Forum OpenACS Q&A: re: reverse DNS for openacs.org

It's possible Openforce fixed the problem, but it looks like a DNS resolution error on your end.

Basically, your SMTPD is saying it couldn't do a reverse lookup on 208.184.248.88, which for me at the moment does resolve.

If you're trying to get Postfix to run in a chrooted environment, I hear you have to take extra steps to get reverse DNS lookup to work.

Also, be aware that if you reject mail from servers that don't have a reverse lookup in DNS you're going to reject a lot of legit email along with the SPAM. It's a sad fact that many networks have broken reverse DNS delegation.

A forward record and a reverse record don't have to match.

Think of the situation where one IP address is virtually hosting 4 domains.

Each domain record will have an A record associated with it, all pointing to the same IP address. But, that IP address can only have one reverse record.

Actually, there is an A record:

[root@ns1 named]# host openacs.org
openacs.org has address 208.184.248.88

And a PTR record:

[root@ns1 named]# host 208.184.248.88
88.248.184.208.in-addr.arpa domain name pointer 208.184.248.88.openforce.net.

But there's no A record for the hostname returned by the PTR:

[root@ns1 named]# host 208.184.248.88.openforce.net
Host 208.184.248.88.openforce.net not found: 3(NXDOMAIN)

The real problem is the hostname returned by the PTR doesn't have an A record associated with it (as you say). But that's a common situation. Heck, my own DNS has some placeholder PTR records such as this.

I agree it's a good idea to have to have a match between the A record for the hostname returned by the PTR record. But in reality, if you're doing email verification checks by making sure the PTR matches the A (as resolved by the SMTPD HELO/EHLO) you're gonna reject a lot of legit email--lots of folks have broken reverse DNS.