Solved

need to send mail through exchange server but isp blocks outbound port 25

Posted on 2008-06-18
29
362 Views
Last Modified: 2013-12-14
i was an attglobal dsl cutomer with an exchange server on the inside sending and recieving mail. one day we switched over to cable and kept the att dsl line for a backup in case cable ever failed. when  i switched to cable i saved the firewall config file for the dsl line, and the changes i made were only to our public ip address. i also changed dns info on my server. switched the cable and everything worked fine! recently our cable line went down and i switched back to the dsl. upped the old dsl config file changed the dns ionfo on the server switche dth eline and internet came up and incomming mail started flowing. only thing is i could send any mail out. i can not figure out for the life of me why mail will not leave my org. it sits in the exchange queu. there are not smtp relays on the exchange server and everything worked fine before. please let me know if there is anymor einfo i could provide.


0
Comment
Question by:cfischer225
  • 13
  • 8
  • 4
  • +1
29 Comments
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 21813090
Did you change the MX record to reflect the new DNS?
0
 

Author Comment

by:cfischer225
ID: 21813168
i did, when i do an nslookup it resolves properly to the dsl ine (the one i changed it to) but mail still didnt go out
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 21813198
So, you can recieve email but can't send any out? Do you have any errors on the server or any bounce backs? Have you checked to see if you are blacklisted? Spam Cop is a site to see if you blacklisted.
0
 

Author Comment

by:cfischer225
ID: 21813256
not blacklisted, no errors, just all the mail getting held up in exchange queu. as soon as i switched back to cable:

upped config file to firewall (exact same file with diff public ip)
changed dns info on server
switched cat5 to cable modem
changed mx record

all mail that was held up was sent
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 21813301
Call your DSL provider and ask if they blocked port 25. I just had a case two days ago on this same site that they DSL provider blocked port 25.
0
 
LVL 29

Expert Comment

by:Michael W
ID: 21813338
Some providers block port 25 if you are not using their 'business account' setup. When this happens, I recommend using a smarthost to send and receive all of your e-mail through.

Reference:
http://en.wikipedia.org/wiki/Smart_host

Comcast, a known provider that blocks outbound e-mail, does something like this as well. So to bypass their system, I utilize what is called a Mail Relay through DNSExit (Mail-Based Service Provider). It allows the external smarthost send all of my e-mail through them on a different port.

http://www.dnsexit.com/Direct.sv?cmd=mailRelay

If your inbound port 25 is also being blocked. DNSExit also offers a service called Mail Redirection.

http://www.dnsexit.com/Direct.sv?cmd=mailRedirect
0
 

Author Comment

by:cfischer225
ID: 21813499
i originally thought port 25 outbound was blocked but i just was able to telne to some servers through 25 and others not through 25. i could get to
cisco.com
mail.oradell.com (another one of my clients)

i could not get to
google.com
mail.yahoo.com

i do not have a smart host set up and my isp said port 25 is not blocked but they could not prove that to me. i think i proved it by telnetting through port 25 to the above servers
0
 
LVL 29

Expert Comment

by:Michael W
ID: 21813566
The best way to tell if your incoming port 25 is being blocked is to try:

'telnet your_external_ip_address 25'

If it connects, then port 25 is accepting inbound connections.

0
 

Author Comment

by:cfischer225
ID: 21813928
since i can recieve mail i would assume incomming port 25 is open...correct?
0
 

Author Comment

by:cfischer225
ID: 21813969
i also went to another machine and telnetted to my public address on the dsl line, but since there is not mail server to answer back the telnet went through then cut out as oppossed to not connecting
0
 

Author Comment

by:cfischer225
ID: 21814061
when i do a reverse lookup on my address 12.98.177.207 it comes up with :

207.177.98.12.in-addr.arpa PTR 207.mube.nyrk.nycenycp.dsl.att.net.

could this be part o fmy problem?
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 21814098
Yes.
0
 

Author Comment

by:cfischer225
ID: 21814312
they do not support reverse dns so it can not point to me.
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 21814649
Are you getting bounce backs or errors?
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 

Author Comment

by:cfischer225
ID: 21814708
my users are getting delayed notices and eventuillay ndr's. i looked in the evnt viewer and could not find any error messages. i think in the queu it said something like remote server could not be reached
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 21814715
Can you post one of the NDRs?
0
 

Author Comment

by:cfischer225
ID: 21814772
no one has any ndr's from that day i have a delay:
Reporting-MTA: dns;mail.pangaiapartners.com

Final-Recipient: rfc822;rjcpsu2003@yahoo.com
Action: delayed
Status: 4.4.7
Will-Retry-Until: Fri, 13 Jun 2008 10:32:00 -0400
X-Display-Name: rjcpsu2003@yahoo.com
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 21815124
Did you do a ipconfig /flushdns when you switched? Also, do a netlogon /fix.
0
 

Author Comment

by:cfischer225
ID: 21815561
i did not flush the dns, i will try that. would that affect outgoing mail but nothing else?
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 21815610
With my experience yes it could if you had a DNS address change.
0
 
LVL 29

Expert Comment

by:Michael W
ID: 21815708
To make sure that the Exchange server environment nor DNS entries aren't at fault, one site I recommend is the MX Toolbox (www.mxtoolbox.com).

Goto this site, then check your Exchange server name through both the MX Lookup Tool and the SMTP Diagnostics Tool as well.

---

ABOUT MX LOOKUP -- This test will list MX records for a domain in priority order. The MX lookup is done directly against the domain's authoritative name server, so changes to MX Records should show up instantly.

ABOUT SMTP DIAGNOSTICS -- This test will connect to a mail server via SMTP, perform a simple Open Relay Test and verify the server has a reverse DNS (PTR) record.  It will also measure the response times for the mail server.  
0
 
LVL 29

Expert Comment

by:Michael W
ID: 21815730
Another thing -- are you running any type of anti-virus/anti-spam applications on your Exchange server environment? Applications like Symantec can add in modules like e-mail auto protect which can hose up/delay messages in the Exchange queues.
0
 
LVL 9

Accepted Solution

by:
Press2Esc earned 500 total points
ID: 21993879
As indicated above, I will assume your domain is pangaiapartners.com and your mail server is 12.98.177.207

The PTR for 12...207 resolves to 207.mube.nyrk.nycenycp.dsl.att.net - this is a good thing if you are trying to deliver AT&T, bellsouth, etc mail  -however, I am not sure about delivering any email to anyone else...  you cable connection works because mail.pangaiapartners.com resolves to 68.195.194.138 (cable), which has correct MX and PTR records and also allows online access to Exchange OWB.  

According to mxtoolbox there is NO MX record (or host name) for mail.pangaiapartners.com which resolves to 12...207.  You need to create a MX record to 12...207 - this should resolve your issue.

Also, I could not ping nor telnet (25/110) to 12.98.177.207.  This is not good if this your mail server is 12...207 AND you are NOT intentionally blocking (e.g., firewall, https, non-std port) access to the mail server.

Finally, per your posted NDR errors:
"no MX record" - see my explaination above.
"Status: 4.4.7" - check the receiving server connectors for error.

* cfischer225, pls explain "they do not support reverse dns so it can not point to me."

P2E
0
 

Author Comment

by:cfischer225
ID: 21997686
"cfischer225, pls explain "they do not support reverse dns so it can not point to me."
means that the PTR for 12...207 will allways resolve to 207.mube.nyrk.nycenycp.dsl.att.net and never mail.pangaiapartners.com

alsot he reaosn you could not ping is because it is not hooked up right now it is a backup line used only when our primary 68.195.194.138 line is down. when i need to make that switch i go in and change the mx record with no-ip.com who holds it so mail.pangaiapartners.com points to 12...207.
0
 
LVL 9

Expert Comment

by:Press2Esc
ID: 21999165
i see.  bellsouth must be alittle different, you can reuest the PTR to reflect the actual mail host name (e.g., mail.pangaiapartners.com); as long as your not having problems delivering mail to other domains, the rDNS 207.mube.nyrk.nycenycp.dsl.att.net  should work...

per your post, I was under the impression that the broadband cable was down and you were ruished to get the mail working via dsl.  my bad.
0
 

Author Comment

by:cfischer225
ID: 21999379
i'll call and see if they can make the ptr mail.pangaiapartners.com
0
 
LVL 9

Expert Comment

by:Press2Esc
ID: 21999903
Because you have 2 seperate broadband connections, you will need min 2 PTRs for cable and dsl.  Both and mail.pangaiapartners.com & 207.mube.nyrk.nycenycp.dsl.att.net should work ok.  

I am bit curious if AT&T's PTR record (207.mube.nyrk.nycenycp.dsl.att.net) is functionally equivelent to 138.194.195.68 -.IN-ADDR.ARPA.

P2E
0
 

Author Comment

by:cfischer225
ID: 21999977
what do you mean functionaly equivalent?
0
 
LVL 9

Expert Comment

by:Press2Esc
ID: 22000245
per rfc2317/rfc1035, useage of 138.194.195.68.IN-ADDR.ARPA is a classless (unspecific) ARPA DNS record that is readily understood by DNS servers.  In comparison to at&t's 207.mube.nyrk.nycenycp.dsl.att.net PTR record, the clever reversal of the IP address in ARPA, is easily understood as a reverse dns pr pointer record.  

P2E
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Check out this infographic on what you need to make a good email signature that will work perfectly for your organization.
This process describes the steps required to Import and Export data from and to .pst files using Exchange 2010. We can use these steps to export data from a user to a .pst file, import data back to the same or a different user, or even import data t…
In this video we show how to create a Shared Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Sha…
The video tutorial explains the basics of the Exchange server Database Availability groups. The components of this video include: 1. Automatic Failover 2. Failover Clustering 3. Active Manager

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now