MTA - MX Config/DNS Records

Discussion in 'Installation/Configuration' started by CubAfull, Jun 5, 2021.

  1. CubAfull

    CubAfull Member

    Hello guys I'm breaking my head here with the MX configuration and after 9 hours + I think is time to ask for help.
    Some days ago I started to see this message in the mail log:
    Code:
    Jun  4 19:45:26 mail postfix/smtp[11789]: 278DD801375: host xxxxxxx refused to talk to me: 554-xxxxxxxx 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means.
    and
    Jun  4 20:30:29 mail postfix/smtp[14159]: 42F29802281: to=<xxxxxxxxxxx>, relay=xxxxxxxx:25, delay=189401, delays=189398/0.04/2.5/0, dsn=4.0.0, status=deferred (host xxxxxxx refused to talk to me: 554 xxxxxxx)
    I check all the RBL list and the server IP/domain is not blacklisted. So, I started to check the server configuration in case I miss something.
    The server FQDM is mail.somedomain.cl and the reverse DNS point to this domain, and all the other 4 domains I have send the emails using mail.somedomain.cl
    In my registrant for somedomain.cl I have:
    DNS1: ns1.somedomain.cl -> xx.xx.xx.xx
    For DNS2 I use their free service for a secondary DNS and Allow zone transfers to my registrant IP
    DNS records I have:
    Code:
    Yes    A    mail    xx.xx.xx.xx    0    3600   
    Yes    A    somedomain.cl.    xx.xx.xx.xx    0    3600
    Yes    A    ns1    xx.xx.xx.xx    0    3600   
    Yes    A    www    xx.xx.xx.xx    0    3600   
    Yes    MX    somedomain.cl.    mail.somedomain.cl.    10    3600   
    Yes    NS    somedomain.cl.    ns1.somedomain.cl.    0    3600   
    Yes    NS    somedomain.cl.    secundario.nic.cl.    0    3600   <- I use the domain registrant service for secondary NS
    Yes    TXT    dkim._domainkey.somedomain.cl.    v=DKIM1; t=s; p=xxxxxxxxxxxxxx    0    3600   
    Yes    TXT    somedomain.cl.    v=spf1 a mx -all    0    3600   
    Yes    TXT    _dmarc.somedomain.cl.    v=DMARC1; p=none    0    3600
    1- I made some test using the https://mxtoolbox.com/emailhealth/ with the domain mail.somedomain.cl and the report say that mail.somedomain.cl don't have a DNS, SPF, DMARC, DKIM records, but I think this is ok because this records are in somedomain.cl. or I'm wrong?
    2- I need an additional Zone/records for mail.somedomain.cl? (I only have the records above in the somedomain.cl zone)
    3- For testing purpose I create a Mail Domain for mail.somedomain.cl and added the DKIM, and in the somedomain.cl DNS Zone I added the SPF and DMARC records and then mxtoolbox stop telling me about SPF, DMARC and DKIM but continue telling me about no DNS records. I think this is ok to, because I don't have any NS, etc. records for mail.somedomain.cl, only for somedomain.cl. I'm wrong here to? I really need this records or any other?

    Please note: If I make the same test for somedomain.cl there is no problems.

    I'm really lost :(
     
  2. Jesse Norell

    Jesse Norell ISPConfig Developer Staff Member ISPConfig Developer

    Some mail can be sent from the hostname, eg. possibly undeliverable message reports, or system generated mail, so those dns records could come into play then. I'd at least create an SPF record for it, but for the most part, it's your mail domain which matters, not the server's name.
    As just said, I'd at least create an SPF record. DKIM won't be setup for the server's hostname, so no need for that unless you configure that yourself. You don't really need a DMARC record if you're just advertising no policy, and not listing any reporting addresses.
    You should be able to set the records in the parent domain's zone. You might add an MX record for
    mail.somedomian.cl.
     
    CubAfull likes this.
  3. CubAfull

    CubAfull Member

    Thanks @Jesse Norell for taking the time to reply!
    About the MX record for mail.somedomian.cl. How do I have to enter it in ispconfig?
    Hostname: mail.somedomian.cl.
    Mailserver hostname: mail.somedomian.cl.
    Is this correct?
    Another question. With this new configuration, mxtoolbox report a critical error with mail.somedomian.cl because no DNS record is found. You know how to solve this problem? Is this something that needs to be fixed?
     
    Last edited: Jun 5, 2021
  4. Jesse Norell

    Jesse Norell ISPConfig Developer Staff Member ISPConfig Developer

    Yep.
     
    CubAfull likes this.
  5. CubAfull

    CubAfull Member

    Thank you again @Jesse Norell !
    Regarding this error:
    Code:
    Dns Server
    dns:mail.somedomain.cl - 1 Tests Failed
    Category   |            Host                |   Result   
    dns              mail.somedomain.cl      DNS Record not found
    I think this is ok because no NS exist for mail.somedomain.cl, but, is this something that need to be fixed?
    Sorry if I'm asking to much, but in so many years using ISPConfig I never do this "extra" configuration :confused:
    //-------------------------//
    In case other people read this thread and have the MTA's poor reputation problem.
    In my case, I switched to another VPS service and apparently the new assigned IP was used in the past by another user to send spam etc. now the IP is not in any RBL list, but it's blocked by some providers/mail servers :(
     
  6. Jesse Norell

    Jesse Norell ISPConfig Developer Staff Member ISPConfig Developer

    No, you don't need an ns record for that hostname. There are times when you do, eg if you created a dns zone with that name, each zone requires ns records.
     
    CubAfull likes this.

Share This Page