[gentoo-user] Re: Dynamic IP address services.

[Kai Krakow]

Am Tue, 8 Nov 2016 13:12:03 +0200
schrieb Alan McKinnon <alan.mckinnon@×××××.com>:

> On 08/11/2016 13:07, J. Roeleveld wrote:
> > On November 8, 2016 9:43:30 AM GMT+01:00, Willie M
> > <matthews.willie80@×××××.com> wrote:
> >> On 11/07/2016 06:31 PM, Harry Putnam wrote:
>  [...]
>  [...]
>  [...]
>  [...]
> >> on
>  [...]
> >> :-)
>  [...]
> >> expected
>  [...]
> >> that
>  [...]
> >>
> >> Hey Harry,
> >>
> >> If I a not mistaken if you change your nameservers to FreeDNS you
> >> will be able to have that dynamic IP Address that way. So your
> >> reverse lookup
> >> should work just fine.
> >>
> >> Only problem is that if your IP address changes, you would have a
> >> short amount of time that your server would not respond (because
> >> of the IP change). The default TTL on FreeDNS is 3600 seconds (1
> >> hour).
> >>
> >> Reading on the front page it says that you can edit the TTL if you
> >> add your own domain. I don't know for sure how it all works
> >> because I have never added on. It doesn't hurt to try and it seems
> >> like it would be a lot better than what you are using now.
> >>
> >> Hope this helps.
> >
> > Willie,
> >
> > This will not work.
> > A reverse lookup (which FQDN for the IP) needs to work for all SMTP
> > servers he is likely to send mail to. This would also include
> > Google and Microsoft.
> >
> > He needs to get his ISP to change the reverse DNS.
>
>
> ISP mail admin chiming in here.
>
> If a host on a dynamic range tries to hit my MX machines and deliver
> mail, that host WILL be denied. Most ISP's work similarly as we are
> sick and tired and fed up to the yinyang of 99.99% of mail from such
> hosts being pure spam.
>
> Harry, you have 2 options:
>
> 1. Do it yourself and do it properly - get a static IP from your ISP
> 2. Don't do it yourself  and do it properly - use your ISP's mail
> relays, or use a relay provider
>
> Why are you even trying to do this yourself? I do this for a living
> and I can tell you it's a pain in the butt you don't want (*I* don't
> even want it, I shove mail services off onto other teams as fast as I
> can get them to take it...)

I can only second this...

As a full service provider and admin myself (using Gentoo machines
btw) we are also running our own mail central mail server with correct
RDNS etc. And it's a pain to filter out all those spammers correctly.

But we are also servicing our customers with their own on-premise mail
servers (mostly exchange). For the most part, we are also admin of
those servers.

The only sane configuration is to setup authenticated relaying. This
is, we forward proxy mails (by address rewriting) to the static IP of
the customer (with firewall in place), or in case of dynamic IP use a
POP3 grabber (everything is forwarded to the same POP3 box, not
catchall) and adding an original receiver header. P2S works great for
it on windows machines, use fetchmail for linux.

The setup scenarios are as follows:

example.com = MX on our site
relay.example.com = MX on customer site

Static DNS:

  * Setup a special SMTP sending account on our site
  * Forward @example.com to @relay.example.com
  * Outgoing mails sent to our site, TLS, port 587, using smart relaying
    with authentication (use the sending account)


Dynamic DNS (which would be your case):

  * Setup one POP3 box for sending and receiving
  * Forward each email address to this POP3 box adding an original
    receiver header
  * Setup POP3 grabber on customer site and let it decide to which
    email account this belongs inspecting the added header


With the second solution, you are free to fall back to multiple POP3
boxes to fetch - but this involves some advanced strategies how to send
mails. With linux it's easy to do sender-based routing and using
different SMTP accounts for sending. Especially if it's all the same
sender domain, you can fall back to use the same SMTP account for
sending. If it's different mail providers, you should use different
SMTP accounts per sender depending on which provider the sender belongs
to.

Apparently, Exchange doesn't support sender-based routing, only
destination-based routing (I still wonder the purpose for this).


Background here is:

For spam fighting purpose, we only allow a customer to use senders
within their own customer account - even when authenticated. We don't
allow senders belonging to a different customer. And we don't allow
unauthenticated delivering with any sender on our system. This
successfully fights a lot of spam and account hijacking.


So in your case: Use POP3 grabbing, use authenticated sending, use
sender-based routing, and all should be fine. Don't try to be a public
MX. If it's only two or three accounts, it's fine. Otherwise it's not
worth the hassle. Better find a sane client solution that provides you
good mail storage usable from different MUAs. You usually don't want to
setup a local IMAP server for the long term, especially not on your
local machine.

-- 
Regards,
Kai

Replies to list-only preferred.