Essential DNS Records for Mail Delivery and Spam Protection
For proper configuration of a public-facing mail server to send and receive emails, it is necessary to configure public DNS records so that other mail servers can find you to send mail to your users, and so that other mail servers will trust you to receive your mail. There are also DNS records designed to protect you from spam and to help other servers to trust that your server is not a spam host. This article attempts to put all the DNS considerations together into one document for your review.
DNS Hosting Provider
Virtually all DNS Hosting Providers facilitate a web browser-based control interface used to modify your DNS records and should provide the technical support needed if you get stuck trying to modify any of the DNS records discussed in this article. Some common DNS Hosting providers consist of companies such as GoDaddy, Network Solutions and DynDNS to name a few. There are possibly hundreds, so shop around if you have not found one yet. Many companies, including your own ISP, might offer DNS hosting on your behalf, but make sure they offer a web-based interface that allows you to have some control over your DNS records and make sure they offer good technical support. All of their interfaces are different, but they accomplish the same basic thing; they allow you to publish your hostnames and important DNS records such as the ones mentioned in this article to the Internet.
Hosting Your Own DNS
From within your DNS web hosting portal, it might be possible to configure it to not host your DNS, but instead to point your NS records someplace else. You could point your NS records to another DNS hosting provider or to your own DNS server at your static IP address. This article does not discuss how to do this, but if you are pointing it to your own DNS servers under your direct control, you must have advanced knowledge of the DNS servers you are managing or must have access to the documentation needed to create the DNS records yourself. This article still may prove useful to let you know what kinds of records you need. You still may need additional references to look up how to create them if you are not an expert with the DNS server you are managing. However, this article is aimed primarily at readers who will be using a web-based DNS hosting service with its own technical support to help them if they need assistance with their DNS.
Static or Dynamic IP Address
Do everything you can to have a static IP address. It is very difficult to run a business with a dynamic home-user Internet plan. If there is no alternative, it might be possible to use something like DynDNS which provides dynamic DNS hosting, but there are drawbacks this article will not cover. This article assumes you have at least one static IP address.
A record maps a name to an address. You will first need an A record for your mail server. Your static IP address from your ISP was the first step. For example, you might log into the web portal for the domain and create an A record for mail for 192.0.2.21. This would create a
mail.example.com published on the Internet. However, mail servers still wouldn't know that this is where to send mail. That's what MX records are for.
Your MX record tells other mail servers the name of the server on the Internet to send mail to for your domain. It is a free text field because it could have any name, including a name that is not part of your domain such as a name of a server from a mail hosting provider or a mail spam filter, for example. If you have the Kerio Connect server with an A record
mail.example.com, you will need to create an MX record that just says
mail.example.com as its value. For additional information, refer to Configuring an MX Record.
The PTR record is a reverse lookup which maps the IP address to the name.
Some mail servers will not trust mail coming from your server unless they can do a reverse DNS lookup. This takes two possible forms. Most mail servers care that a PTR record exists at all. Strict mail servers do a forward lookup on the name your mail server introduces itself as such as
mail.example.com, verify it is the IP address that is read off the connection, and do a PTR lookup on that IP address to see if it resolves to the same name.
A very common mail server is Craigslist. AOL is also famous for doing this check, and they have changed their minds from time to time and taken this check off, but it is impossible to predict when they will put the check back on again because they have several times in the past and still do sometimes.
The PTR record is more difficult than the others because it might require more advanced knowledge of DNS. This PTR record discussion here will assume you do not control your own PTR records. This assumes you own only a small number of IP addresses, and you must call your Internet Service Provider (ISP) to ask them to create a PTR record for you. Knowing the A record for
mail.example.com, you must create a reverse PTR record. Most ISPs have a DNS Services department that can create a PTR record for you. They will ask the name you want, and what IP address you want to assign to that name.
If you must create your own PTR record, you will need to do it in your own DNS hosting services web interface. You might need to call them for support. If you host your own DNS, you will need to create a reverse zone that is not covered in this article.
SPF gives other mail servers a way to verify that mail claiming to be from your domain is from one of your IP addresses. They do this by checking a special TXT record you put in your DNS records. It is an interesting way to prevent mail spoofing. For additional information, refer to Creating an SPF.
Caller-ID was an earlier way to do what SPF does today. As with SPF, Caller-ID gives other mail servers a way to verify that mail claiming to be from your domain is from one of your IP addresses. They do this by checking a special TXT record you put in your DNS records. Caller-ID is not nearly as popular as SPF but does protect you slightly differently than SPF. Because of this, not everyone believes Caller-ID is irrelevant. For additional information, refer to Creating a Caller ID record.