Regarding PTR records for mail gateways and ZoneRunner...

Question

I have a question regarding reverse lookups (and by extension SPF records) for mail gateways in an F5 GTM\LTM deployment scenario.&nbsp;
We have decided to implement 2 F5 load balancers in a pool in order to load balance 2 ISP links for our organization. These load balancers will be sitting outside our Firewall and basically be load balancing traffic passed through the firewall out our 2 ISP links in a round-robin configuration.   In conjunction, we have decided to move our external dns from being hosted on Godaddy to the F5 devices using Zonerunner.   We have all our records configured and have tested everything, but we have some concerns regarding reverse lookups for our mail gateways that we would like to get some assistance on before we go through with our full implementation.  We are concerned specifically about these lookups as we do not want outgoing mail to be rejected by other domains.&nbsp;
Performing an mxlookup of our current records tells us that our PTR records for our mail gateways are correctly pointing to our mail gateways on ISP link 1, and we assume that we simply have to have the ISP update the records for the secondary link to point to the same gateways.   However, we are unsure if this the only change we have to make or if we are required to add the PTR records for the gateways into Zonerunner.  Our research hasn't yielded a concrete answer to this question, and we would like to avoid spending our implementation window scrambling to resolve an outage related to this.  Is there anyone who can provide some insight on this issue?&nbsp;

boricuaking55_1 · Answer

Please feel free to ask me for more information if my question seems unclear&nbsp;

cory_50405 · Answer

Your SPF record should include all email relay hostnames that will relay mail for your domain.  As long as you ensure there's a PTR in place for each sending mail server IP address, and that PTR specifies the hostname of the email relay, then you should be good.&nbsp;
If you can provide more details on your current SPF record and how many email relays you have, I can help ensure you are all setup properly.&nbsp;

boricuaking55_1 · Answer

Thank you for your answer Cory.  We actually do not have an SPF record set that contains the mail gateway host-names (2 nodes, each with an IP address on each link).  Our current plan is to update the PTR record for the secondary link IPs with the two host-names (they are using temporary filler names as of this moment)

cory_50405 · Answer

Just for clarity, reverse lookups (PTR) and SPF (TXT) records are two separate things, both of which receiving mail servers usually check.  Some mail servers will not accept mail from your domain unless it finds an SPF record.  I've encountered some that will always mark messages as spam unless there's an SPF record in place.  It's definitely a good idea to create PTR records for your secondary IP addresses, but you really should create an SPF record as well.

vitaliy_savrans · Answer

Useful link for checking DNS configuration for mailgateways http://mxtoolbox.com (maybe this simple test will answer to your question). For avoiding be in spam lists don't forget about SMTP Reverse Banner Check.

Forum Discussion

Regarding PTR records for mail gateways and ZoneRunner...

7 Replies

Recent Discussions

vulnerabilities (CVE-2020-36363), CVE-2016-0736,CVE-2019-6593-FOR VERSION BIGIP LTM-16.1.4

Chrome V 124+ on MacOS - Virtual Server Access Issue

Port Group on F5OS network setting

Advise on setting up IRULE

F5 iRule to replace host to path

Related Content

API Gateway Mapping - Gartner - F5

Integrating SSL Orchestrator with McAfee Web Gateway-Transparent Proxy

Whats new in NGINX Gateway Fabric 1.2?

Managing ZoneRunner Resource Records with Bigsuds

Using BIG-IP Kubernetes Gateway API Controller