How to properly set up DNS SPF records for a .local server? - email

We send out mail via Microsoft Exchange 2010 running on a Windows Server set up as server.organization.local.
When error messages are generated it shows:
Generating server: server.organization.local
I am confused as to what our SPF records should look like based on this. Should it simply contain the external IP address that this server uses to send out mail, or both this .local address and external IP address?
Currently it is set as:
# 10800 IN SPF "v=spf1 mx a:server.organization.local ip4:10.10.10.10 -all"
The mx is included to be safe but I'm not sure if it needs to be? The MX records on the domain name is set to a third-party filtering service, no mail is sent via it.

You need to specify the public IPs if you want to send emails to the internet.
If you are sending emails to another mail server on the LAN then you might have to add the private IPs as well.
I suggest to use a testing utility to check your SPF records.

Related

Can I run an email Server with a fixed IP only?

I created a web app to do some basic content management for just myself. I want to mail some docs to the server instead of downloading then uploading them. Ive been looking at postfix but everything assumes you have a domain. Is it possible to receive email at a server with a fixed ip and no domain?
if you want anybody and any app to be able to send mail you need MX records in DNS. And MX records point at dns server names, not IP addresses.
https://serverfault.com/questions/663112/why-cant-mx-records-point-to-an-ip-address
If its just you then you can telnet to the SMTP port to send mail

ISPConfig set up reverse DNS

I have an Ubuntu 16.04 server with ISPConfig 3.1.
I set up many websites and emails, but when I send an email to a certain email address I have the following error:
Your server IP address [186.156.31.17] does not have a valid reverse
550-DNS entry [pc-17-31-156-186.cm.vtr.net]. see
550-http://spamauditor.org/best-practices/check_dynamic_reverse_dns/
for
more 550-information. Protection provided by MagicSpam 2.1-8.3 550
http://www.magicspam.com (in reply to RCPT TO command)
How can I set up reverse DNS in ISPConfig? I learned that I need a PTR record but I'm not sure how to do it correctly.
This isn't something you can configure from your end unless your ISP has specifically given you the ability to do it.
Linode, for example has a button for it, but if you don't, you would need to contact your ISP.
Normally individuals don't have access to the rDNS records

Setting up various DNS records for my mail server with external DNS

I have a domain name, mysite.com registered with a provider at ns1.dnsprovider.com and ns2.dnsprovider.com.
mysite.com is a Wordpress site on WHM/cPanel at IP: 111.222.333.444
I can set my DNS records at DNSProvider to point at 111.222.333.444 for the websites - no problem. I also need to set up email facilities.
This I'm struggling with. I'm simply running the standard Exim package in cPanel.
I figure I need to set up an A record mail.mysite.com for IP 111.222.333.444 but I also need to set up MX records. Would this be to mail.mysite.com with priority 0 and 10?
Also what about DKIM and SPF records? What would I need to enter?
First a quick note: If the mail server is on the same IP address you do not need the extra A record, since there is already an A record the MX record can use.
As for the MX record, it depends on what the mail addresses will be. For the one you mentioned the mail addresses will be user#mail.example.com, if you want them to be user#example.com, then the MX record must be for example.com, like this:
# MX 10 mail.example.com.
Where mail.example.com is the extra A record you wanted to create, you can also point the record to example.com, since it has an A record pointed to the IP of the mail server.
Now for the SPF record it depends on which servers will be send mails on behalf of your domain. If only your server (this includes your web site, since they are on the same IP) the SPF record can be like this:
# TXT "v=spf1 a -all"
This allows the IP of your A record to send mails and "forbids" everybody else.
The DKIM record is in the following format:
default._domainkey TXT "v=DKIM1; p=yourPublicKey"
You should generate yourPublicKey and also a private key, with which you will sign your mails (note that you can simply skip the whole DKIM part)

AWS EC2 Reverse DNS (PTR) Failing

Have searched everywhere, can't find answer.
I have the domain mydomain.com. The root and www records point to my main server, which runs my website.
I am now using a separate AWS ec2 instance to set up an email server for my domain. This is running on the subdomain mail.
My dns looks like this:
A # webserverip
A www webserverip
A mail ec2ip
To prevent my server from getting flagged for spam, I submitted the amazon reverse dns form here: https://aws.amazon.com/forms/ec2-email-limit-rdns-request
I gave them the ip of my ec2 mail server, and put "mail.mydomain.com" in the "Reverse DNS Record for EIP 1" box.
However, I keep receiving emails back from them saying:
When attempting to map the reverse DNS entry, we notice that this is failing because the PTR record doesn't match the A record for that domain.
We currently require the forward A record to match the PTR record for all reverse DNS entries.
I really don't understand what I am doing wrong. The "mail" subdomain has an A record pointing to my ec2 server ip. Any assistance would be greatly appreciated!
(I am using cloudflare for my dns if this makes any difference)
You can follow these steps to configure the DNS for your EC2 dedicated mail server on AWS:
STEPS
Add two A host records for pop.mydomain.com and
smtp.mydomain.com that point to your elastic IP and assign your
MX record to the smtp.mydomain.com host.
Add a CNAME record (not A host record) for mail.mydomain.com that points to the DNS entry assigned by AWS (e.g., ec2-XXX-XXX-XXX-XXX.REGION.compute.amazonaws.com).
Submit your rDNS request for smtp.mydomain.com mapping to your EIP.
Don't forget to add the SPF TXT record for your mail server. For example, v=spf1 mx a
Once you're done with this setup, you should have a proper mail server configuration in terms of DNS that would pass SMTP tests and avoids being flagged as spam.

Set up mail.mydomain.com to point to dedicated server

I currently have a domain name which is set to point to Amazon Cloudfront's nameservers. I also have a dedicated server which uses WHM/cPanel that I want to use for all mail.
On Amazon:
The A record for the domain is set to point to the server IP
The MX record is set up as well
On Server:
I have an A record for "mail" that points to the server IP
However, when I log into cPanel webmail, I can send mail but cannot receive it.
Any help would be greatly appreciated. Some type of routing issue I am assuming? When I send an email via Gmail to myemail#mydomain.com, it does not bounce back.
I fixed it by changing the MX record from mydomain.com. to mail.mydomain.com. and then having the A record for mail point to the server IP.