Preventing your smtp server being marked as spam sender


So my last post talked about setting up an smtp server strictly for the purpose of sending e-mail out.  Google sometimes categorizes such server as a bulk sender. Mail servers don’t usually like bulk senders, since they, for the most part are source of spams and advertisements. Below are a couple of pointers that could be useful in avoiding your smtp server being marked as a spam sources by receiving smtp server as well as DNSBL and RBL.

1. PTR Records
Always make sure that you can resolve a reverse DNS queries for each of your smtp servers. Meaning, you have to have a PTR Records of each of the IP for your smtp servers pointing to the correct FQDN. If your public IPs are provisioned by an internet provider, ask them to do it for you. As an example, this is a DNS query for sendx.mach5.web.id

surfer@M5-F-x-II:~$ dig sendx.mach5.web.id

; <<>> DiG 9.9.5-3ubuntu0.2-Ubuntu <<>> sendx.mach5.web.id
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18741
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;sendx.mach5.web.id.        IN    A

;; ANSWER SECTION:
sendx.mach5.web.id.    300    IN    A    www.xxx.yyy.zzz

A properly installed receiving smtp server would typically check to make sure that the IP really resolves to that particular FQDN, -in this case sendx.mach5.web.id- by performing reverse query:

surfer@M5-F-x-II:~$ dig -x www.xxx.yyy.zzz

; <<>> DiG 9.9.5-3ubuntu0.2-Ubuntu <<>> -x www.xxx.yyy.zzz
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23772
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 13, ADDITIONAL: 25

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;zzz.yyy.xxx.www.in-addr.arpa.    IN    PTR

;; ANSWER SECTION:
zzz.yyy.xxx.www.in-addr.arpa. 60 IN    PTR    sendx.mach5.web.id.

2. DKIM
DKIM, or Domain Key Identified Email allow a sender smtp server to digitally sign each outgoing email. The receiving smtp server will then compare the signature to a public key that we must publish on our DNS server. There can be as many DKIM public keys as servers that send and sign mail. Certain domain have specific requirements in regards to your keys. For example,  Google will only accept 1024-bit or longer keys.

surfer@M5-F-x-II:~$ dig mail._domainkey.mach5.web.id TXT

; <<>> DiG 9.9.5-3ubuntu0.2-Ubuntu <<>> mail._domainkey.mach5.web.id TXT
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 64563
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 5, ADDITIONAL: 9

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;mail._domainkey.mach5.web.id.    IN    TXT

;; ANSWER SECTION:
mail._domainkey.mach5.web.id. 295 IN    TXT    "v=DKIM1\; k=rsa\; s=email\; " "p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsxBsq0lUqpwjpg1/5LioX5sCYgm34FBeJL0zUDY3kH2HJKfcq7VGdGPf/rJTlba4aNhrgtHOQvxIndRgLwCHeUMd8uhx/3zTT20IHmLcgzHGQyb 6YsW6RXdVQ4UtDVA7rkOAKtxHn4QhZ2eChmF4uqw0qxTefcy3gjx/O/j2S0NAFcv9Ss73bsfpTyZZzwym4ZNd5B0+ja4YgL" "9DjtUh1IlHEnYN/4asqLHk2qcTWx72grzchMNI+kvj/yw0iFZmkMHVWl5eaPS2MUfVplidUSMQ4/llqxuR3KaJ7KVfj6OIheJhxwJwsTlnyaU5jslEQmuhKoe8lvJNpVxb5AfyUQIDAQAB"

3. SPF Records
A Sender Policy Framework or SPF record for short, within a DNS servers identifies which hosts are allowed to act as a sender smtp server and, thus are allowed to send e-mail from. For example, a record saying “v=spf1 +mx +ip4:www.xxx.yyy.zzz -all” means that all hosts identified on mx records of a domain, along with a node with an ip of http://www.xxx.yyy.zzz are allowed to send e-mails. The tailing “-all” means that anything beyond those mentioned earlier are prohibited from initiating smtp transfer.

surfer@M5-F-x-II:~$ dig @ns4.zoneedit.com mach5.web.id txt

; <<>> DiG 9.9.5-3ubuntu0.2-Ubuntu <<>> @ns4.zoneedit.com mach5.web.id txt
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14096
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;mach5.web.id.            IN    TXT

;; ANSWER SECTION:
mach5.web.id.        300    IN    TXT    "v=spf1  +mx +ip4:www.xxx.yyy.zzz -all"

Here is an example of a header of an email that is sent from an smtp server that passes both DKIM and SPF checks:

Delivered-To: manicprincess@gmail.com 
Received: by 10.107.129.156 with SMTP id l28csp40181ioi; Fri, 3 Jul 2015 
 13:02:51 -0700 (PDT) 
X-Received: by 10.70.131.232 with SMTP id op8mr78750335pdb.156.1435953771641; 
 Fri, 03 Jul 2015 13:02:51 -0700 (PDT) 
Return-Path: <surfer@mach5.web.id> 
Received: from sendx.mach5.web.id (sendx.mach5.web.id. [www.xxx.yyy.zzz]) by 
 mx.google.com with ESMTPS id iv9si2025187pac.228.2015.07.03.13.02.49 for 
 <manicprincess@gmail.com> (version=TLSv1.2 
 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 03 Jul 2015 13:02:50 
 -0700 (PDT) 
Received-SPF: pass (google.com: domain of surfer@mach5.web.id designates 
 www.xxx.yyy.zzz as permitted sender) client-ip=www.xxx.yyy.zzz; 
Authentication-Results: mx.google.com; spf=pass (google.com: domain of 
 surfer@mach5.web.id designates www.xxx.yyy.zzz as permitted sender) 
 smtp.mail=surfer@mach5.web.id; dkim=pass header.i=@mach5.web.id 
Date: Fri, 03 Jul 2015 13:02:50 -0700 (PDT) 
Message-Id: <5596ea6a.a9c5420a.56f3b.ffffe1d9SMTPIN_ADDED_MISSING@mx.google.com> 
Received: from there (unknown [111.94.73.41]) by sendx.mach5.web.id (Postfix) 
 with ESMTPA id 6E1282051B for <manicprincess@gmail.com>; Fri,  3 Jul 2015 
 20:01:31 +0000 (UTC) 
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mach5.web.id; s=mail; 
 t=1435953752; bh=anQIPAvuDwk4z578Dwusrv+mIrvhJ6rNL3LgH2M7xKk=; 
 h=FROM:TO:subject:From; 
 b=myVdAcO/thC1wEWRCCFtRZeIfW9TBYsudx49GAuoQI515hFc37hMFSilxU/abqsCD 
 N1tRtRstZOKzY0PhkwtkzozHgnQY33VAbpxczOBt32q74W9gUxnKmvEGOg3XmIvHAu 
 O+8TpG3pw9Qf/4S9TfyasJdVcI9lQxNrzL8ufjMvlDWynRSck08dwuDgmh2lCLMZbA 
 TGTXxDNCakU56bixAL3wsD7B817inh7yxe3sXoTk3YGyknJ58zATHSfUlj51VJlPd1 
 2KoJ5sdvjgR97xps9WvfmSZDKZjpC4Gf+LR/r2RWa131pgLVcYvwyDgf3cXX+y+Jaf 
 f5oxbmRMIIkuw== 
FROM: surfer@mach5.web.id 
TO:manicprincess@gmail.com 
subject: is this the real life 
 
is this just fantasy?

As you can see this email passed SPF record check, as well as being signed with to correct DKIM key.

4. Prevent open relay
To make sure that other smtp servers do not brand ours as spam sender, we do really need to make sure that our smtp servers are actually not sending them. Some receiving smtp servers are set to check whether a sending smtp server is listed on a DNSBL or RBL. There are a couple of them, some are freely accessible while others require subscription, and the best way to make sure that our smtp servers are not listed in one or more, is not to send spam at all. If one of your host or subnets made it to the list, you can usually ask for delisting. That however, would only last until your smtp server is caught sending them again and make it back to the list.  There a couple of things we can do, such as enabling authentication, so only emails sent from an authenticated sender are allowed to relay, or only allow client connection within our internal network or perhaps,  only accepting senders with certain ” from address”.

So there you have it, I hope it help who are looking for answers about this kind of stuff 🙂

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s