Mail errors. They hit you at your most vulnerable, and make you want to smash your laptop.
We know. Because we help website owners resolve email errors and other technical issues as part of our Server Support services for web hosting providers.
Hosting users frustrated with cryptic email errors would submit a support request, and we’ll fix it for them in a few minutes.
Here’s an email bounce error we fixed recently in a Linux cPanel/WHM server:
user2@recipient.com host server.recipient.com [zz.zz.zz.zz] SMTP error from remote mail server after pipelined MAIL FROM:<user1@sender.com> SIZE=3964: 550 "REJECTED - Bad HELO - Host impersonating [mx.sender.com]"
Here’s another variant of this error we’ve seen:
user2@recipient.com SMTP error from remote mail server after HELO mx.sender.com: host server.recipient.com [zz.zz.zz.zz]: 550 Bad HELO - Host impersonating domain name [mx.sender.com]
What is the error “550 Bad HELO – Host impersonating domain name [mx.sender.com]”?
You’ve seen in spy movies how they use the uniform of workmen or company staff to get into the building.
Spammers use a similar technique called Greeting Forgery, where a spam mail bypasses anti-spam checks by pretending to be a legitimate domain hosted inside the server.
Older servers would let in that spam thinking it originated from within the server.
But newer servers know better.
They’ll reject mails from outside that pretend to come from inside the server.
And the error they send is “550 Bad HELO – Host impersonating domain name [mx.sender.com]”
But how does this anti-spam check affect legit mails?
The Greeting Forgery anti-spam measure contains two checks:
- Domain name forgery – If an incoming mail greets with a domain name hosted within the server.
- Server hostname forgery – If an incoming mail greets with the mail server’s own name. For eg. If smtp.myserver.com gets a mail from smtp.myserver.com!
Now, it might seem that only spam mails will attempt something as ridiculous as this.
But, in reality, we’ve seen duplicate domain records between two servers causing this. It can be after a website migration, or when setting up a multi-server website infrastructure.
What causes “550 Rejected – Bad HELO – Host impersonating” error?
We’ve seen largely two situations where this can happen.
1. Duplicate records after a website migration
Website migrations often leave a mess in their wake.
From undeleted files to old domain records, a lot of things might remain back in the old server, long after the domain migration is complete.
Now, what’s the trouble with undeleted old domain records?
Well, the Old server thinks it’s still hosting domain.com, whereas the New server rightfully thinks it is the owner of domain.com.
Let’s say now the New server tries to send a mail to Old server. Both servers think they host domain.com.
So, the new server sends an SMTP greeting with “domain.com“. Old server checks its files, sees “domain.com” listed in it, and assumes the incoming mail is fake.
The mail gets rejected with : “550 rejected – bad helo – host impersonating“.
Solution : We solve this by deleting all traces of domain.com from the old server including /etc/remotedomains, /etc/mailhelo, /etc/localdomains, and more.
2. Separate web server and mail server using the same hostname
We’ve seen multi-server clusters in which the web server runs in one VPS, and the mail server runs in another.
They both work for the same site, say domain.com.
In some such networks, we’ve seen both the web server and the mail server will have the same server name – domain.com.
And confusion ensues.
The web server connects to the mail server by greeting it with “Hello, I’m domain.com“.
The mail server thinks, “Hey that’s MY name. This connection must be fake.”, and rejects the mail.
Solution : There are three ways in which we resolve this:
- Change the hostnames – The simplest way is to just give unique hostnames to different servers. For eg. web.domain.com for web server and mail.domain.com for mail server.
- Change greetings – If changing the hostnames is not possible, we’ll change the SMTP greeting by fixing the website code.
- Whitelist sending IP – A simple way to fix this is to add the sending server’s IP into the mail server whitelist so that all anti-spam checks will be bypassed. But the downside is that if ever the sending server is infected, spam will flood the mail server.
Conclusion
550 Rejected – Bad HELO – Host impersonating is an anti-spam check failure error. Here we’ve discussed two causes our Support Engineers have seen and how we fix it.
I had the same issue with directadmin and none of the above fixed the issue. It was actually because of a conflict in defined SPF record in domains DNS server and directadmins local spf in DNS records.
Its a directadmin bug which not loading and analyzing dns settings from original dns server rather than its local values. So when I copied original SPF record from original DNS server to directadmin dns records the problem was fixed.