I maintain several Exchange servers for clients and have never run across this problem before. Unfortunately my personal Exchange mailbox is hosted by a 3rd party and I'm unable to access log files. I have worked with their tech support but nobody can even venture a guess at this point as to why this is happening.
My domain, coralogic.com, filters mail using a 3rd party service. Our DNS servers are set up as follows with MX records pointing to the filtering service and an A record pointing to our server for web hosting use.
Non-authoritative answer:
coralogic.com MX preference = 15, mail exchanger = coralogic.com.inbound15.mx
logic.net
coralogic.com MX preference = 15, mail exchanger = coralogic.com.inbound15.mx
logicmx.ne
t
coralogic.com MX preference = 25, mail exchanger = coralogic.com.inbound25.mx
logic.net
coralogic.com MX preference = 25, mail exchanger = coralogic.com.inbound25.mx
logicmx.ne
t
coralogic.com MX preference = 35, mail exchanger = coralogic.com.inbound35.mx
logic.net
coralogic.com MX preference = 35, mail exchanger = coralogic.com.inbound35.mx
logicmx.ne
t
coralogic.com MX preference = 45, mail exchanger = coralogic.com.inbound45.mx
logic.net
coralogic.com MX preference = 45, mail exchanger = coralogic.com.inbound45.mx
logicmx.ne
t
Non-authoritative answer:
Name: coralogic.com
Address: 204.13.168.228
Our internal mail server has ACL's set up to prohibit any IP's other than those of our 3rd party filtering service from sending mail directly to the server.
Recently there have been a few instances (very rare) that the Exchange server has attempted to deliver the mail to the A record and does not appear to be making any attempt to deliver to any of the MX records. Our internal mail server logs show a connection attempt and a failure to connect (due to ACL violation) from the IP address of the Exchange server. Nobody can determine why these messages are not consistently routing using MX.
The bounced messages are from the Exchange server and reference the same error as indicated in our internal mail server logs. There appears to be no doubt that a direct connection between these two servers was attempted.
Under what circumstances would this happen? How can I avoid Exchange from bouncing messages without opening up our ACL's to allow direct delivery?