hmLoadTopic({
hmKeywords:"Reverse Lookup",
hmTitle:"Reverse Lookup",
hmDescription:"With the options on this screen, MDaemon can be configured to do a reverse lookup on the domain passed in the HELO\/EHLO and MAIL commands. When performing the lookups MDaemon...",
hmPrevLink:"security--relay_settings.html",
hmNextLink:"security--pop_before_smtp.html",
hmParentLink:"security_menu.html",
hmBreadCrumbs:"<a href=\"security_menu.html\">Security Menu<\/a> &gt; Security Manager &gt; Security Settings",
hmTitlePath:"Security Menu > Security Manager > Security Settings > Reverse Lookup",
hmHeader:"<h1 class=\"p_Heading1\" style=\"page-break-after: avoid;\"><span class=\"f_Heading1\">Reverse Lookup<\/span><\/h1>\n\r",
hmBody:"<p class=\"p_BodyText_Center\"><img style=\"margin:0 auto 0 auto;width:32.5625rem;height:26.9375rem;border:none\" src=\".\/images\/security-settings_reverse-lookups.png\"\/><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">With the options on this screen, MDaemon can be configured to do a reverse lookup on the domain passed in the <\/span><span style=\"font-family: \'Courier New\',Courier,monospace; color: #010100;\">HELO\/EHLO<\/span><span class=\"f_BodyText\"> and <\/span><span style=\"font-family: \'Courier New\',Courier,monospace; color: #010100;\">MAIL<\/span><span class=\"f_BodyText\"> commands. When performing the lookups MDaemon will attempt to acquire all of the MX and A record IP addresses for the given domain. Then the IP of the server making the connection is compared to this list in an attempt to determine whether the sender might be using a forged identity. <\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">You can also perform reverse lookups on pointer records (PTR) of incoming IP addresses. When using this option the connection can be aborted or a warning header inserted into the message if the incoming IP address does not match any PTR record.<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">Finally, it is generally agreed that accepting mail from sources that identify themselves by using a domain that does not exist should be optional. Therefore, a switch exists that makes it possible for you to refuse messages for which the reverse lookup process returns a &quot;domain not found&quot; message from the DNS server. In such cases, MDaemon will return a <\/span><span style=\"font-family: \'Courier New\',Courier,monospace; color: #010100;\">451<\/span><span class=\"f_BodyText\"> error code, refuse to accept the message, and then allow the SMTP session to progress. However, should you wish to return a <\/span><span style=\"font-family: \'Courier New\',Courier,monospace; color: #010100;\">501<\/span><span class=\"f_BodyText\"> error code, close the socket connection, or do both, other switches are provided for those purposes.<\/span><\/p>\n\r<p class=\"p_BodyText\"><span class=\"f_BodyText\">Trusted IP addresses and localhost (127.0.0.1) are always exempt from reverse lookups.<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Perform PTR lookup on inbound SMTP connections<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Enable this option if you want MDaemon to perform pointer record lookups on all inbound SMTP connections.<\/span><\/p>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">...send 501 and close connection if no PTR record exists (caution)<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_ControlIndent2\">If this box is checked then MDaemon will send a <\/span><span style=\"font-family: \'Courier New\',Courier,monospace; color: #010100;\">501<\/span><span class=\"f_ControlIndent2\"> error code (syntax error in parameters or arguments) and close the connection if no PTR record exists for the domain.<\/span><\/p>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">...send 501 and close connection if no PTR record match<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_ControlIndent2\">If this box is checked then MDaemon will send a <\/span><span style=\"font-family: \'Courier New\',Courier,monospace; color: #010100;\">501<\/span><span class=\"f_ControlIndent2\"> error code (syntax error in parameters or arguments) and close the connection if the result of a pointer record lookup fails to match.<\/span><\/p>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">Exempt authenticated sessions<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_ControlIndent2\">Click this option if you wish to defer the PTR lookup on inbound SMTP connections until after the SMTP MAIL command in order to see whether or not the connection will use authentication.<\/span><\/p>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">Exempt List<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_ControlIndent2\">Click this button to open the PTR Lookup<\/span><span class=\"f_ControlIndent2\"> Exempt List, on which you can specify IP addresses that will be exempt from PTR reverse lookups.<\/span><\/p>\n\r<p class=\"p_CenteredHLine\" style=\"border-right: none; border-bottom: none; border-left: none;\"><span class=\"f_CenteredHLine\">&nbsp;<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Perform lookup on HELO\/EHLO domain<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Click this box if you want a lookup to be performed on the domain name that is reported during the <\/span><span style=\"font-family: \'Courier New\',Courier,monospace; color: #010100;\">HELO\/EHLO<\/span><span class=\"f_ControlIndent\"> portion of the session. The <\/span><span style=\"font-family: \'Courier New\',Courier,monospace; color: #010100;\">HELO\/EHLO<\/span><span class=\"f_ControlIndent\"> command is used by the client (sending machine) to identify itself to the server. The domain name passed by the client in this command is used by the server to populate the <\/span><span style=\"font-family: \'Courier New\',Courier,monospace; color: #010100;\">from<\/span><span class=\"f_ControlIndent\"> portion of the <\/span><span style=\"font-family: \'Courier New\',Courier,monospace; color: #010100;\">Received<\/span><span class=\"f_ControlIndent\"> header.<\/span><\/p>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">...send 501 and close connection on forged identification (caution)<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_ControlIndent2\">Click this check box if you want a 501 error code to be sent and then the connection closed when the result of the lookup appears to be a forged identification.<\/span><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 3.0625rem 0.8750rem 3.0000rem;\"><table style=\"background-color:#ffffe6; border:solid thin #000000; border-spacing:0;\">\n\r<tr>\n\r<td style=\"vertical-align:top; width:3.1250rem; height:3.1250rem; padding:0.3125rem; border:none\"><p class=\"p_NoFormat\"><img style=\"margin:0;width:3.1250rem;height:3.1250rem;border:none\" src=\".\/images\/forbidden_50_yback.gif\"\/><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; padding:0.3125rem; border:none\"><p class=\"p_Notes\"><span class=\"f_Notes\">When the result of a reverse lookup states that the server is using a forged identification, this result may frequently be incorrect. It is very common for mail servers to identify themselves with values that do not match their IP addresses. This can be due to ISP limitations and restrictions and other legitimate reasons. For this reason, you should exercise caution before enabling this option. It is likely that using this option could result in your server refusing some legitimate messages.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">Refuse to accept mail if a lookup returns <\/span><span style=\"font-size: 0.80rem; font-family: \'Times New Roman\',Times,Georgia,serif; font-weight: bold;\">\'<\/span><span class=\"f_ControlHeading2\">domain not found<\/span><span style=\"font-size: 0.80rem; font-family: \'Times New Roman\',Times,Georgia,serif; font-weight: bold;\">\'<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_ControlIndent2\">When a lookup results in &quot;<\/span><span style=\"font-family: \'Courier New\',Courier,monospace; color: #010100;\">domain not found<\/span><span class=\"f_ControlIndent2\">&quot;, enabling this option will cause the message to be refused with a <\/span><span style=\"font-family: \'Courier New\',Courier,monospace; color: #010100;\">451<\/span><span class=\"f_ControlIndent2\"> error code (Requested action aborted: local error in processing) and then the session will be allowed to progress normally to its conclusion.<\/span><\/p>\n\r<p class=\"p_ControlHeading3\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading3\">...send 501 error code (normally sends 451 error code)<\/span><\/p>\n\r<p class=\"p_ControlIndent3\"><span class=\"f_ControlIndent3\">Enable this checkbox if you want the error code that is sent in response to a &quot;domain not found&quot; result to be <\/span><span style=\"font-family: \'Courier New\',Courier,monospace; color: #010100;\">501<\/span><span class=\"f_ControlIndent3\"> (syntax error in parameters or arguments) instead of <\/span><span style=\"font-family: \'Courier New\',Courier,monospace; color: #010100;\">451<\/span><span class=\"f_ControlIndent3\">.<\/span><\/p>\n\r<p class=\"p_ControlHeading3\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">...and then <\/span><span class=\"f_ControlHeading3\">close<\/span><span class=\"f_ControlHeading2\"> the connection<\/span><\/p>\n\r<p class=\"p_ControlIndent3\"><span class=\"f_ControlIndent3\">Click this checkbox if you want the connection to be closed immediately instead of allowed to progress when &quot;<\/span><span class=\"f_PlainText\">domain not found<\/span><span class=\"f_ControlIndent3\">&quot; is the result of the reverse lookup.<\/span><\/p>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">Exempt authenticated sessions<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_ControlIndent2\">Click this option if you wish to defer the lookup until after the SMTP MAIL command in order to see whether or not the connection will use authentication.<\/span><\/p>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">Exempt List<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_ControlIndent2\">Click this button to open the HELO\/EHLO Lookup<\/span><span class=\"f_ControlIndent2\"> Exempt List, for listing IP addresses and domain\/host names of sites that you wish to exempt from HELO\/EHLO reverse lookups.<\/span><\/p>\n\r<p class=\"p_CenteredHLine\" style=\"border-right: none; border-bottom: none; border-left: none;\"><span class=\"f_CenteredHLine\">&nbsp;<\/span><\/p>\n\r<p class=\"p_ControlHeading\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading\">Perform lookup on value passed in the MAIL command<\/span><\/p>\n\r<p class=\"p_ControlIndent\"><span class=\"f_ControlIndent\">Enabling this switch will cause a lookup to be performed on the domain name that is passed during the <\/span><span style=\"font-family: \'Courier New\',Courier,monospace; color: #010100;\">MAIL<\/span><span class=\"f_ControlIndent\"> command portion of the mail transaction. The address passed in the <\/span><span style=\"font-family: \'Courier New\',Courier,monospace; color: #010100;\">MAIL<\/span><span class=\"f_ControlIndent\"> command is supposed to be the reverse-path for the message, and is usually the mailbox from which the message is originating. Sometimes, however, it is the address to which error messages should be directed instead.<\/span><\/p>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">...send 501 and close connection on forged identification (caution)<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_ControlIndent2\">Click this check box if you want a 501 error code to be sent and then the connection closed when the result of a lookup appears to be a forged identification.<\/span><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 3.0625rem 0.8750rem 3.0000rem;\"><table style=\"background-color:#ffffe6; border:solid thin #000000; border-spacing:0;\">\n\r<tr>\n\r<td style=\"vertical-align:top; width:3.1250rem; height:3.1250rem; padding:0.3125rem; border:none\"><p class=\"p_NoFormat\"><img style=\"margin:0;width:3.1250rem;height:3.1250rem;border:none\" src=\".\/images\/forbidden_50_yback.gif\"\/><\/p>\n\r<\/td>\n\r<td style=\"vertical-align:top; padding:0.3125rem; border:none\"><p class=\"p_Notes\"><span class=\"f_Notes\">When the result of a reverse lookup states that the server is using a forged identification, this result may frequently be incorrect. It is very common for mail servers to identify themselves with values that do not match their IP addresses. This can be due to ISP limitations and restrictions and other legitimate reasons. For this reason, you should exercise caution before enabling this option. It is likely that using this option could result in your server refusing some legitimate messages.<\/span><\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">Refuse to accept mail if a lookup returns no MX records (caution)<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_ControlIndent2\">Check this box if you wish to refuse MAIL from domains that do not have MX records. This option is disabled by default and should be used with caution, because domains do not need MX records in order to exist, be valid, or send\/receive mail.<\/span><\/p>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">Refuse to accept mail if a lookup returns <\/span><span style=\"font-size: 0.80rem; font-family: \'Times New Roman\',Times,Georgia,serif; font-weight: bold;\">\'<\/span><span class=\"f_ControlHeading2\">domain not found<\/span><span style=\"font-size: 0.80rem; font-family: \'Times New Roman\',Times,Georgia,serif; font-weight: bold;\">\'<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_ControlIndent2\">When a lookup results in &quot;<\/span><span style=\"font-family: \'Courier New\',Courier,monospace; color: #010100;\">domain not found<\/span><span class=\"f_ControlIndent2\">&quot;, enabling this option will cause the message to be refused with a <\/span><span style=\"font-family: \'Courier New\',Courier,monospace; color: #010100;\">451<\/span><span class=\"f_ControlIndent2\"> error code (Requested action aborted: local error in processing) and then the session will be allowed to progress normally to its conclusion.<\/span><\/p>\n\r<p class=\"p_ControlHeading3\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading3\">...send 501 error code (normally sends 451 error code)<\/span><\/p>\n\r<p class=\"p_ControlIndent3\"><span class=\"f_ControlIndent3\">Enable this checkbox if you want the error code that is sent in response to a &quot;domain not found&quot; result to be <\/span><span style=\"font-family: \'Courier New\',Courier,monospace; color: #010100;\">501<\/span><span class=\"f_ControlIndent3\"> (syntax error in parameters or arguments) instead of <\/span><span style=\"font-family: \'Courier New\',Courier,monospace; color: #010100;\">451<\/span><span class=\"f_ControlIndent3\">.<\/span><\/p>\n\r<p class=\"p_ControlHeading3\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading3\">...and then close the connection<\/span><\/p>\n\r<p class=\"p_ControlIndent3\"><span class=\"f_ControlIndent3\">Click this checkbox if you want the connection to be closed immediately instead of allowed to progress when &quot;<\/span><span style=\"font-family: \'Courier New\',Courier,monospace; color: #010100;\">domain not found<\/span><span class=\"f_ControlIndent3\">&quot; is the result of the reverse lookup.<\/span><\/p>\n\r<p class=\"p_ControlHeading2\" style=\"page-break-after: avoid;\"><span class=\"f_ControlHeading2\">Exempt list<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_ControlIndent2\">Click this button to open the MAIL Lookup<\/span><span class=\"f_ControlIndent2\"> Exempt List. On it you can designate the IP addresses and domain\/host names of sites that you wish to exempt from MAIL reverse lookups.<\/span><\/p>\n\r<p class=\"p_ControlIndent2\"><span class=\"f_ControlIndent2\">&nbsp;<\/span><\/p>\n\r"
})
