Fortinet FortiMail-100, Инструкция по установке

Страница: 18 / 174

The role of DNS in email delivery Key concepts
FortiMail™ Secure Messaging Platform Version 4.0 Patch 1 Install Guide
18 Revision 2
http://docs.fortinet.com/ • Feedback
Exceptions include if you are configuring a private DNS server for use with the Use MX
Record option (see “Use MX Record” on page 83 ). In that case, rather than referencing
the FortiMail unit as the mail gateway and being used by external SMTP servers to route
mail, the MX record references the protected SMTP server and is used by the FortiMail
unit to define the SMTP servers for the protected domain.
A record
A records are configured on a DNS server. A records indicate the IP address to which a
host name resolves. In their most simple form, A records use the following format:
mail IN A 192.168.1.10
where:
•
mail
is the name of the host
•
IN
indicates the Internet protocol class
•
A
indicates that the DNS resource record is of the IPv4 address type
•
192.168.1.10
indicates the IP address that hosts the domain name
When an email client sends an email, the sender’s MTA queries a DNS server for the MX
record of the domain name in the recipient’s email address. To resolve the host name of
the MTA referenced by the MX record, it then queries for the A record of the destination
MTA. That A record provides the IP address of the email server or gateway. The sender’s
MTA then attempts to deliver the email to that IP address.
You must configure the public DNS server for your host names with an A record to resolve
the host names referenced in MX records, and the host name of the FortiMail unit, if any.
For example, if an MX record is:
example.com IN MX 10 fortimail.example.com
the required A record in the example.com zone file might be:
fortimail IN A 192.168.1.15
Reverse DNS record
Because the SMTP protocol does not strictly require SMTP clients to use their own
domain name during the SMTP greeting, it is possible to spoof the origin domain. In an
attempt to bypass antispam measures against domain names known to be associated
with spam, spammers often exploit that aspect of SMTP by pretending to send email from
legitimate domains.
For example, the spammer spam.example.com might initiate an SMTP session with the
command:
EHLO nonspam.example.edu
To prevent this form of attack, many SMTP servers query reverse DNS records to verify
that the domain name provided in the SMTP greeting genuinely matches the IP address of
the connecting SMTP client.
You should configure the public DNS server for your protected domain names with a
reverse DNS record to resolve the IP addresses of your protected SMTP servers and/or
FortiMail unit into domain names.
For example, if the outgoing MTA for example.com is the FortiMail unit,
fortimail.example.com, and the public network IP address of the FortiMail unit is
10.10.10.1, a public DNS server’s reverse DNS zone file for the 10.10.10.0/24 subnet
might contain:
1 IN PTR fortimail.example.com.