SMTP Server in IIS is not forwarding to smarthost because of failed DNS lookups

We have a Win 2003 Server running ISA 2004; acting as a gateway beetween our Exchange server and the outside world. On this gateway, IIS is set to forward all outbound email to a smarthost (our Anti-Spam provider) which is a DNS name. It was all working fine and no changes have been made, but one day outgoing email stopped, the email is queuing and the System Event Log full of ID 4000 messages like this:

"Message delivery to the remote domain 'hotmail.com' failed for the following reason: Unable to bind to the destination server in DNS. "

Inbound email is still fine (because a Remote Domain smarthost points internally by IP), and from the server you can still NSLookup quite happily, and Telnet on TCP 25 to the smarthost. So why has this stopped working? and why is IIS looking up the DNS for every outbound email when it's all pumped to a smart host anyway? Changing the smarthost to an IP address gets round the problem as there's no DNS lookups, but we need to use the DNS hostname because it points to a cluster of servers.
volteuropeAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

omarfaridCommented:
Can you run nslookup on IIS server and resolve the smarthost to ip address?

If not then check if port 53 udp & tcp is blocked to your dns server.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
volteuropeAuthor Commented:
Yes from the IIS server, using NSLookup can connect to all DNS servers and resolve all names and IP's
0
omarfaridCommented:
You mentioned in your question that if you put the ip address of the smarthost it works.

You mentioned that you can telnet to port 25. Can you try to send test message from the telnet session? Do this from the IIS server to hotmail.com mail servers and see what errors you get.
0
Newly released Acronis True Image 2019

In announcing the release of the 15th Anniversary Edition of Acronis True Image 2019, the company revealed that its artificial intelligence-based anti-ransomware technology – stopped more than 200,000 ransomware attacks on 150,000 customers last year.

volteuropeAuthor Commented:
Yes you can Telnet on TCP 25 to the DNS name of the smarthost and send test messages just fine.
0
volteuropeAuthor Commented:
We have still not managed to resolve this issue. Why is IIS trying to bind to the destination host of every outbound email when everything should be going to the SmartHost??
0
volteuropeAuthor Commented:
Ok, I've resolved this. It seems the SMTP server is trying to connect to DNS using TCP instead of UDP. Our firewall has only ever allowed UDP DNS outbound, and has now been changed to allow this access out. Following article http://support.microsoft.com/kb/330070, I tried setting IIS to only use UDP but this made no difference. This must have been due to a Windows update - why is IIS trying to use TCP when UDP for DNS is the norm?!?
0
omarfaridCommented:
Hi,

I think I did mention this in my comment:

"If not then check if port 53 udp & tcp is blocked to your dns server."

So, this should have helped in solving the problem. So, I don't agree to refund points.


0
volteuropeAuthor Commented:
Ok, sorry, yes you did, but this is still only a work-around to the problem. I wasnt prepared to ask the firewall team to start opening ports because of some quirky Microsoft problem. I still dont know what caused this, and rather use UDP as most public DNS servers only accept UDP.
0
omarfaridCommented:
What other than smtp you have running on the same system? Why do you call it work around? did you ask MS support about it?
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Email Protocols

From novice to tech pro — start learning today.