Re: outbound.protection.outlook.com, __RDNS_NONE and IPv6 ?

Andrew C Aitchison <[email protected]> writes:

> Is it reasonable to expect that IPv6 outbound servers have rDNS
> (given that IPv6 space is so much bigger than IPv4) ?

Yes, it is reasonable.  The space is huge, but the number of addresses
in use for outgoing mail servers is not really any bigger than v4.

> Actually this one does appear to have rDNS:
> # host 2a01:111:f403:c205::5
> 5.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.5.0.2.c.3.0.4.f.1.1.1.0.1.0.a.2.ip6.arpa
> domain name pointer
> mail-uksouthazlp170120005.outbound.protection.outlook.com.
>
> How do I debug why my Ubuntu machine is hitting this rule ?

Note that the SA-inserted headers are about a DNS lookup at time of
receipt, while you ran `host` later.  Perhaps you used a different
computer, perhaps a different resolver, perhaps a different network.

Are you saying that you reliably get RDNS_NONE when rerunning with -D
and -?  And that "host" on that very same machine, at about the same
time, works?

I would suggest using tcpdump to capture the dns queries and respsonses
during the `spamassassin -t -D` run and inspect those vs the debug
output.

It could be that the timeout is short and the authoritative  serers are
slow (after all they are probably running Windows :-) and that by the
time you run host the answer has arrived, but SA gave up after 5s.
Totally making that up, but something to look into.    But, I ran that
query (with dig -x instead of host) and it completed in 44 ms.  Which is
obviously fine and super fast.

I would also be running an on-machine caching resolver for SA.  There
are a lot of lookups per message.