Exchange 2003 could only receive some external mail

My new platform is E2k3 + ISA2000 (also is a DC) and is configured as edge firewall.
I have no problem to receive internal mail, but only SOME EXTERNAL mail can be arrived.
The system seems ok when I send test mail from ZoneEdit but fail to gmail or yahoo.

Can someone tell me what is going wrong? My regular email account is
Thanks advence.

Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Have you recently made the changes to your DNS for email to be delivered?
If so then the changes might not have replicated round fully.

Go to and enter your domain name. This will run a series of tests which includes connecting to your email server. If you get errors then that will be what you need to fix.


Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
jack68000Author Commented:
Thank for your timely response.
It is a new site + a newbie. ^_^

Setup in ISP: DNS mode,, -->
Layout of Network:
  ADSL dumb router
Dual homed host:  
 ISA2k + DC (2003) + Exchange2003 + DNS  --> Domain Name=powerbase.local
  External NIC:, Gateway, DNS
  Internal NIC:, no gateway assigbbed, DNS
       (A) Master2  (A) Master2 (NS) =(SOA)= Master2.powerbase.local
       (A) Master2  (A) www, (A) DNS, (MX),
       (NS)=(SOA)= master2.powerbase.local
    Global: *, default *
    Receive Policy: default (SMTP:, smtp: powerbase.local)
    SMTP Protocal:
       default Virtual:
       powerbase Virtual:

Your name servers aren't responding to the Internet.

From what you have written above and what the DNS Report shows, I think your DNS configuration is screwed up.

You have lots of entries for nameservers, all pointing at the same server. That isn't right.
Second, you shouldn't be using your internal DNS servers for external DNS services. An AD integrated DNS should not be exposed to the internet.

Presumably you have an ISP or domain name registrar who looks after your domain. If you do, reset everything back to their defaults, using their name servers.

Then ask them (or do it on their web interface) to add new entries in the DNS records for your domain.
As a bare minimum you will need type A www pointing at your web site. Type A mail pointing to your Exchange server, and MX records of with a value of 5.

Make sure that port 25 is open on your firewall.
Then wait for the DNS to propagate.

Your Guide to Achieving IT Business Success

The IT Service Excellence Tool Kit has best practices to keep your clients happy and business booming. Inside, you’ll find everything you need to increase client satisfaction and retention, become more competitive, and increase your overall success.

jack68000Author Commented:
It seems like my problem is the configure of DNS, a test mail from ZoneEdit can reach me, however, it is using IP address.
Which make me believe my port 25 and MX is ok, Exchange is ok too because test mail can reach
Port 25 will be fine if the email is being sent to an IP address.
The MX record will not be fine if the DNS is not configured correctly as the MX record needs to lookup the host. Click on the link that I included above, that will show you the problem.

jack68000Author Commented:
My ISP is Hinet, and I register my domain in TWNIC who only provide DNS and Host mode services. I adopt DNS mode which as my understanding is using my own DNS, my ISP will provide my DNS IP to the user who want rnter my web or send mail to me. TWNIC only gave me 5 row to fill out my host name and IP. according their web sample, I shall enter 2 DNS name and location in DNS mode, or assign www and mail server in host mode (also have 5 row there, each row can assign name and IP) , I don't see any where can put MX value and record.
Shall I using DNS mode or host mode in such condition? I can send their screen capture for your reference.

I delete all other register and only left and
I also made the following change:
A. Change the DNS in External NIC to which is my ISP's DNS
B. Left only two A record (www and master2) in
Am I doing it right ?

jack68000Author Commented:
Yes, I went DnsReport before I ask help, I know it is a problem but doesn't know how to fix them.
jack68000Author Commented:
The new DNS setting is done, I can see it from DnsReport, however, it still doesn't see the MX.

I am still seeing failure messages on your domain.

What is the IP address ""? Is that your own IP address or the address of the ISPs DNS servers?

jack68000Author Commented:
The problem is TWNIC only support A record in Host mode and ask me using DNS mode if I have Exchange.
Which mean I need setup my own DNS accordingly.
jack68000Author Commented: is my own IP
jack68000Author Commented:
I resolved it by publish DNS query rule in ISA2000, the mail come in now, thanks.
You were blocking DNS packets, which is what I thought might be the case.
However you still should not be using the same DNS server for external requests as active directory. This is a large security hole which exposes a lot of information that you don't want in public.

jack68000Author Commented:
I know this is not a good approach, however, my problem is there are tons indivual paper for ISA; Exchange; DNS and Server but all I need is a workable total solution and sample. I believe you can selling lots if you can publish a cookbook for some common scenario.

I try to using two box to setup exchange+DC+Internal DNS and a separate firewall for many times but was stuck setup of exchange to receive internet mail when the domain internal and external domain name is different.

Getting Exchange to receive external email when the internal domain is different is very easy - probably the second most common scenario for Exchange deployments.

The bottom line is no matter what scenario you are using you should not be allowing external traffic to see an active directory DNS domain. Simply spin the DNS out to an external party (your ISP or web host) and then point the required DNS entries to your external IP address. Then make the required changes to the firewall to allow the traffic to come in. Finally if you want to use the same domain name internally then create an internal zone for the external name and populate it with the correct IP addresses - which will be a mix of internal and external IPs.

jack68000Author Commented:
The problem is our ISP doesn't provide MX record.
I can publish my DNS by follow Thomas W Shinder's paper, however, can u instruct me the following puzzle so that I may build my first Exchange?
1. FrontEnd: Running ISA and DNS now, its setup is:
    Ext NIC:
    Int NIC:
    DNS: (Intend to be External DNS)
      A Record: DNS (
       Listen address: Only
       Forward and Recursive: disable.
       Published rule: DNS Query Server, DNS Zone Transfer
       Publish mail rule by wizard: SMTP, POP,IMAP4 etc.

2. DC+Exchange
    DNS: (Intend to be internal DNS)
      Zone: (can be forward to any server)
      A record:,
      Forward: (ISP)
     Receipt policy SMTP:
I really appreciate ur time and efforts, I would close and accept ur answer next time.

jack68000Author Commented:
This layout can't receive external mail, they're stuck in cache.
Would be appreciate if u can point out where I doesn't doing right.

jack68000Author Commented:
Feel frustrated to my first mail server, now it receivd but fail on send to internet.
1. Can you direct me how to setup a split DNS with two box?
2. One is ISA and the other is Exchange+DC
3. DNS shall also publish to public due ti our ISP dosn't have MX.
4. Setup Exchange so it can send/receive mail internal/external with domain name

Shall I rise the point or create another board?

Thank advance.
jack68000Author Commented:
I'm new here so have a little misunderstanding in 'Point', I though I had to pay extra beside the month fee.

Since the question is getting longer and have a little change, so I just create another board and end this one.

many thanks
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.