Multiple A Records - Followup Question

[David Ford]

On 2016-10-02 21:22, Reindl Harald wrote:
>
>
> Am 02.10.2016 um 22:42 schrieb David Ford:
>> On 2016-10-02 12:59, Reindl Harald wrote:
>>>
>>>> IOW, can a given *IP* appear in more than one A record? I realize
>>>> that this does have the problem that the reverses would resolve to
>>>> hostX not
>>>> test
>>>
>>> on IP should only have on PTR - period
>>>
>>> avoid anything else than PTR/A-matching if the machine is supposed to
>>> send outbound mail
>>
>> it is very helpful to have multiple PTR records for an IP on a mail
>> server so anti-spam engines can accurately make fully verified forward
>> and reverse lookups not just for DNS but also certificate verification.
>
> which is *exactly* what you break with *multiple* PTR records for a
> single IP - seems you don't understand what
> https://en.wikipedia.org/wiki/Forward-confirmed_reverse_DNS really means

no, it exactly doesn't break. it exactly applies to -every- domain
served by that mail server with each domain serviced having fully
verified forward and backward reachable chain regardless of how many A
or PTR (and even CNAME) records exist in RR answers, each having their
own domain set in their MX record.

>
>> mail servers that can't correctly emit the right EHLO for outbound email
>> should remain in the 1990s.
>
> yes, and your EHLO matches the A record of your IP
>
> which of the multiple PTR's should the receiving server use?
> guess what: it uses a random one
> one time it matches your EHLO, the next time not

PTR lookup of 1.2.3.4 returns all RR for a.foo.com, b.zee.com,
c.lark.com, where each of these also resolves to 1.2.3.4. it is your
-client- that determines what to do with each RR after it has received
the answer. if your MTA or milter software cannot iterate all the RR
records to find the matching hostname, you should get a better MTA or
milter.

>
> congratulations: you are playing lottery

you're only playing the lottery with MTAs and anti-spam services that
are too naive to understand that multiple records can exist in a single
RR answer and it should utilize all the records.

>
> and yes i had cases where we blocked email because
> check_reverse_client_hostname_access when the mailadmin did request a
> PTR and the ISP was too dumb to remove the generic one which ended in
> some mails hit rules and others not

the notion of a 1-to-1 relationship between A and PTR is a relic of
history. the internet is always evolving and sharing of IPs to host
multiple domains has been around for a long time and increasing
considerably as people try to stretch IPv4 further while waiting for
their upstream to provide IPv6. there are a considerable number of
existing servers that use a many-to-many relationship of A and PTR
records and it's only going to increase as more customers request their
IPs resolve to all of their hosted domains.

the cat and mouse game of spam is always ratcheting upward. as mail
providers get better at blocking half-assed setups due to spam, sending
providers improve their configuration to rise above the spammers. with
the simple fully verified FR of IP/PTR/EHLO, i block more than 87% of
incoming spam right at the edge. i have very very few false positives.

many-to-many works, and i support it's use. i also support the adoption
of MTAs and milters capable of handling modern many-to-many instead of
breaking because they expect a legacy 1-to-1 or 1-to-many RR.