Need help create PTR entry

dynDNS at dedyn.io
1

Hi,

I have created a new domain and added all the usual DNS entries like MX, A, CNAME and TXT etc. needed for my local mail server setup.

All working fine but, sending mails to Gmail or hot mail are failing saying PTR record not found.

I am new to this and unable to figure out how to create one. When reading some documents, they mentioned that I need to create DNS zones and add PTR entry there. Does that mean, I need to create a new domain with in my DeSEC account?

Could you please let me know with instructions on how to create DNS zone and PTR records. Below are example details of my setup:

deSEC Domain Name: abcd.dedyn.io
My mail server domain: mail.abcd.dedyn.io
My Public IP: 123.345.567.789

Thanks for your help in advance.

2

All working fine but, sending mails to Gmail or hot mail are failing saying PTR record not found.

PTR = also known as reverse DNS

You see your current PTR with:

dig -x IP-OF-YOUR-MAILSERVER

It need to bee resolve to mail.abcd.dedyn.io (respectively your smtp HELO message).

You must discuss this topic with the owner of the IP address. Usually your Internet service provider (if we’re talking about a mailserver at your home) or your server provider. If it at your home: Please note that most of these IP addresses are already on various blacklists.

Tipp: Test your mailserver with https://mail-tester.com/ before you use them.

1 Like
3

Thanks @markus for the quick response.

Below is the output I get for the command given (please note that I had to redact my IP address):

root@sl:/var/log# dig -x 123.345.567.789

; <<>> DiG 9.18.12-0ubuntu0.22.04.3-Ubuntu <<>> -x 123.345.567.789
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 45012
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;789.567.345.123.in-addr.arpa.	IN	PTR

;; AUTHORITY SECTION:
345.123.in-addr.arpa.	2326	IN	SOA	ns1.p04.dynect.net. dnsadmin.345.123.in-addr.arpa. 2023092001 10800 3600 604800 86400

;; Query time: 140 msec
;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
;; WHEN: Mon Oct 02 20:18:15 UTC 2023
;; MSG SIZE  rcvd: 120

This is a VPS with a public IP that I self-hosted alias service (simple login) using the dedyn.io subdomain domain.

Based on a few docs I read, I need to create a PTR DNS entry for 789.567.345.123.in-addr.arpa. but not sure how to do it (is it in the same domain I have like abcd.dedyn.io or I need to create a completely new domain)

4

Many if not most mail servers require the reverse lookup of the sending IP to match the hostname (as communicated in the SMTP HELO/EHLO message) of the sending server for unauthenticated senders. This is an anti-spam measure. If the reverse lookup does not match, mails are either rejected out of hand, or their spam score increases which may lead to rejection as well.

The domain where you need to create this PTR record is not your mail domain. It’s is a subdomain of in-addr.arpa. (for IPv4) or ip6.arpa. (for IPv6). As @markus already explained, you need to have the owner of that subdomain create the reverse entry.

For example if your provider owns the IPv4 block 123/8 and they give your server the static IP 123.234.123.25/32 then your provider can affect changes to the subdomain 123.in-addr.arpa and thus set a PTR record on 25.123.234.123.in-addr.arpa. to point to your mail server hostname.

Note however that this will only make sense for static IPs. No sane provider will update PTR records when your dynamic IP changes. And a stale PTR record is as good as none at all.

Basically setting up a mail server on a dynamic IP does not work! (You could set up such a mail server to only relay mail via an authenticated connection to a real mail server, but that would be a special case.) And the inability to set up the reverse lookup is just one of several reasons. E.g. IP ranges used for dynamic IPs generally have a very low reputation which means that they trigger anti-spam measures at the recipient.

Also there is nothing deSEC can do to help you here. They do not own or manage the subdomain needed for the reverse lookup.

HTH
fiwswe

1 Like
5

Is there any situation in which desec can actually manage a PTR record. Or differently put: Why is it possible to add a PTR record to the DNS block here at desec?

6

Hi @wmader,

I’ve added a dummy PTR to one of my domains

image
image2360Ă—365 34.6 KB

7

If one still has a IPv4 Class address range they could directly use the PTR DNS Record.

See Classful network - Wikipedia

8

@wmader PTR records for reverse DNS lookups are a small subset of all PTR records. Your questions imply that you equate “PTR record” with “PTR record for reverse DNS lookups” which is incorrect.

Taking your question literally, yes. deSEC name servers allow setting PTR record types.

PTR records for reverse lookups are a special case though. Not because of any restrictions deSEC places on them but because the owners of the required subdomains correspond to the owners of the IP ranges. So you normally don’t own these subdomains.
If you manage to delegate the appropriate subdomain of in-addr.arpa. (IPv4) or ip6.arpa. (IPv6) to deSEC, then you can add PTR records to suit your needs. But only the owner of that subdomain is able to do that. So your choices are:

  1. Get ownership of the required subdomain. Then delegate it to use deSEC name servers. Then set your PTR records for the reverse DNS lookups.
  2. Get the current owner of the subdomain to set the PTR records for you.

I think you probably meant to ask something different. But to answer the asked question: Because PTR records are not special in any way and deSEC name servers allow most valid record types.

fiwswe

1 Like
9

Thx for your explanations.

1 Like