Chapter 02 Networking, DNS & Crypto Admin: #pTls

10/10 DNS Deliverability, Reverse DNS (FCrDNS) & Wildcard DNS Pitfalls

Major receivers such as Gmail, Microsoft 365, and Deutsche Telekom evaluate sender reputation heavily on DNS alignment. Under TLS & DNS Advisor (#pTls), SharpMailserver generates copy-ready records for every hosted domain and validates them live against public DNS.

Operational Tip & Architecture Note

Beware of Wildcard DNS (*.company.com -> web server IP): a wildcard record silently routes unconfigured subdomains like autodiscover.company.com to your web host instead of your mail server! Always create explicit CNAME or A/AAAA records for mail, autodiscover, and autoconfig.

Sample DNS Zone Records (BIND / RFC 1035)

Export your exact domain zone anytime via 'sharpmail-cli dns company.com --bind' or from #pTls inside the Admin Cockpit.

Reference / Configuration

mail                  3600 IN A     198.51.100.10
mail                  3600 IN AAAA  2001:db8::10
@                     3600 IN MX 10 mail.firma.de.
@                     3600 IN TXT   "v=spf1 mx ip4:198.51.100.10 ip6:2001:db8::10 -all"
s2026._domainkey      3600 IN TXT   "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."
ed2026._domainkey     3600 IN TXT   "v=DKIM1; k=ed25519; p=11qYAYKxCrfVS..."
_dmarc                3600 IN TXT   "v=DMARC1; p=reject; adkim=s; aspf=s; rua=mailto:dmarc@firma.de"
autodiscover          3600 IN CNAME mail.firma.de.
autoconfig            3600 IN CNAME mail.firma.de.
_imaps._tcp           3600 IN SRV   0 1 993 mail.firma.de.
_submission._tcp      3600 IN SRV   0 1 465 mail.firma.de.
_caldavs._tcp         3600 IN SRV   0 1 443 mail.firma.de.
_carddavs._tcp        3600 IN SRV   0 1 443 mail.firma.de.

Settings, Default Values & Best Practices

Setting / Location	Description	Default Value	Production Best Practice
`Reverse-DNS (PTR) & FCrDNS`	Maps your server's public IPv4 (and IPv6) address back to ServerHostName at your ISP/hosting provider (Forward-Confirmed Reverse DNS).	`Beim Hoster zu setzen / ISP panel`	Set PTR at Hetzner/IONOS/Netcup/AWS to match ServerHostName 1:1. Missing or generic PTR records cause immediate 550 rejections at strict ISPs.
`SPF TXT (v=spf1)`	Declares which IPv4/IPv6 addresses and MX hosts are authorized to send mail on behalf of your domain (RFC 7208).	`v=spf1 mx a -all`	Include explicit sending IPs (v=spf1 mx ip4:... ip6:... -all), stay well below the 10-lookup RFC limit, and enforce -all once all senders are listed.
`Dual-DKIM (RSA-2048 + Ed25519)`	Two parallel DKIM keypairs per domain (e.g. s2026 for RSA-2048 and ed2026 for Ed25519) cryptographically sealing outbound headers and body hashes.	`Beide Keys automatisch erzeugt (s2026 + ed2026)`	Publish both DNS TXT records (s2026._domainkey & ed2026._domainkey) once in DNS, then switch instantaneously on the server between RSA-2048, Ed25519, or RFC 8463 Dual Signing.
`DMARC (_dmarc.<domain>)`	Binds SPF/DKIM alignment to the visible From header and instructs receivers how to handle spoofing, feeding aggregate XML reports back into /admin/.	`v=DMARC1; p=quarantine; ...`	Start with p=quarantine and rua=mailto:dmarc@company.com for 2 weeks, inspect the built-in DMARC analyzer, then graduate to p=reject.
`Autodiscover, Autoconfig & DNS-SRV`	Enables zero-touch server discovery across Outlook, Apple Mail, Thunderbird, and mobile clients using only the user's email address.	`Auf Port 443 integriert`	Create explicit CNAMEs for autodiscover & autoconfig pointing to mail.<domain> plus SRV records (_imaps, _submission, _caldavs, _carddavs).