Microsoft365 mail servers with loopback adresses

Question

Hello,

does anyone know why Microsoft is configuring mail servers with loopback addresses on Microsoft365 cloud service ?

Few examples:

• BRA01-CPZ-obe.outbound.protection.outlook.com
• BRA01-ROA-obe.outbound.protection.outlook.com
• na01-obe.outbound.protection.outlook.com

For each of these servers nslookup command shows 127.0.0.1 on public Internet.

Acording to standards defined in RFC documents (https://www.ietf.org/standards/rfcs/) it is not allowed:

• RFC 1122 => Internal host loopback address. Addresses of this form MUST NOT appear outside a host.
• RFC 5735 => 127.0.0.0/8 - This block is assigned for use as the Internet host loopback address.

It cauese problems with e-mail messages delivery from Microsoft365 cloud mail servers to other e-mail servers on Internet.

Example:

Mar 5 14:01:44 mx postfix/from_WORLD/smtpd[5368]: NOQUEUE: reject: RCPT from mail-roabra01on2042.outbound.protection.outlook.com[40.107.111.42]:
554 5.7.1 <BRA01-ROA-obe.outbound.protection.outlook.com>: Helo command rejected: mail server in loopback network;
from=<..............................> to=<............................> proto=ESMTP helo=<BRA01-ROA-obe.outbound.protection.outlook.com>*

Answer 1

Organizations that cooperate with us use Exchange online to send e-mails to my organization.
We have Exchange on-prem instalation with MX server at front (postfix).

We have noticed that many e-mails are rejected by our MX server with information : Helo command rejected: mail server in loopback network

When we checked that we found out that it is caused by incorrect configuration of DNS record for some e-mail servers, especially those owned by Microsoft that I mentioned above.

I don't know why loopback address are used for those servers ? What is the purpose ?

Answer 2

I don't think that there is problem with my MX. It works acording to rules defined in RFC documents that I mentioned earlier.
Checks IP address of SMTP server sending message and rejects those that should never appear on Internet.

IMHO the problem is with only few Micsrosoft365 servers that are misconfigured.
Nobody should use loopback addresses on Internet and violate RFC rules even such a big company as Microsoft.

Answer 3

There still seem to be some misconfigured outbound mail servers:

   $ host EUR03-AM7-obe.outbound.protection.outlook.com  
   EUR03-AM7-obe.outbound.protection.outlook.com has address 127.0.0.1  
   EUR03-AM7-obe.outbound.protection.outlook.com has IPv6 address ::1  

It seems the problem still exists

Answer 4

Problem still exists for servers:

EUR02-DB5-obe.outbound.protection.outlook.com
EUR03-AM7-obe.outbound.protection.outlook.com

MS needs to correct them.

554 5.7.1 <EUR02-DB5-obe.outbound.protection.outlook.com>: Helo command rejected: mail server in loopback network

C:\>nslookup EUR02-DB5-obe.outbound.protection.outlook.com 8.8.8.8
Server: dns.google
Address: 8.8.8.8

Non-authoritative answer:
Name: EUR02-DB5-obe.outbound.protection.outlook.com
Addresses: ::1
127.0.0.1

C:\>nslookup EUR03-AM7-obe.outbound.protection.outlook.com 8.8.8.8
Server: dns.google
Address: 8.8.8.8

Non-authoritative answer:
Name: EUR03-AM7-obe.outbound.protection.outlook.com
Addresses: ::1
127.0.0.1

Answer 5

But server EUR02-DB5-obe.outbound.protection.outlook.com still points to 127.0.0.1

C:\>nslookup EUR02-DB5-obe.outbound.protection.outlook.com 8.8.8.8
Server: dns.google
Address: 8.8.8.8

Non-authoritative answer:
Name: EUR02-DB5-obe.outbound.protection.outlook.com
Addresses: ::1
127.0.0.1