Question about ptr?

Question

Domain Name System

I need to check the domain for a fake email address like [email protected] What does the mat.chast tell me:

In order to reduce the volume of unsolicited email (spam), many email recipient servers can check for a PTR record for the host from which it is being sent. In this case, the PTR record for the IP address must match the name of the sending mail server that it is presented to during the SMTP session.

Okay, then we will request a ptr record from the gmail.com domain, first we calculate the IP:

ping gmail.com
PING gmail.com (216.58.209.37) 56(84) bytes of data.
64 bytes from waw02s05-in-f37.1e100.net (216.58.209.37): icmp_seq=1 ttl=51 time=36.3
ms =51 time=36.0 ms
64 bytes from waw02s05-in-f37.1e100.net (216.58.209.37): icmp_seq=3 ttl=51 time=36.5 ms

Now we request ptr record:

dig -x 216.58.209.37
37.209.58.216.in-addr.arpa. 86129 IN PTR waw02s05-in-f5.1e100.net.
37.209.58.216.in-addr.arpa. 86129 IN PTR waw02s05-in-f37.1e100.net.
37.209.58.216.in-addr.arpa. 86129 IN PTR waw02s05-in-f37.1e100.net.
37.209.58.216.in-addr.arpa. 86129 IN PTR waw02s05-in-f5.1e100.net.

It's not clear to me why the writeback is not: 37.209.58.216.in-addr.arpa. 86129 IN PTR gmail.com? the domain is gmail? what does it have to do with / what is waw02s05-in-f5.1e100.net.?

Answer 1

You don't have to look at who sends you letters.
ptr record, it's just a record by which you can find out the name through Ip. Those are writeback.
in dig look dig -x 77.88.21.3 +short
you can check by ip that there is a writeback. But for mail today, this is not the most relevant. Sometimes, for example, it is impossible to write back for various reasons, so they introduced SPF / DKIM / DMARC, etc.
Further, there may be several servers for various reasons, for example, the
Received header: from mail-ua0-x249.google.com (mail-ua0-x249.google.com. [2607:f8b0:400c:c08::249])
by mx .google.com with ESMTPS id e3si2268363vkg.44.2017.07.26.07.34.05
or
Received: from mail-wr0-x233.google.com (mail-wr0-x233.google.com. [2a00:1450:400c:c0c::233])
by mx.google.com with ESMTPS id 35si17517304wrd.219.2017.07.26 .14.45.01
or, for example, from habr
Received: from mxs.habramail.net (mxs.habramail.net. [2001:1af8:4010:a087:22::169])
by mx.google.com with ESMTPS id g48si12255511edb. 194.2017.07.26.14.44.59
If we check the PTR, then everything will be OK.
Well, the mail server can be responsible for different domains. The MX record is responsible for this.
For example, by setting up yandex or google mail servers, you can (after confirmation) receive mail for your domain using their servers.

Answer 2

It is necessary to look not at the host of the web interface, but at the host - the sender of the mail.
For example, here is one of them from the Exim log
Accordingly, we check.

[email protected]:~ # host mail-oi0-x22d.google.com
mail-oi0-x22d.google.com has IPv6 address 2607:f8b0:4003:c06::22d
[email protected]:~ # host -t ptr 2607:f8b0:4003:c06::22d
d.2.2.0.0.0.0.0.0.0.0.0.0.0.0.0.6.0.c.0.3.0.0.4.0.b.8.f.7.0.6.2.ip6.arpa domain name pointer mail-oi0-x22d.google.com.

Everything about Gmail is correct.

Answer 3

Why did you decide that gmail.com always replies from the same IP?

C:\Users\>ping gmail.com

Обмен пакетами с gmail.com [173.194.122.246] с 32 байтами данных:
Ответ от 173.194.122.246: число байт=32 время=80мс TTL=54