FCrDNS and Hostname Alignment: Forward-Confirmed Reverse DNS & Tarpitting Defense

1. The Triangular Verification Algorithm: RFC 1912 FCrDNS

When an egress MTA opens a TCP socket on port 25 to a receiving MX cluster (e.g., Gmail’s aspmx.l.google.com), the receiving edge daemon immediately reads the remote IP address from the kernel socket structure via getpeername(). Before issuing the 220 Service ready greeting, the receiver initiates an out-of-band DNS verification sequence known as Forward-Confirmed Reverse DNS (FCrDNS).

FCrDNS is not a single DNS query; it is a rigorous three-step triangular cryptographic validation designed to confirm that the server controlling the IP address also exercises authoritative ownership over the announced domain name:

Connecting Client IP:  162.251.122.169

Step 1: Ingress Reverse DNS Query (PTR Lookup)
        Query:  169.122.251.162.in-addr.arpa. IN PTR
        Result: mta1.mailcluster.domain.com.

Step 2: Forward Confirmation Query (A Record Lookup)
        Query:  mta1.mailcluster.domain.com. IN A
        Result: 162.251.122.169

Step 3: Triangular Equality Assertion
        Assertion: Forward IP (162.251.122.169) == Connecting IP (162.251.122.169)
        Outcome:   MATCH → [FCrDNS VALIDATED - ADMIT SOCKET]

Failure Case: PTR returns 'mta1.otherdomain.com', but 'mta1.otherdomain.com'
resolves to 192.0.2.1.
Outcome:       MISMATCH → [FCrDNS SPOOF DETECTED - DROP SOCKET]

If Step 3 fails, the receiver concludes that the PTR record was either maliciously forged in an unauthenticated reverse DNS zone or left orphaned after an IP reassignment. Mailbox providers such as Google, Microsoft, and Yahoo immediately terminate the connection with permanent 554 5.7.1 Client host rejected: cannot find your reverse hostname errors.

2. EHLO/HELO Syntactic Precision & FQDN Rules

Once the socket passes the FCrDNS handshake, the egress MTA issues its identification greeting: EHLO <hostname>. RFC 5321 Section 4.1.1.1 strictly mandates that the argument of the EHLO command must be a valid, fully qualified domain name (FQDN) or, in exceptional circumscribed cases, an address literal enclosed in square brackets.

In high-volume production delivery, the EHLO hostname must achieve 100% lexical and operational alignment with the FCrDNS PTR record:

3. Ingress Tarpitting & Pre-Envelope Socket Drops

When an sending server lacks clean FCrDNS alignment, mailbox providers rarely emit clean, human-readable error messages. Instead, edge security firewalls employ SMTP tarpitting (intentional socket throttling) to protect their compute clusters from spambots.

Under a tarpit condition, the receiving MX accepts the TCP connection but delays emitting the 220 banner for 30 to 60 seconds, or introduces a 10-second delay between every single command character. If an egress MTA attempts to deliver thousands of messages across tarpitted sockets, its entire outbound connection pool exhausts its thread limit, stalling delivery across the entire fleet.

4. The Generic Cloud Hostname Trap & PBL Listings

A fatal mistake made by engineers spinning up SMTP nodes on cloud hypervisors (AWS EC2, Google Cloud, DigitalOcean, Hetzner) is utilizing the hosting provider’s default reverse DNS entry:

Generic AWS PTR:     ec2-162-251-122-169.compute-1.amazonaws.com
Generic DO PTR:      162-251-122-169.dynamic.digitalocean.com
Generic Hetzner PTR: static.162.251.122.169.clients.your-server.de

Spamhaus PBL & Ingress Rule Regex Pattern:
^.*(dynamic|client|user|pool|dhcp|broadband|cable|dialup|[0-9]{1,3}[-.][0-9]{1,3}).*$

Result: The presence of raw IP octets separated by hyphens or words like 'dynamic'
triggers automated classification as an unauthenticated residential or ephemeral node.
Rejection: 554 5.7.1 Service unavailable; Client host listed in Spamhaus PBL.

Production enterprise email infrastructure requires fully branded, non-numeric hostnames (e.g., relay01.mail.autosmtp.io) with custom reverse DNS entries configured directly in the cloud provider’s networking console.

5. Dual-Stack IPv4/IPv6 Pointer Synchronization

Modern mailbox providers—especially Google—enforce even stricter FCrDNS validation over IPv6. If your sending server has IPv6 networking enabled and outbound traffic routes over an IPv6 interface, Google requires:

1. The IPv6 address must have a valid PTR record ending in .ip6.arpa.
2. The PTR hostname must resolve to an AAAA record matching the outbound IPv6 address.
3. The SPF record on the envelope domain must include the ip6: prefix authorizing the full /64 subnet.

Because many DNS management consoles make IPv6 PTR delegation complex, thousands of senders inadvertently send over unaligned IPv6 sockets and experience 100% rejection rates with the infamous error: 550 5.7.1 Our system has detected that this message does not meet IPv6 sending guidelines.

6. SRE Verification Runbook: Dig Probes & MTA Automation

To verify the integrity of your fleet’s FCrDNS and EHLO alignment prior to launching production traffic, execute this deterministic validation runbook:

Automated CLI Verification Script

#!/usr/bin/env bash
IP="162.251.122.169"
EXPECTED_HOSTNAME="mta1.mail.autosmtp.io"

echo "[1/3] Querying Reverse DNS (PTR)..."
PTR=$(dig +short -x "$IP" | sed 's/.$//')
echo "  PTR Result: $PTR"

if [ "$PTR" != "$EXPECTED_HOSTNAME" ]; then
    echo "  [ERROR] PTR mismatch! Expected '$EXPECTED_HOSTNAME', got '$PTR'"
    exit 1
fi

echo "[2/3] Querying Forward DNS (A Record)..."
FORWARD_IP=$(dig +short A "$PTR")
echo "  Forward A Result: $FORWARD_IP"

if [ "$FORWARD_IP" != "$IP" ]; then
    echo "  [ERROR] FCrDNS Broken! Forward A '$FORWARD_IP' != IP '$IP'"
    exit 1
fi

echo "[3/3] Probing Live SMTP Banner & EHLO Echo..."
curl -s --url "smtp://$IP:25" --mail-from "test@autosmtp.io" || true
echo "  [SUCCESS] Triangular FCrDNS is 100% closed and aligned!"

PowerMTA Hostname Binding (`config`)

Ensure that each outbound Virtual MTA binds its matching FQDN as its outgoing EHLO banner:

<virtual-mta node-169>
    smtp-source-ip 162.251.122.169
    host-name mta1.mail.autosmtp.io
    smtp-greeting-message "mta1.mail.autosmtp.io AutoSMTP Cluster Node ESMTP"
</virtual-mta>