Reverse DNS mismatches mark Exchange email as spam

Many Internet service providers and email providers, such as AOL and Hotmail, attempt to block spam by using reverse DNS lookups on incoming email. This can cause problems for Exchange Server organizations in which the DNS server's PTR records are incorrectly configured.

Many Internet Service Providers and email providers, such as AOL and Hotmail, attempt to block spam by using reverse

DNS lookups on incoming email. Reverse DNS lookups are used to validate that the IP addresses of originating servers match the origin information in the actual email messages.

By and large this is a good idea, but there are a few places where it falls apart. The biggest issue involves Exchange Server organizations in which the DNS server's PTR records are not correctly configured.

Worse, servers hosted on some networks return markedly different reverse DNS information, no thanks to the way the reverse DNS request is honored. A mismatch in the records used by the forward and reverse DNS servers is often the problem, because the two servers don't always have the same record.

To make things even more complicated (as if they aren't already!), the exact authority responsible for hosting your reverse DNS entries is not necessarily obvious. You may even see misleading IP address information if you're using a smart host or if you have your organization behind a firewall.

In short, what you think your address is may not be your address -- especially if you're using a line that has been resold by some other provider. People who set up "business-class" network lines from, say, a cable provider often run into this issue and assume it's some kind of Exchange Server problem.

Related resources on Exchange Server and DNS:

Tutorial: How to protect Exchange Server from spam blacklists

Crash Course: Exchange Server and DNS

Expert Advice: How to determine if you're the target of a 'reverse NDR' attack

Tip: Exchange delivery issues with free Internet email accounts

Tip: Give Exchange 2000 reverse DNS power

Best Practices Guide: The 10 most common Exchange Server issues and how to avoid them

OutlookExchange.com columnist Jason Sherry talked in depth about the reverse DNS issue for Exchange. He also provides a handy walkthrough for how to add the proper forward and reverse lookup records for your mail server.

One tool that he mentions in passing that I want to draw particular attention to is the AOL Postmaster IP Verification Tool, which allows you to determine the IP of a server connecting to AOL domains to send email. This in turn will allow you to debug, if needed, the reverse DNS pointers assigned to your mail server.

Similar tools are available at the DNS Stuff site, too, including a more generic DNS report that provides a lot of useful information. If all else fails, be sure to try the Spam Database Lookup tools there to determine if you've been blacklisted.

Additionally, bear in mind that reverse DNS information is cached, usually with a lifetime of 86,400 seconds (one day). If you change mail server IPs, reverse lookups may fail during that time period.

Last but not least, Microsoft has consolidated a number of different Knowledge Base articles that touch on this issue and describe how to deal with it.

About the author: Serdar Yegulalp is editor of Windows Insight, a newsletter devoted to hints, tips, tricks, news and goodies for all flavors of Windows users.

Do you have comments on this tip? Let us know.

Please let others know how useful this tip was via the rating scale below. Do you have a useful Exchange Server or Microsoft Outlook tip, timesaver or workaround to share? Submit it to SearchExchange.com. If we publish it, we'll send you a thank-you gift only an IT geek could love.

This was first published in May 2007

Dig deeper on Spam and virus protection

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

SearchWindowsServer

SearchEnterpriseDesktop

SearchCloudComputing

SearchSQLServer

Close