Support keeps receiving questions about reverse DNS records. Many users have only a vague idea of what they are and how to use them.
You can set reverse records in vpsAdmin for your IP addresses. But users often approach reverse records incorrectly, misunderstand them or use them the wrong way. So how do they work?
A PTR (pointer record) answers a reverse DNS query. Normally, we ask, "Which IP addresses belong to this domain name?" and look for A and AAAA records. But DNS also has a hierarchical tree containing answers to the opposite (reverse) question: "Which domain name belongs to this IP address?"
While forward records are managed by the domain administrator, reverse records are created by the administrator of the allocated IP addresses. The query is automatically made under the top-level domain (TLD) .arpa, specifically in-addr.arpa and ip6.arpa. It works the same way as a forward record: the most specific part is on the left, and the most general on the right. For example:
$ host 37.205.9.45 45.9.205.37.in-addr.arpa domain name pointer mxproxy.vpsfree.cz. $ host 2a01:430:17:1::ffff:427 7.2.4.0.f.f.f.f.0.0.0.0.0.0.0.0.1.0.0.0.7.1.0.0.0.3.4.0.1.0.a.2.ip6.arpa domain name pointer mxproxy.vpsfree.cz.
Why does a reverse record matter? Mail servers receiving mail now check that the two records agree: the domain name points to an IP address whose reverse record points back to the same domain. This is basic spam protection. The administrator is effectively showing control of records in both directions, rather than merely operating a compromised machine that "happens" to send mail.
A common mistake is trying to list every domain for which the mail server will receive mail in the reverse records. That is not how it works. A reverse record contains the server's name, not the domains it manages. Ideally, something like mail.example.com. It must be the name the mail server uses to introduce itself when exchanging mail. For Postfix, this is the configuration setting:
myhostname="mail.example.com"
You can only set one PTR record per IP address. So you have to choose what your server will actually be called. You cannot give one address several domain names.
This setting has no effect on email addresses or the domains that receive mail. The connection between a domain and a mail server is made through an MX record in DNS. This specifies which server should receive mail for a given domain name. Notice that the mail server does not need to be in the same domain at all:
# dig MX vpsfree.org … ;; ANSWER SECTION: vpsfree.org. 1800 IN MX 10 mxproxy.vpsfree.cz. vpsfree.org. 1800 IN MX 15 mx2.vpsfree.cz. …
So to set a reverse record, choose a domain name for your mail server under any subdomain you control. Set that name in vpsAdmin for both your IPv4 and IPv6 addresses. This matters because many mail servers (including Gmail) now use the modern IPv6 protocol, and everything must be correct there too.
You can then configure your mail server however you like, add more domains for receiving mail and use the domain name in the MX records of every domain it should receive mail for. There is no need to change the reverse record again.
The main points:
- set the reverse record in vpsAdmin
- it points to the server's name, not the domains that receive mail
- it always points to just one domain name
- when setting a reverse record, remember the IPv6 address