How does reverse DNS add security?

Question

There are plenty of good answers here about how reverse DNS works, but why is it used?

It seems that all reverse DNS proves is that the person sending the email has access to the DNS records for the IP. For an end user on a residential connection I find outgoing mail getting blocked by the SMTP server because there is no reverse DNS record. Since I am not trying to spoof some other domain, but using the domain for the SMTP server, how does this check add any security? It seems like the first check should be if there is a large volume of mail coming from the IP before considering rejecting.

Answer 1

It doesn't add security - it is a legacy anti-spam check, and a largely pointless one.

It could be argued that it shows that the system administrators are minimally competent and has control of reverse DNS. It historically indicated that the sender was more likely to be a Message Transfer Agent (MTA) rather than a Mail User Agent (MUA). Since the process requires a reverse, then a forward lookup of the reverse lookup, and since reverse DNS has now been fairly fully mapped out, it's not a good predictor of legitimacy anymore - but remember that SMTP is a very old protocol, and these kinds of tricks used to be helpful before SPF, DKIM etc.

This goes back to 1999 - RFC2505 - which says (paragraph 1.4))

     When we suggest use of FQDNs rather than IP addresses       this is because
     FQDNs are intuitively much easier to use. However, all such usage
     depends heavily on DNS and .IN-ADDR.ARPA (PTR) information. Since it
     is fairly easy to forge that, either by false cache information
     injected in DNS servers or spammers running their own DNS with false
     information in them, host and domain names must be used with care,
     e.g. verified so that the translation address->name corresponds to
     name->address. With Secure DNS, RFC2065, [7], things will improve,
     since spoofing of .IN-ADDR.ARPA will no longer be possible.

Answer 2

Reverse DNS proves that the person who owns the IP address agrees that the DNS record should be pointing to it.

Anyone can create a host record hello.mydomain.ca and point to any IP address they want, spoofing a website. Let's say I point to the IP of amazon.com.

Now granted, there are many other checks in place these days, especially if you're using SSL certificates on the original site.

But a reverse DNS would show the true owner/domain of that website. There may be 100 DNS A records pointing to the same IP, but the reverse DNS shows you only the correct A record.

Edit : Since I disagree with davidgo but cannot yet comment on his post.

David states that Reverse DNS is outdated, no longer needed, etc. This is completely wrong.

1. If you're running Email servers and do not set up PTR records, you can expect Gmail, Yahoo, Microsoft to mark emails from your domain as Spam. See here for one example.

2. Logging and Monitoring systems which see traffic from IP Addresses will use Reverse DNS to put human-readable names to IP addresses.

3. Day-to-day troubleshooting by Network and Security admins will rely on Reverse DNS to once again map IP addresses to hostnames, application names, etc.

In my line of work it is used every day. If David wants to assume the world has left Reverse DNS behind he can do so. But he shouldn't spout out such nonsense without evidence.

If Reverse DNS is useless, there would be an RFC that outlines the death of Reverse DNS. There is no such thing.