<\/h4>\n
Until IP Version 6 becomes widely implemented, validation of email connection will (mostly) remain dependent on the current Domain Name Service (DNS).Growing popularity of Mail Tranfser Agents (MTA) such as postfix<\/a>, by Wietse Venema and IBM, qmail, and sendmail is partly due to their capacity to validate any other mail servers who wish to send them mail.<\/p>\n
Validation helps reduce the volume of Unsolicited Bulk Email (UBM or SPAM) with enhanced security, efficiency and reliability for Internet mail services in general.<\/p>\n
Using postfix as as example, just take a look at one set of such validation options:<\/p>\n
“Postfix Configuration – UCE Controls”<\/a><\/p>\n
… to see how these MTA’s can really slam shut the mail door to any but the most trustworthy and identifiable mail servers.<\/p>\n
How DNS Queries are used to Validate SMTP Clients<\/h4>\n
Take a moment to look at at this portion of an Ipswitch Imail<\/a> SMTPD server log. The log shows what information is provided by the SMTP client that is trying to send email to our SMTPD server:<\/p>\n
Figure 1:<\/p>\n
\"Figure<\/a>
Figure 1<\/p><\/div>\n
Armed with our log information, let’s consider the validation procedures that various mail servers will run against our (and our  hosted clients’) attempts to send mail?<\/p>\n
DNS Authentication Tests Run by Email Servers:<\/p>\n
Validating the ip address of the SMTP client:<\/p>\n
    \n
  1. Query DNS for the PTR record of ip address (reverse lookup)<\/li>\n
  2. Does the PTR record for this ip exist?
    \nIf NO<\/q>: then reject the mail.<\/li>\n
  3. Does the PTR record refer to the HELO\/EHLO hostname?
    \nIf NO<\/q>: then reject the mail.<\/li>\n
  4. Does the ip address’s PTR hostname have an A record??
    \nIf NO<\/q>: then reject the mail.<\/li>\n
  5. Does the ip address’s PTR hostname have an MX record??
    \nIf NO<\/q>: then reject the mail.<\/li>\n
  6. Is the ip address in Mail-Abuse.org’s MAPS (or similar) databases<\/a> of black-holes, open-relays, or dial-ups?
    \nIf YES<\/q>: then reject the mail.<\/li>\n
  7. Is the DNS reverse delegation valid and\/or correct?
    \nIf NO<\/q>: then reject the mail.<\/li>\n<\/ol>\n
    Validating the HELO\/EHLO hostname<\/tt> information:<\/p>\n
      \n
    1. Does the hostname resolve to an DNS A or MX record?  [3]<\/a>
      \nIf NO<\/q>: then reject the mail.<\/li>\n
    2. Is the hostname a FQHN: Fully Qualified Host Name ?
      \nIf NO<\/q>: then reject the mail.<\/li>\n
    3. If there is an A record, is that ip address in one of the MAPS databases for black-holes, open-relays, or dial-ups?
      \nIf YES<\/q>: then reject the mail.<\/li>\n<\/ol>\n
      Validating the MAIL FROM: @sender.domain information:<\/p>\n
        \n
      1. Does sender.domain<\/tt> resolve to a DNS A or MX record?
        \nIf NO<\/q>: then reject the mail.<\/li>\n
      2. Is sender.domain<\/tt> a FQHN: Fully Qualified Host Name ?
        \nIf NO<\/q>: then reject the mail.<\/li>\n
      3. If there is an A record, is the ip address listed in databases of black-holes, open-relays, or dial-ups?
        \nIf YES<\/q>: then reject the mail.<\/li>\n<\/ol>\n
        If you want to be able to validate access to your own mail server, then check out the links above. No matter what brand of mail server you use, you can implement Postfix<\/a>, IMGate<\/a> or similar solutions suited to your preferred operating system: Increasing the availability, speed, reliability, and overall quality of your mail infrastructure.<\/p><\/blockquote>\n
        How to configure DNS for correct email validation<\/h4>\n
        From the above, it follows that well configured<\/q> mail servers will use DNS database records to validate email transfers.  Correct DNS based validation reduces spam and has some important security benefits.<\/p>\n
        So, being a responsible and enthusiastic administrator, you’re asking How can I setup my DNS so that my own and my clients’ mail is reliably delivered to mail servers that use DNS validation techniques?<\/q><\/p>\n