connect.fcrdns plugin


Determine if the SMTP sender has matching forward and reverse DNS.

See FCrDNS at wikipedia


Other plugins can use FCrDNS results like this:

var fcrdns = connection.results.get('connect.fcrdns');
if (fcrdns) {
    if (fcrdns.fcrdns) {
        // they passed, reward them

    var fails =;
    if (connection.results.has('connect.fcrdns', 'fail', /^is_generic/) {
        // their IP is in their hostname, unlikely to be MX, penalize


Edit config/connect.fcrdns.ini

This plugin honors the whitelisting of IPs as set by the rdns_access plugin. For that to work, rdns_access needs to be listed before this plugin in config/plugins.

  • timeout=30

When performing DNS lookups, time out after this many seconds.

The following settings permit control of which test will block connections. To mimic the lookup_rdns.strict plugin, set no_rdns=true.

; reject if the IP address has no PTR record

; reject if the FCrDNS test fails

; reject if the PTR points to a hostname without a valid TLD

; reject if the rDNS is generic, examples:


The reverse DNS of zombie PCs in bot nets is out of the bot operators control. This presents a significant hurdle for a large portion of the hosts that attempt spam delivery.


From Wikipedia: Forward Confirmed Reverse DNS

  1. First a reverse DNS lookup (PTR query) is performed on the IP address, which returns a list of zero or more PTR records.
  2. For each domain name returned in the PTR query results, a regular 'forward' DNS lookup (type A or AAAA query) is then performed.
  3. Any A or AAAA records returned by the second query are then compared against the original IP address. If there is a match, FCrDNS passes.


The iprev results are added to the Authentication-Results header.

RFC 1912RFC 5451RFC 7001

2.6.3. "iprev" Results

pass: The DNS evaluation succeeded, i.e., the "reverse" and "forward" lookup results were returned and were in agreement.

fail: The DNS evaluation failed. In particular, the "reverse" and "forward" lookups each produced results, but they were not in agreement, or the "forward" query completed but produced no result, e.g., a DNS RCODE of 3, commonly known as NXDOMAIN, or an RCODE of 0 (NOERROR) in a reply containing no answers, was returned.

temperror: The DNS evaluation could not be completed due to some error that is likely transient in nature, such as a temporary DNS error, e.g., a DNS RCODE of 2, commonly known as SERVFAIL, or other error condition resulted. A later attempt may produce a final result.

permerror: The DNS evaluation could not be completed because no PTR data are published for the connecting IP address, e.g., a DNS RCODE of 3, commonly known as NXDOMAIN, or an RCODE of 0 (NOERROR) in a reply containing no answers, was returned. This prevented completion of the evaluation. A later attempt is unlikely to produce a final result.