Domain Verification

Question

Hello, 
 I am evaluating Sophos Email Appliance and I noticed some behavior that is really annoying. 
 I receive a complaint that a spam was received and when I checked the sender's domain I discovered that there is no MX record what so ever for that domain. 
 In another case, the IP is completely different than the published MX record. 
 I opened a ticket with the support, but unfortunately, they failed to understand what is RDNS and failed to understand the basics of doamin-to-IP verification. 
 In used to work with UTM and RDNS was applied strictly and it will never allow "wrong" IP to pass. 
 
 Any suggestion ? do not you think IP-Domain verification is essential ? 
 Am I missing something ?

DouglasFoster · Accepted Answer

It is common for mail to come from a different IP address than the MX record. In a big environment, one group of machines handles incoming traffic, another group of machines handles outgoing traffic. SPF may provide a complete list of known senders, MX will not. I have found so many problems with SPF causing false positives that I do not use it. 
 Some email domains are send-only, so they do not publish an MX record. This may or may not indicate spam. Some mail receiving systems block a non-MX domain, but not all have this feature. I have legitimate mail coming daily, from a business partner, which is a send-only domain. 
 Requiring Reverse DNS or requiring Forward-confirmed reverse DNS are strategies that have been tried. IETF does not seem to think them very useful by themselves. See RFC 7601, the "iprev" section, for a discussion on this topic. Follow the references in that RFC for more detail. 
 I am currently using UTM and another spam filter device together, neither of which understand DMARC. My next solution must have DMARC support. SEA is a possibility because it has DMARC, but it seems to lack other of my must-have features, like configuring whitelist rules that require matching on multiple criteria (e.g. email domain and server RDNS). 
 There are vendors doing interesting work on domain reputation, matching known spam sources to other email domains and IP addresses based on Whois information and other data. 
 I think the future of spam filtering is going to be in cloud services, because they will have the best databases of information, including domain reputation.