This blog explains some of the effects of disabling REVDNS in MQ, and gives some best practices on use of host names in CHLAUTH statements.
You can convert a host name to an ip address format – for example (my.org.com) to ip address (9.2.2.2) using a DNS service. For example the command nslookup google.com gave me 216.58.198.238 .
You can convert an IP address to a host name using a reverse DNS service. Normally a DNS server transparently does both!
nslookup 216.58.198.238 gave me name = lhr26s04-in-f238.1e100.net. This shows that an IP address can have an alias as well as host name.
When a TCP Connection request comes in to MQ, the ip address ( 9.2.2.2) is passed in.
Channel auth rules can use host names or ip address formats.
If your CHLAUTH rules have host names rather than IP address, the CHLAUTH code needs to call the reverse DNS service to convert the incoming IP address to a hostname. The CHLAUTH code can then use the returned hostname in its checks.
The DNS server will usually have cache of recently used host names and IP addresses. If an unusual IP address comes in and it is not in the DNS server cache, the DNS goes and asks another server for information about the request.
If there is a problem in the DNS setup, or the network, these requests can take a long time (many seconds). This is not good, as in the MQ code other DNS lookups are blocked.
You can disable this reverse DNS lookup using ALTER QMGR REVDNS(DISABLED).
If you do this you need to change your CHLAUTH definitions to use the IP address instead of a hostname.
If you do this you need to change your CHLAUTH definitions to use the IP address instead of a hostname.
Morag said
Hostnames are not a particularly secure manner to use for identification. They are much more easily spoofed than IP addresses (which are of course spoof-able too with some effort). You need to use digital certificates for identification.
You should NEVER use a hostname for a blocking rule but only for a positive allowing CHLAUTH rule.
Actions
- If you need to use REVDNS(DISABLE) check your CHLAUTH statements and replace hostname with IP address.
- Check your CHLAUTH and replace HOSTNAME with IP address where it is being used for identification
- Check CHLAUTH and change hostnames in blocking rules to be IP addresses.
ColinPaice 
One thought on “What is the impact of REVDNS(DISABLE) and use of host names?”