What should be the PTR for a mail server which is also a web server?

TL;DR It's entirely allowable for one IP to have multiple PTR records, but if you prefer to stick with one, go with mail.example.com.

Long version:

As per the DNS reverse lookup specs, it's perfectly okay to have multiple PTR records for one IP. It's not usually done, but the spec doesn't forbid it.

That said, the reason it's not usually done is because there's rarely a reason for it. As an example, in the case you cite there's really no reason why a webserver's reverse lookup should match all or even any of the hostnames of the sites it serves.

SMTP, on the other hand, has been gradually tightening up its concept of security over the past few decades due to massive amounts of spam, and most spam filters nowadays at the very least attach a nontrivial "weight" to the flag of "Reverse lookup does not match forward lookup" because it implies that the sending server may not be who it claims to be. More strictly configured filters may even refuse to accept mail outright from a server whose forward and reverse lookups don't match.

By having both the forward A record and the reverse PTR record match the name the mail server uses to identify itself during the HELO/EHLO handshake you demonstrate that the person who configured the server has the administrative ability to change the DNS entries for that server as well, making it more likely to be a legitimate server -- or at least, more likely to be accountable.

ETA Another thing that would be wise to do if you have control over your DNS settings is to add a SPF (Sender Policy Framework) record that positively identifies your server by IP and hostname as being authorized to send mail from your domain. Sites like the SPF Wizard can help you construct what said record would need to look like.

Shadur

Posted 2014-09-07T04:42:37.380

Reputation: 1 732

With the added detail that the name referenced in the MX record for example.com is the important one here. The A and PTR records for that name/IP should match. If mail.example.com is in the MX record for example.com, then this is correct. – milli – 2014-09-11T04:43:37.647

@milli Not necessarily. He's talking about an outgoing mail server; this is not always the same as the incoming mail server, and only the latter would be listed in the MX records. – Shadur – 2014-09-11T04:48:05.603

Most MTAs check SPF records on senders, so yes, it does matter in both directions. – milli – 2014-09-11T04:51:28.863

SPF records, yes. MX records, not necessarily. Again, they're not intrinsically the same thing even though most SPF records contain a mx stanza. – Shadur – 2014-09-11T06:45:26.690

@milli That said, good point about SPF, answer amended to include. – Shadur – 2014-09-11T06:48:05.190

OP says his server hostname is server1.example.com which is different from the envelope sender header mail.example.com. Won't the HELO/EHLO still be server1.example.com? And if A record already has a *.example.com, does he need to add anything there? – Question Overflow – 2014-09-11T08:37:58.857

@questionOverflow That depends. If his SMTP software is set to introduce itself with its hostname, it'll HELO as server1.example.com; if it's set to identify as mail.example.com then it'll HELO as mail.example.com. For instance, in Postfix this is determined by the mailname configuration setting in main.cf. – Shadur – 2014-09-11T08:46:20.997

@QuestionOverflow Using a wildcard A record would help in the forward lookup, but be of no use at all during the reverse check. – Shadur – 2014-09-11T08:47:10.037

1Yes, he would need a PTR for the reverse check. But does the domain in the forward lookup need to match the reverse exactly? i.e. is matching example.com sufficient enough for the mail to pass SPAM check using FCrDNS or does the mail/server1.example.com need to be added to the A record? – Question Overflow – 2014-09-11T08:55:10.300

@QuestionOverflow You appear to misunderstand how a wildcard A record works. If your zone information says that (for instance) *.example.com points to 1.2.3.4, a lookup of mail.example.com will return 1.2.3.4 as will a lookup of server1.example.com as will a lookup of supercalifragulisticespiallidocious.example.com. As far as the asker is concerned, there is no difference between an answer derived from a wildcard and an answer with a specific record. – Shadur – 2014-09-11T08:58:02.810

Quoting from the OP mail.example.com, do I have to add this name to both A and PTR records. That is also part of what the OP is trying to find out right? – Question Overflow – 2014-09-11T09:01:38.697

Let us continue this discussion in chat.

– Shadur – 2014-09-11T09:03:40.693

Sorry, I have problem logging in to chat every time I try to use it. Would prefer to use the comment. Thanks. – Question Overflow – 2014-09-11T09:04:44.047

@questionoverflow Judging by the original question, the OP doesn't understand what they're asking terribly well either, which is why I attempted to explain what's actually going on and went from there. You, on the other hand, are starting to badly derail the discussion by adding hypotheticals that the OP didn't ask about and may not even be in play, and I have better things to do with my time than try educating two people, one of whom seems to be acting deliberately obtuse. – Shadur – 2014-09-11T09:09:25.953

What should be the PTR for a mail server which is also a web server?

Answers