1

Please help me re-frame question for positive use if needed, thank you

I use two domains mail.hpdist.com and mail.hpsteaks.com. I am a little unsure how to properly walk through the testing as it seems to me it is setup correctly. Both domain names resolve to the correct IP address 66.**.60.115, but an example email header sent to a gmail account shows the following

    Delivered-To: sample@gmail.com
Received: by 10.64.60.103 with SMTP id g7csp486489ier;
        Wed, 11 May 2016 17:48:44 -0700 (PDT)
X-Received: by 10.202.224.138 with SMTP id x132mr3366323oig.28.1463014124271;
        Wed, 11 May 2016 17:48:44 -0700 (PDT)
Return-Path: <sample@DOMAIN.com>
Received: from mail.DOMAIN.com (66.**.60.114.nw.nuvox.net. [66.**.60.114])

I can test Reverse DNS successfully with both domain mail addresses which resolve to 66.**.60.115 properly, but as you see the header does not represent the same.

The address 66.**.60.114 is not used for email, and is forwarded to another server altogether via the zone file. I have checked that my Send Connectors are using External DNS Lookup, I'm just not sure what else I should be looking at

Seth
  • 334
  • 2
  • 9
  • 21

2 Answers2

4

Received: from mail.hpsteaks.com (66.49.60.114.nw.nuvox.net. [66.49.60.114]) - Isn't a reverse lookup of the name mail.hpsteaks.com. The ip address 66.49.60.114 is the ip address that your email server uses for outbound SMTP traffic (and probably all outbound traffic) and is the ip address that destination email servers see as connecting to them for the SMTP "transaction". The fact that you have a different ip address NAT'ed/port forwarded for inbound traffic doesn't mean that the server uses the same ip address for outbound traffic. Open a web browser on the server and go to www.ipchicken.com and you'll see the ip address is 66.49.60.114.

I have checked that my Send Connectors are using External DNS Lookup - This is how your server locates the MX records for domains that it is sending email to. It has nothing to do with the DNS records for your domain.

joeqwerty
  • 109,901
  • 6
  • 81
  • 172
3

joeqwerty is absolutely right, but I think this is a good opportunity to also point out another problem.

No Received: from mail.hpsteaks.com (66.49.60.114.nw.nuvox.net. [66.49.60.114]) isn't a reverse lookup of the name mail.hpsteaks.com however, it does show that the IP address your exchange server is sending mail from the wrong public IP address.

If mail.hpsteaks.com resolves to 66.49.60.115 then your mail needs to be coming from 66.49.60.115. Why does it matter what IP address your mail comes from? Because if you send email from an IP address that is different than the IP address of the host used to send the mail then the PTR lookup will fail and some email providers may not accept your email.

To fix that you will need to make sure that your router is configured to perform outbound NAT from the exchange server so that emails from the exchange server are properly translated from the private IP address of the exchange server to the public IP address 66.49.60.115. Because your router is not properly configured to NAT the packets from the private IP of the exchange server to the public IP address 66.49.60.115 it is using the router's default public IP address which is 66.49.60.114.

user5870571
  • 3,094
  • 2
  • 12
  • 35
  • Good explanation of what needs to be done. – joeqwerty May 12 '16 at 21:05
  • Well I was trying not to give too much information at first, but this came about from Cloudmark blocking our emails to certain customers. Joe qwerty was right of course about the external IP, but it also turned out the PTR record had been purged from Nuvox by accident. Cloudmark seems to be very particular about resolution. That's an excellent point on NAT. Could I just use a seperate interface on my firewall and assign the 115 that way or would it still have to go through 114 regardless? Does the outbound NAT approach just mean the PTR wouldn't be required?? – Seth May 14 '16 at 12:06
  • Sorry if I ask dumb questions I really appreciate your guys' input! – Seth May 14 '16 at 12:06
  • Not a dumb question. You will need to configure the outbound NAT rule and also ask Nuvox to create the PTR. – user5870571 May 14 '16 at 12:43