反向 DNS 和 SMTP
我正在为我的 SMTP 服务器实施转发确认的反向 DNS。阅读了一些内容后，我发现最好在 SMTP 连接另一端找到的 IP 进行查找（而不是在邮件标头中，因为该 IP 更容易被欺骗）。获得主机名后，我可以将其与标头中的“发件人”电子邮件域进行比较，并确定电子邮件是否有效。
然而，我进一步思考并意识到这可能不是我想要查找的 IP。如果电子邮件在到达我的途中必须经过多个 SMTP 服务器，那么 SMTP 连接另一端的 IP 是否不会将 DNS 反向返回到“最后一跳”SMTP 服务器的域，而不是“发件人”电子邮件地址？
如果上述情况属实，我如何知道哪个 IP 是正确的查找对象？
谢谢， -本
I'm in the middle of implementing Forward Confirmed Reverse DNS for my SMTP server. After reading around a bit, I found that it is best to do the lookup on the IP found at the other end of the SMTP connection (not in the mail header, because that IP is spoofed more easily). Once I have the hostname, I can compare it to the 'from' email domain in the header and determine if the email is valid.
However, I was thinking about it further and realized that this might not be the IP I want to do a lookup against. If the email message had to travel through several SMTP servers on the way to mine, wouldn't the IP on the other end of the SMTP connection reverse DNS back to the domain of the 'last hop' SMTP server, and not the domain of the 'from' email address?
And if the above is true, how do I know what IP is correct to do a lookup on?
Thanks,
-Ben
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
FCrDNS 仅确认发送服务器已正确配置 DNS。即，您从 1.2.3.4 获得传入连接，您查找 1.2.3.4 以获取whatever.example.com，然后查找whatever.example.com。如果结果为 1.2.3.4，则测试通过。
您不想对邮件标头中实际存在的域名进行此检查。如果一台服务器托管 100 个域的电子邮件，那么您所描述的技术将至少失败 99 个域，因为反向检查只能返回一个主机名。您不能假设 example.com 的合法邮件仅来自 example.com 域名上托管的服务器。
您可能想要执行的不是此检查，而是实施
SPF。编辑：除了 SPF 之外，您还可以进行适当的 FCrDNS 检查，但我发现这比它的价值更麻烦，因为那里有大量配置错误的服务器。您可能会花费大量时间来追踪误报。
FCrDNS confirms only that the sending server has correctly configured DNS. I.e., you get an incoming connection from 1.2.3.4, you look up 1.2.3.4 to get whatever.example.com, then you look up whatever.example.com. If that results in 1.2.3.4, then the test passes.
You don't want to do this check against the domain name that's actually inside the mail header. If a server hosts email for a hundred domains, then your described technique will fail at least 99 of them because the reverse check can only ever return one host name. You can't assume that legit mail for example.com will only ever come from a server hosted on an example.com domain name.
What you probably want to do instead of this check is to implement
SPF.Edit: You can do a proper FCrDNS check in addition to SPF, but I find that it's more trouble than it's worth, as there are tons of misconfigured servers out there. You'll likely spend much of your time tracking down false positives.