<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 19/07/2019 16:00, Brian Candler
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:4473b2df-f6f0-01bf-cc33-aeb1106cbdb4@pobox.com">On
19/07/2019 15:52, <a class="moz-txt-link-abbreviated"
href="mailto:bryantz-pdns@zktech.com" moz-do-not-send="true">bryantz-pdns@zktech.com</a>
wrote:
<br>
<blockquote type="cite" style="color: #000000;">Where we are
getting into issues is that customers we host e-mail servers for
are having issues as some email service providers appear to be
forcing their reverse lookups directly against our powerdns
servers.
<br>
</blockquote>
<br>
Can you provide your evidence for that assertion? Do you have
packet captures?
<br>
<br>
I can't see any way they could know about your nameservers, unless
they followed the in-addr.arpa delegation which ended up with your
CNAME.
</blockquote>
<p>However, the fact that you have two PTR records could certainly
be confusing them. And I *would* expect them to do a forward
lookup after the reverse lookup, so you'll see that arriving at
your nameservers.</p>
<p>That is, the sequence is:<br>
</p>
<p>1. Remote server accepts an inbound connection from
65.183.176.179</p>
<p>2. They do a reverse lookup on this IP address, and get the name
"mail.granddial.com" (say)<br>
</p>
<p>3. They do a forward lookup on this name, and get IP address
65.183.176.179</p>
<p>4. They check that this matches the original IP address. This is
what prevents you from forging your PTR records; otherwise, you
could just put in a PTR record pointing at "whitehouse.gov" for
example.</p>
<p>5. If the forward and reverse don't match, paranoid servers will
drop the connection, or mark your mail as spam.</p>
<p>You have a much better chance of this working if you have a
*single* PTR record for that IP address. Pick whichever name you
consider to be the "main" name of the mail server, and use that.</p>
<p>You are astill llowed to have many different forward records
pointing to IP address 65.183.176.179; there's no problem with
that. You just want the reverse record to point to a single name,
and that name also to point to 65.183.176.179.</p>
<p>HTH,</p>
<p>Brian.<br>
</p>
</body>
</html>