Can I add multiple PTR records mapping multiple IPV6 addresses to the same domain, and add multiple AAAA records mapping the same domain to to the same set of IPV6 addresses, to let pass the iprev check?
Does forward confirmed reverse dns (fcrdns) only lookup ip to hostname and then hostname to ip or does it compare to the first hostname as well (especially in spam filtering)?
Let's say i have these records:
- A reverse.somedomain: 127.0.0.1
- A mail.somedomain: 127.0.0.1
- A mail.mailserverdomain: 127.0.0.1
- PTR 127.0.0.1: reverse.somedomain
A MTA tries to verify the RDNS of the host and resolves mail.mailserverdomain to 127.0.0.1, then reverse 127.0.0.1 to reverse.somedomain, and then forward reverse.somedomain to 127.0.0.1. Will this be a valid FCRDNS or does the PTR record need to point to the name given in the HELO command (how the mailserver identifies itself)?
The question boils down to the question, if FCRNDS uses two or three queries, so the sequence is either:
- Got
HELO mail.senderdomain - Resolve
mail.senderdomainto the IP. - Resolve connecting IP to
hostname.senderdomain
FAIL: hostname.senderdomain != mail.senderdomain
or
- Got
HELO mail.senderdomain - Resolve
mail.senderdomainto the IP - Resolve IP to
hostname.senderdomain - Resolve
hostname.senderdomainto the same IP
SUCCESS: hostname.senderdomain matches the connecting ip and vice versa.
As a useful check needs to confirm the HELO hostname against the ip (else my mailserver could claim in HELO to be google), there will be a forward lookup, which is compared against the connecting ip.
Then the next step is the reverse lookup, giving a hostname of the connecting ip. Now the shorter sequence would compare the hostnames, while the longer does another forward lookup and compares the ips.
If the first sequence is used, this would mean, that using functional hostnames like mail.domain in the mailserver configuration while using hostnames which identify a host in the rDNS like server123.domain would get your message flagged as possible spam.
Let's say i have these records:
- A mail.somedomain: 127.0.0.1
- A mail.mailserverdomain: 127.0.0.1
- MX somedomain: mail.somedomain
A MTA connects mail.somedomain for delivering mail to somedomain and gets a certificate for mail.mailserverdomain presented, and the MTA presents its hostname as mail.mailserverdomain in HELO.
Is this a valid TLS session or would this mean a certificate for a wrong hostname (expecting somedomain or reverse.somedomain)?