Sophos Central Admin US-West customers may experience performance and login issues. See Central Status for the latest updates.
We'd love to hear about it! Click here to go to the product suggestion community
It appears that this question, or ones similar, have been asked previously, but I did not find a solution in the responses that were given.
Here is my scenario...
I have a Exchange server behind the UTM that hosts multiple domains (my own personal domains). Recently I have been experiencing more occasions where mail messages sent from my domains are ending up in a users junk/spam folder. Obviously this is undesirable.
Tests on MXToolbox return no errors, but there are a few warnings, the one I am most concerned about being "Reverse DNS does not match SMTP Banner"
I recently changed ISPs and that meant that my fixed IP changed too. Initially there was a problem with my reverse DNS, but that was resolved.
On the Exchange server you can configure multiple Send Connectors (one for each domain) and these normally deal with the HELO/EHLO requests. However, these are overridden by the UTM (Email Protection > SMTP > Advanced > Advanced Settings > SMPT Hostname). It would appear that whatever is set there is what is seen for a HELO/EHLO request.I have tried leaving the SMTP Hostname blank, but that is worse. Then the UTM simply reverts to the UTM's hostname.
The end result is that the "Received: from" header does not match any of my email domains, which I assume is causing me the issues.
I believe that technically I could set the SMTP Hostname on the UTM to the MX name of one of my domains and set the MX records of my other domains to match, but that would be quite undesirable. I need the Received header to match the hostname of the email being sent.Receiving mail to multiple domains is not an issue at all.
So, this is my question...
Is there a way I can use the SMTP proxy on the UTM but have my Exchange Send Connectors do the HELO/EHLO response?
Or maybe there is another way I can get around this issue of multiple email domains behind the UTM.
As always, I am open to suggestions.
You can ignore the warning on mxtoolbox about the rdns entry. The main thing is to actually have an rdns as most spam filters will do an rdns check to make sure there is one.
What the actual entry is doesn't really matter in my experience.
In reply to Louis-M:
Yeah.... I thought that too, but this does not account for an increased amount of messages now being seen as SPAM.
I have run the same Exchange server for over 10 years and this has only become a problem since changing my ISP about 12 months ago. As mentioned, my RDNS is valid.I am in the planning stages of upgrading my server environment and wanted to address this issue at the same time, but I am not finding any solutions as yet.
In reply to BigO:
Have you tried to nslookup <your public IP-address that your Sophos mail protection is using>
and then enter the name that appears as the SMTP-hostname in settings? That is wat did the trick in my environment.
In reply to apijnappels:
Yes, I did think of doing that and in fact I tested it too.
As much as it appears to resolve the SMPT banner issue, I am concerned that it will create even more problems, as this contains my ISPs domain name, not mine.
RDNS = static-xxx-xxx.grapevine.transact.net.au (where xxx-xxx is the last 2 octets of my fixed IP address)
My concern is that using the above will make it look like I am a relay, as the RDNS does not include any of my domains.What I think should work is to configure multiple send connectors in Exchange, as you can specify the HELO/EHLO FQDN there, but I do not see a way of doing this with the UTM in front of the Exchange server.
You can safely do this. Spam filters check various ways but some things that most insist on is the IP comes from a static range and has a valid rdns entry.
I've never had an issue apart from Microsoft and that was down to some sort of reputation filter that only allows x amount of mail. Never had an issue with rdns though and if you are concerned, you could strenghten it up with SPF and DKIM
Okay... even if the SMTP Banner issue is resolved by using the RDNS string in the UTM, I am still seeing messages to some recipients being classified as SPAM/Junk.
The UTM, as I see it, only allows you to set a single HELO/EHLO response and if the RDNS sting is used it does not resemble any of my email domains in any shape or fashion.I am in no way a mail expert, so I may be seeing issues that do not actually exist, but I would think that some weight for "is it SPAM or isn't it?" would involve the HELO/EHLO response a mail server gets from my UTM.
gMail was fine to send to a week ago, but now when I send test mail messages to that domain every message is going into the Junk folder. I now fear that my IP address has been identified by gMail (and others) as "dubious" and no matter what I change from this point onward will have no effect.
I have been running my own mail server for nearly 20 years now and this is the first time I have had problems like this. I am currently at the point where I have run out of ideas about how to fix this issue of my mail messages being seen as SPAM.