Solved

Reverse DNS not working, mail not flowing

Posted on 2009-07-09
9
500 Views
Last Modified: 2013-11-30
On the morning of the July 7th our email stopped flowing to a number of domains, namely aol,cox,comcast,rr,juno and a bunch of others. Basically the error we get in the log is this...

2009-07-09 16:14:49 205.188.155.72 OutboundConnectionResponse SMTPSVC1 GEMINI - 25 - - 220-rly-dg08.mx.aol.com+ESMTP+mail_relay_in-dg08.6;+Thu,+09+Jul+2009+12:14:51+-0400 0 0 83 0 32 SMTP - - -
2009-07-09 16:14:49 205.188.155.72 OutboundConnectionCommand SMTPSVC1 GEMINI - 25 EHLO - mail.libertyhospital.org 0 0 4 0 32 SMTP - - -
2009-07-09 16:14:49 167.206.4.77 OutboundConnectionResponse SMTPSVC1 GEMINI - 25 - - 452+4.2.1+Your+host+66.141.233.241+has+no+DNS+record+.+If+you+are+using+a+firewall+please+configure+DNS+and+try+again+authoritative+host+not+found:+ovacc@optonline.net 0 0 167 0 610 SMTP - - -
2009-07-09 16:14:49 167.206.4.77 OutboundConnectionCommand SMTPSVC1 GEMINI - 25 RSET - - 0 0 4 0 610 SMTP - - -
2009-07-09 16:14:49 205.188.249.91 OutboundConnectionResponse SMTPSVC1 GEMINI - 25 - - 220-rly-de08.mx.aol.com+ESMTP+mail_relay_in-de08.3;+Thu,+09+Jul+2009+12:14:51+-0400 0 0 83 0 93 SMTP - - -
2009-07-09 16:14:49 205.188.249.91 OutboundConnectionCommand SMTPSVC1 GEMINI - 25 EHLO - mail.libertyhospital.org 0 0 4 0 93 SMTP - - -
2009-07-09 16:14:49 205.188.155.72 OutboundConnectionResponse SMTPSVC1 GEMINI - 25 - - 250-rly-dg08.mx.aol.com+peer+name+unknown 0 0 41 0 78 SMTP - - -
2009-07-09 16:14:49 205.188.155.72 OutboundConnectionCommand SMTPSVC1 GEMINI - 25 MAIL - FROM:<Crodick@libertyhospital.org> 0 0 4 0 78 SMTP - - -
2009-07-09 16:14:49 63.138.68.59 smtp.paydaymess.com SMTPSVC1 GEMINI 192.168.223.4 0 RCPT - +TO:<julie.hering@libertyhospital.org> 550 0 0 42 12782 SMTP - - -
2009-07-09 16:14:49 167.206.4.77 OutboundConnectionResponse SMTPSVC1 GEMINI - 25 - - 250+2.5.0+Ok. 0 0 13 0 657 SMTP - - -
2009-07-09 16:14:49 205.188.249.91 OutboundConnectionResponse SMTPSVC1 GEMINI - 25 - - 250-rly-de08.mx.aol.com+peer+name+unknown 0 0 41 0 125 SMTP - - -
2009-07-09 16:14:49 205.188.249.91 OutboundConnectionCommand SMTPSVC1 GEMINI - 25 MAIL - FROM:<LRICHWINE@libertyhospital.org> 0 0 4 0 125 SMTP - - -
2009-07-09 16:14:49 167.206.4.77 OutboundConnectionResponse SMTPSVC1 GEMINI - 25 - - 452+4.2.1+Your+host+66.141.233.241+has+no+DNS+record+.+If+you+are+using+a+firewall+please+configure+DNS+and+try+again+authoritative+host+not+found:+oilmanshoney@optonline.com 0 0 174 0 687 SMTP - - -
2009-07-09 16:14:49 167.206.4.77 OutboundConnectionCommand SMTPSVC1 GEMINI - 25 RSET - - 0 0 4 0 687 SMTP - - -

We have exchange 2003 with a frontend server in the DMZ behind a PIX firewall and an enternal server with all the mailboxes. Email flows in just fine and out to some domains with no problem. When I run a test from mxtoolbox this is what I get

RESULT: mail.libertyhospital.org
Banner: 220 mail.libertyhospital.org Microsoft ESMTP MAIL Service, Version: 6.0.3790.3959 ready at Thu, 9 Jul 2009 11:27:15 -0500
Connect Time: 0 seconds - Good
Transaction Time: 12.641 seconds - Not good!
Relay Check: OK - This server is not an open relay.
Rev DNS Check: Reverse DNS FAILED! This is a problem.
GeoCode Info: Geocoding server is unavailable
Session Transcript: HELO please-read-policy.mxtoolbox.com
250 mail.libertyhospital.org Hello [64.20.227.13 [47 ms]
MAIL FROM: <test@mxtoolbox.com>
250 2.1.0 test@mxtoolbox.com....Sender [31 ms]
RCPT TO: <test@mxtoolbox.com>
550 5.7.1 Unable to relay for test@mxtoolbox.c [12516 ms]
 
 
I ran the dnsdiag on our frontend server and it checks out ok. At home I have roadrunner (one of the offending domains) and I am unable to reverse lookup our IP from there but internally and on our public wireless we have it works just fine.

The main thing I am trying to figure out is why would our DNS servers not be replying with the rDNS info. We host our own DNS servers (long story, but SBC kept screwing up the records before). They are both W2K3, one is the primary, one a secondary.

If you need more info let me know.
0
Comment
Question by:arosenboom
9 Comments
 
LVL 71

Accepted Solution

by:
Chris Dent earned 500 total points
ID: 24815495

If the name above is the name of the e-mail server then no public delegation for the IP range exists beneath 141.66.in-addr.arpa which belongs to swbell.net / sbcglobal.net.

Without the delegation there's no way for a system asking for that record to find your servers, assuming those are the ones hosting the reverse lookup zone.

Chris
0
 
LVL 8

Expert Comment

by:Npatang
ID: 24815580
Make sure you have the pointer record created in your external DNS......SOme of the domains do loko for the reverse DNS resolution ..
0
 

Author Comment

by:arosenboom
ID: 24815677
We do have the PTR record on our DNS. I've checked it, deleted it, recreated it. That doesn't seem to be the problem.

It is name of the server. Last year this time the same thing happened and it took a couple of days for the problem to go away pretty much by itself even though we tried a lot. Could SBC be messing with our domain and IP range. We bought the 66.141.233 from SBC a few years ago (2003). It sounds like they need a pointer for the 233 network to point to our DNS server, is that correct?
0
Revamp Your Training Process

Drastically shorten your training time with WalkMe's advanced online training solution that Guides your trainees to action.

 
LVL 71

Expert Comment

by:Chris Dent
ID: 24815746

> It sounds like they need a pointer for the 233 network to point to our DNS server, is that correct?

They need a delegation, but I think you mean the same thing. They need to create this if you have the /24 from them:

233.141.66.in-addr.arpa. IN NS ns1.you.com.
233.141.66.in-addr.arpa. IN NS ns2.you.com.

If it's classless delegation it's a bit more complex, but it still fails at their name servers.

Chris
0
 
LVL 65

Expert Comment

by:Mestha
ID: 24815747
Where did you look for the reverse DNS?
If you are looking in the DNS server applet on your network, then that is the wrong place. Your ISP has to set the reverse DNS and it is highly unusual for an ISP to delegate control of the IP addresses to a customer.
You need to speak to your ISP and see what they can do for you.

Simon.
0
 

Author Comment

by:arosenboom
ID: 24816495
Thanks Chris, we are looking into it. Our guy that usually deals with the SBC is on vacation so I am waiting on an email back from him.

Mestha - Yes I was looking on our DNS server. We control DNS for our domain and IP range, we "own" it. I will be contacting them though since it does sound like they have messed something up with the 233 delegation.

I will let you know more in a while.
0
 

Author Comment

by:arosenboom
ID: 24816623
Chris - what did you use to find that data in your first post?
0
 
LVL 71

Expert Comment

by:Chris Dent
ID: 24817949

I use Dig with a nice Windows version of it here:

http://members.shaw.ca/nicholas.fong/dig/

If you follow the instructions to set it up (you can leave resolv.conf blank) you can run this:

dig 241.233.141.66.in-addr.arpa +trace

It shows you exactly where the delegations stop.

Assuming that's the correct IP address of course :)

NsLookup can do it as well, but it's harder to get useful results.

Chris
0
 

Author Closing Comment

by:arosenboom
ID: 31601699
We were able to contact SBC, they claimed the rDNS was never even setup for our domain although this had worked in the past. They added the delegation earlier today and all the email is flowing again. Thanks for your help.
0

Featured Post

How our DevOps Teams Maximize Uptime

Our Dev teams are like yours. They’re continually cranking out code for new features/bugs fixes, testing, deploying, responding to production monitoring events and more. It’s complex. So, we thought you’d like to see what’s working for us. Read the use case whitepaper.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
DNS Issues With Machines 2 40
Migrating imap accounts to onsite exchange 6 38
Removing Exchange 2003 3 17
Restrict Mailbox size in Exchange 2 26
Marketers need statistics and metrics like everybody else needs oxygen. In this article we explain how to enable marketing campaign statistics for Microsoft Exchange mail.
Find out what you should include to make the best professional email signature for your organization.
To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an antispam), the admini…

730 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question