Why does mail-tester say my email domain fails reverse DNS lookup?

Nightfirecat

I’ve set Mailcow up on my server with the following relevant records created for it:

In my setup, I have MAILCOW_HOSTNAME=mail.nightfirec.at and ADDITIONAL_SAN=autoconfig.nightfirec.at,autodiscover.nightfirec.at set.

When testing mail sending with mail-tester, the only significant issue it finds is that my reverse DNS does not match my sending domain. In this case, rDNS on my server’s IP address yields nightfirec.at, but the mail is sent from mail.nightfirec.at (despite having created the nightfirec.at domain within Mailcow, and sending from an @nightfirec.at address). How should this be addressed so they match?

hndrk

the reverse DNS match check refers to the mailserver (domain). so it should be mail.nightfirec.at to pass the test, because thats the domain of the MX record.

Nightfirecat

What would I need to change in my current setup to fix this? As I understand the basic DNS setup for Mailcow, my setup is “correct”. I do plan on serving some other application when visiting the base domain nightfirec.at, so I will still need that A record intact for when I do.

hndrk

Nightfirecat the A Record can be like it is. The PTR Record (Reverse DNS) is the one you could change to pass the check.

You could also let mailcow listen on nightfirec.at and maybe just edit the nginx configuration to let the webadmin interface get used by another subdomain.

Nightfirecat

hndrk Thanks, this was a big help in helping mentally figure out what I was missing. My PTR was fixed due to the hostname I assigned my VPS, and I wasn’t interested in changing it, but I was able to set up a reverse proxy config with nginx to achieve what I wanted.

For anyone mentally stuck where I was 10 hours ago, the following is what I did to fix the rDNS mismatch and reach my final end state of mail being served from the base domain (nightfirec.at) and webmail interface served at the MX domain (mail.nightfirec.at). My setup is done with a single VPS, with NGINX as a reverse proxy, and with certbot to generate certs.

In mailcow.conf, change MAILCOW_HOSTNAME to the base domain (in my case, mail.nightfirec.at -> nightfirec.at)
Add MX domain to ADDITIONAL_SAN
Restart mailcow (sudo docker-compose down && sudo docker-compose up -d)
- After this step, the rDNS mixup is fixed, but webmail interface is served on the base domain.
Set up reverse proxy (mostly following steps here: https://mailcow.github.io/mailcow-dockerized-docs/post_installation/firststeps-rp/)
1. In mailcow.conf, change HTTP_PORT and HTTPS_PORT to unused ports, and change HTTP_BIND and HTTPS_BIND to 127.0.0.1. Additionally, set SKIP_LETS_ENCRYPT=y
2. Restart affected containers (sudo docker-compose up -d)
3. Create cert to be served via reverse proxy: sudo -H certbot certonly -d nightfirec.at,mail.nightfirec.at,autoconfig.nightfirec.at,autodiscover.nightfirec.at
4. Copy certs into mailcow ssl directory (see: https://mailcow.github.io/mailcow-dockerized-docs/post_installation/firststeps-rp/#optional-post-hook-script-for-non-mailcow-acme-clients for paths, and for post-hook script example)
5. Create reverse proxy nginx config (reference)
6. Enable nginx: sudo systemctl start nginx

Once all these steps are completed, the end result is achieved. The base domain still serves the webmail interface until some other server definition is created for it.