Reverse DNS question

[Darren Pilgrim]

On 2/18/2014 3:06 PM, Janos Dohanics wrote:
> My Postfix logs show entries like this:
>
> Feb 18 08:35:13 barrida postfix/smtpd[86649]: connect from unknown[207.238.171.17]
> Feb 18 08:35:13 barrida postfix/smtpd[86705]: connect from spam2.continental-realestate.com[207.238.171.17]
>
[...]
> # host 207.238.171.17
> 17.171.238.207.in-addr.arpa domain name pointer mail1.continental-realestate.com.
> 17.171.238.207.in-addr.arpa domain name pointer mail.continental-realestate.com.
> 17.171.238.207.in-addr.arpa domain name pointer spam2.continental-realestate.com.

> 1. Other than network congestion, what might cause this recurring name
> resolution failure?

There are a couple of issues with the above:

1. More than one PTR record for a given IP address is a 
misconfiguration.  It is supported and there is no RFC saying you must 
not have more than one, but in practice most software will only look for 
one and thus only take the first PTR RR returned from the query.

2. mail1 and mail do not resolve to 207.238.171.17, so you only have 
forward-confirmed reverse DNS (FCRDNS) for spam2.  Postfix will use the 
hostname of "unknown" for anything that does not have FCRDNS.