Home / server / Questions / 773925
Accepted
MyFault
Asked: 2016-04-30 11:19:55 +0800 CST

SMTP: Received from unknown [xxx.xxx.xxx.xxx] -> but IP does have a valid PTR/RDNS

  • 772

I got the following problem. I got an smtp-relayserver that collects outgoing mails from other servers and checks them (spam assassin).

Now the headers are showing this:

Received: from customerdomain.com (unknown [xxx.xxx.xxx.xxx])
     (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
     (No client certificate requested)
     by relayserver.com (Postfix) with ESMTPS id 1D576101747
     for <[email protected]>; Fri, 29 Apr 2016 21:11:14 +0200 (CEST)
Received: from XYZ (some-isp.com [xx.xx.xx.xx])
     by outgoing-mailserver.com (Postfix) with ESMTPA id C684DAC4F2F
     for < [email protected] >; Fri, 29 Apr 2016 21:11:13 +0200 (CEST)

Okay, fine - my first thought: the IP xxx.xxx.xxx.xxx is missing a RDNS.

But 

host xxx.xxx.xxx.xxx
results in
outgoing-mailserver.com

Why is it showing the unknown-tag?

domain-name-system email postfix email-server reverse-dns

1 Answers

  1. Best Answer

    https://grox.net/doc/postfix/html/faq.html#paranoid

    warning: xxx.xxx.xxx.xxx: address not listed for hostname yyy.yyy.yyy

    Postfix uses hostnames in its junk mail and mail relay controls. This means that in theory someone could be motivated to set up bogus DNS information, in order to get past your junk mail or mail relay controls. When Postfix looks up the SMTP client hostname for the SMTP client IP address, then Postfix also checks if the SMTP client IP address is listed under the SMTP client hostname.

    If the SMTP client IP address is not listed under the SMTP client hostname, then Postfix concludes that the SMTP client hostname does not belong to the SMTP client IP address, and ignores the SMTP client hostname. A warning is logged, so that you can find out why an SMTP client is or is not stopped by your junk mail or mail relay checks.

    You could contact the people who maintain the SMTP client's DNS records, and explain to them that each IP address needs one PTR record, and that this one PTR record needs a matching A record.

    Some people read the RFCs such that one IP address can have multiple PTR records, but that makes PTR records even less useful than they already are. And in any case, having multiple names per IP address only worsens the problem of finding out the SMTP client hostname.

    • 2