MSABBAGH
asked on
SMTP cannot connect to any DNS server on my Exchange Server
We migrated our ISA Server 2004 to new hardware last week. A couple of days ago, our outbound mail ceased to leave our Exchange Server and is queued with the error message "SMTP cannot connect to any DNS server."
I ran DNSDIAG on my exchange server, testing different mail domains, with total success. Nevertheless nslookup and telnet through port 25 to these domains fail.
We are not listed on any spam list.
I ran DNSDIAG on my exchange server, testing different mail domains, with total success. Nevertheless nslookup and telnet through port 25 to these domains fail.
We are not listed on any spam list.
ASKER
ISA is our front end firewall and our Exchange Server has external DNS servers configured on its SMTP virtual server. Unfortunately I inherited a setup in which the Exchange server is our DC also.
We also have DNS running on ISA. Can you elaborate a bit on how we would set up ISA's DNS as the forwarder for our domain and how our DC would point to ISA Server?
We also have DNS running on ISA. Can you elaborate a bit on how we would set up ISA's DNS as the forwarder for our domain and how our DC would point to ISA Server?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
How do I change Exchange Server to use ISA Server as its DNS source (remember that the Exchange Server is also our sole DC)? When I try to configure Forwarders on the DNS console, it is not possible because "forwarders are not available because this is a root server."
ASKER
Forget the last comment. I get it.
Do I have to reboot for these changes to take effect.
Do I have to reboot for these changes to take effect.
ASKER
I have redirected my Exchange server to ISA's DNS. DNS in ISA now has forwarders to external DNS. I created a new connector with "Use DNS to route to each address space on this connector" selected on its General Properties tab.
Now I get a "The remote server did not respond to a connection attempt."
Further help would be much appreciated.
Now I get a "The remote server did not respond to a connection attempt."
Further help would be much appreciated.
ASKER
Additional information.
DNSDIAG resolves names yet we cannot establish a connection on port 25 with Telnet to external mail domains from our Exchange Server.
DNSDIAG resolves names yet we cannot establish a connection on port 25 with Telnet to external mail domains from our Exchange Server.
I presume your ISA Server is the route of last resort for the network (default gateway). If so then do you have a rule to allow SMTP traffic from just the Exchange Servers to the EXTERNAL network?
Can you also confirm that DNs is working throughout the domain? Not just for Internal name resolution but for internet browsing and the like? (just so we know that the DNS issue is sorted)
sounds like your isa server is actively blocking outbound smtp connections from your exchange box
I'd adjust the ruleset
you might want to look at all the rules on your isa server that pertain to your internal exchange box - I'm thinking you'll find that no traffic is being allowed out past the proxy
I'd adjust the ruleset
you might want to look at all the rules on your isa server that pertain to your internal exchange box - I'm thinking you'll find that no traffic is being allowed out past the proxy
ASKER
Exchange servers do have a rule allowing SMTP to External.
Internal DNS is working. Now, internal computers use DC's DNS and DC uses ISA's DNS.
I have checked ISA rules over and over again and nothing seems to be blocking. I enclose results from SMTPDIAG from the Exchange Server.
SNAPSHOT.doc
Internal DNS is working. Now, internal computers use DC's DNS and DC uses ISA's DNS.
I have checked ISA rules over and over again and nothing seems to be blocking. I enclose results from SMTPDIAG from the Exchange Server.
SNAPSHOT.doc
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
I created a deliver-by-dns connector. No other user-connectors exist so I really do not understand the "lower cost than other connectors" part of your question.
If you fire up monitor on the ISA Server and monitor only traffic from the Exchange Servers what does it show you?
if there is only one connector then the cost is irrelevant - it only comes into play when you have more than one connector
the rule on your proxy server should look something like this - allow smtp, dns from your exchange_server to all
the rule on your proxy server should look something like this - allow smtp, dns from your exchange_server to all
ASKER
Things finally worked out. Our DC/Mail server is dual-homed. Do not ask why; I inherited it this way. After creating the connector and clicking on the "Use DNS to route to each address space on this connector", the IP address pertaining to the SMTP Virtual Server was not configured to use ISA's DNS while the other one was. After switching configurations, everything worked as it should.
Warm thanks to ABHAIGH and the points are yours.
Warm thanks to ABHAIGH and the points are yours.
ASKER
And warm thanks to Kieran Burns who also shares the points!
ASKER
Thank you again.
Your Exchange Servers are using EXTERNAL DNS for name resolution?
If it was me, I would have DNS running on the ISA Server and have that as the forwarder for your Domain, and then have the EXTERNAL DNS Servers as forwarders for it.
So, your DC's would have DNS running, the Exchange Servers would use them for DNS services. The DC's would point to the ISA Server for domains they don't know about, and ISA would only allow external name resolution through.