Reverse DNS

Legitimate mail servers almost always have a PTR record for their IP address, and the name in that record resolves back to the same address. This property is called forward-confirmed reverse DNS. Hosts that send spam from compromised machines or from dynamic address ranges often lack it, so its absence is a useful signal about a client. Stalwart checks the property for each SMTP client. RFC 8601 (section 2.7.3) calls this check iprev, and it proceeds in three steps:

1. Look up the PTR records of the client’s IP address.
2. Look up the addresses of the names found, at most the first two.
3. The check passes when the client’s IP address is among them.

The name that the client gave in EHLO plays no part in the check. The check is made once per session, at MAIL FROM.

Settings

The check is controlled by reverseIpVerify on the SenderAuth singleton (found in the WebUI under Settings › MTA › Inbound › Sender Authentication). The field is an expression that returns one of three modes. Its default expression applies relaxed on port 25 and disable on the other ports:

{
  "reverseIpVerify": {
    "match": {"0": {"if": "local_port == 25", "then": "relaxed"}},
    "else": "disable"
  }
}

The modes differ in what happens when the check does not pass:

Mode	Effect
relaxed	Perform the check and record the result, in the Authentication-Results header, for the spam filter and for system Sieve scripts (env.iprev.result, env.iprev.ptr).
strict	Also refuse MAIL FROM when the check does not pass, including when the address has no PTR record: 550 5.7.25 Reverse DNS validation failed., or 451 4.7.25 Temporary error validating reverse DNS. for a temporary DNS error.
disable	Do not perform the check.

The choice between the first two modes is a trade-off. strict refuses mail from servers whose operators have not set up reverse DNS, and some of those are small but legitimate servers. In relaxed mode, the message is still accepted, and the missing record instead counts against it in the spam filter, as the RDNS_NONE tag. The submission ports are not checked by default, because users connect from networks whose addresses often have no matching reverse DNS.