Please configure your outgoing mail server(s) correctly

[azmke]

I sent an email to Ninjatrader support on Thursday (6/2) and never got a response automated or otherwise. I was dead in the water so I started digging and eventually solved my issue.

This morning I thougth it odd that I never received a response so I dug through our email server logs. Indeed there was an attempted response shortly after I sent my request. The problem however is that the email from ninjatrader support "looks" exactly like spam. That is to say the server sending the message identified itself as "mpls-eh7661-fe01.enginehosting.com" which resolves to 216.250.166.125 however the actual IP address of the sending host was 209.240.81.200 which reverses to "209-240-81-200.static.gippy.net". Sendmail identified this as a forged host and stopped the SMTP conversation immediately.

To summarize I believe there are at least three problems.

1) "mpls-eh7661-fe01.enginehosting.com" resolves to 216.250.166.125 however the reverse is NOT correct. That is 216.250.166.125 reverses to "enginehosting.com". Forward and reverse NEED TO MATCH!

2) The sending host identified itself as "mpls-eh7661-fe01.enginehosting.com" which again resolves to 216.250.166.125 however the actual IP address of the sender was 209.240.81.200.

3) The host "209-240-81-200.static.gippy.net" does not exist. That is the hostname does not resolve to an IP address.

With the configuration that Ninjatrader is using adding "[email protected]" to a whitelist etc., does nothing as mail never makes it that far.

Please read this paragraph, particularly the last two sentences from https://secure.wikimedia.org/wikiped...ed_reverse_DNS

"A FCrDNS verification can create a weak form of authentication that there is a valid relationship between the owner of a domain name and the owner of the network that has been given an IP address. While weak, this authentication is strong enough that it can be used for whitelisting purposes because spammers and phishers can not usually by-pass this verification when they use zombie computers to forge the domains. It is considered good practice in general that all rDNS should be forward confirmed. This is especially true for the IP addresses used by email servers to help prevent outgoing email from being wrongly rejected as spam."

Ideally email should be sent from 74.200.197.238, the listed MX server for ninjatrader.com.

[NinjaTrader_Brett]

Hello,

Thanks for the detailed information.

We very rarely have issues with email being received here at support with our customers so this is the exception not the rule. However I will check into this with my IT manager to see if it possible to make any changes here.

Thanks for your patience, also glad to hear you got the issue resolved.

Finally, you run your own mail server then? Also have you emailed us before from here and got our notes meaning this is something new or is this something that you have never received an email from us in the past?

[azmke]

I'm quite surprised you haven't had more issues as this method of detecting spam is becoming more and more common.

The last contact I had (or have record of) with [email protected] was on 10/29/2008. The outgoing server in that case was "outgoing-cab02.gippy.net" which at that time resolved correctly to 216.250.166.73. As such there was no issue receiving the email.

[NinjaTrader_Lowell]

Hi azmke,

Thank you for your input and information supplied.

Your correct ideally mail should be sent from the listed domain server, but as we have multiple services and multiple servers to ensure high availability at times e-mail will be sent from our secondary serves and or services servers. As for SPF records these are used as a proof of identity for e-mail and can increase the insurance your e-mail are not marked as spam, however due to the sensitivity of the setup and creation of the record not many large e-mail hosting companies and ISPs use them. I am currently looking into creating an SPF record to cover all of our servers but not sure when it will be implemented.

Thank you,