Hello guys I'm breaking my head here with the MX configuration and after 9 hours + I think is time to ask for help. Some days ago I started to see this message in the mail log: Code: Jun 4 19:45:26 mail postfix/smtp[11789]: 278DD801375: host xxxxxxx refused to talk to me: 554-xxxxxxxx 554 Your access to this mail system has been rejected due to the sending MTA's poor reputation. If you believe that this failure is in error, please contact the intended recipient via alternate means. and Jun 4 20:30:29 mail postfix/smtp[14159]: 42F29802281: to=<xxxxxxxxxxx>, relay=xxxxxxxx:25, delay=189401, delays=189398/0.04/2.5/0, dsn=4.0.0, status=deferred (host xxxxxxx refused to talk to me: 554 xxxxxxx) I check all the RBL list and the server IP/domain is not blacklisted. So, I started to check the server configuration in case I miss something. The server FQDM is mail.somedomain.cl and the reverse DNS point to this domain, and all the other 4 domains I have send the emails using mail.somedomain.cl In my registrant for somedomain.cl I have: DNS1: ns1.somedomain.cl -> xx.xx.xx.xx For DNS2 I use their free service for a secondary DNS and Allow zone transfers to my registrant IP DNS records I have: Code: Yes A mail xx.xx.xx.xx 0 3600 Yes A somedomain.cl. xx.xx.xx.xx 0 3600 Yes A ns1 xx.xx.xx.xx 0 3600 Yes A www xx.xx.xx.xx 0 3600 Yes MX somedomain.cl. mail.somedomain.cl. 10 3600 Yes NS somedomain.cl. ns1.somedomain.cl. 0 3600 Yes NS somedomain.cl. secundario.nic.cl. 0 3600 <- I use the domain registrant service for secondary NS Yes TXT dkim._domainkey.somedomain.cl. v=DKIM1; t=s; p=xxxxxxxxxxxxxx 0 3600 Yes TXT somedomain.cl. v=spf1 a mx -all 0 3600 Yes TXT _dmarc.somedomain.cl. v=DMARC1; p=none 0 3600 1- I made some test using the https://mxtoolbox.com/emailhealth/ with the domain mail.somedomain.cl and the report say that mail.somedomain.cl don't have a DNS, SPF, DMARC, DKIM records, but I think this is ok because this records are in somedomain.cl. or I'm wrong? 2- I need an additional Zone/records for mail.somedomain.cl? (I only have the records above in the somedomain.cl zone) 3- For testing purpose I create a Mail Domain for mail.somedomain.cl and added the DKIM, and in the somedomain.cl DNS Zone I added the SPF and DMARC records and then mxtoolbox stop telling me about SPF, DMARC and DKIM but continue telling me about no DNS records. I think this is ok to, because I don't have any NS, etc. records for mail.somedomain.cl, only for somedomain.cl. I'm wrong here to? I really need this records or any other? Please note: If I make the same test for somedomain.cl there is no problems. I'm really lost
Some mail can be sent from the hostname, eg. possibly undeliverable message reports, or system generated mail, so those dns records could come into play then. I'd at least create an SPF record for it, but for the most part, it's your mail domain which matters, not the server's name. As just said, I'd at least create an SPF record. DKIM won't be setup for the server's hostname, so no need for that unless you configure that yourself. You don't really need a DMARC record if you're just advertising no policy, and not listing any reporting addresses. You should be able to set the records in the parent domain's zone. You might add an MX record for mail.somedomian.cl.
Thanks @Jesse Norell for taking the time to reply! About the MX record for mail.somedomian.cl. How do I have to enter it in ispconfig? Hostname: mail.somedomian.cl. Mailserver hostname: mail.somedomian.cl. Is this correct? Another question. With this new configuration, mxtoolbox report a critical error with mail.somedomian.cl because no DNS record is found. You know how to solve this problem? Is this something that needs to be fixed?
Thank you again @Jesse Norell ! Regarding this error: Code: Dns Server dns:mail.somedomain.cl - 1 Tests Failed Category | Host | Result dns mail.somedomain.cl DNS Record not found I think this is ok because no NS exist for mail.somedomain.cl, but, is this something that need to be fixed? Sorry if I'm asking to much, but in so many years using ISPConfig I never do this "extra" configuration //-------------------------// In case other people read this thread and have the MTA's poor reputation problem. In my case, I switched to another VPS service and apparently the new assigned IP was used in the past by another user to send spam etc. now the IP is not in any RBL list, but it's blocked by some providers/mail servers
No, you don't need an ns record for that hostname. There are times when you do, eg if you created a dns zone with that name, each zone requires ns records.
