Solved

Switching ISPs - DNS Changes

Posted on 2011-02-26
8
611 Views
Last Modified: 2012-05-11
We are in the process of switching ISPs to improve our bandwidth - service will overlap - we have not cancelled the first one but the new one will be providing service next week - they have provided me with my new block of static ip addresses.

Now internally I've got a Fortigate 80C firewall (V4MR2 - Patch2 ) so theoritically I could be supporting two wan interfaces (I would rather not have to figure out how to configure that and then put it back after we get rid of ISP 1 unless you give me a compelling reason to).

Behind the firewall are three servers - all running Server 2003; one is our primary domain controller and handles AV installations (attached to logon scripts) as well as hosting a web based paging service for our staff.  Second server is Exchange 2003 (we are currently hosting our own mail although incoming  is screened by third party SPAM Filter before delivery to us).  

Now I know I need to reconfigure firewall with new addresses and I need to get the company who hosts our domain name to alter DNS records for us - which dns records do I have to request changes to and given the potential delay in propagation of dns changes how to I best time this to minimize disruption of service to all of our users (I can't afford to have 100+ users upset about missing e-mail!)

Thanks!
0
Comment
Question by:Lisaa_G
  • 2
  • 2
  • 2
  • +2
8 Comments
 
LVL 76

Accepted Solution

by:
Alan Hardisty earned 250 total points
ID: 34989065
Get your hosting company to add a new MX record as a lower priority for one of your new IP Addresses as soon as you have decided which one you are going to use, make sure that IP Address is clean (check on www.mxtoolbox.com/blacklists.aspx and www.blacklistalert.org) and get your ISP to configure Reverse DNS on the new IP Address once the MX record is in place (some won't put Reverse DNS in place until an MX record exists!).

Then when you are ready to switch over (a minimum of 48 hours later) - there should be no loss of email because your MX records will have replicated globally and as your primary IP won't be available, the secondary one will.

When the switch is complete, remove the old MX record and job done.

Please also have a read of my article to check the new IP Address is configured correctly:

http://www.experts-exchange.com/Software/Server_Software/Email_Servers/A_2427-Problems-sending-mail-to-one-or-more-external-domains.html
0
 
LVL 7

Assisted Solution

by:droyden
droyden earned 100 total points
ID: 34989067
Prior to the DNS change you should ask the current company who runs the dns to drop the cache and time to live (TTL) values down very low. Although this will mean that their DNS servers will get more traffic over the migration period it will also mean that dns changes are reflected and propagated across other servers alot quicker (since they arent caching for so long)
0
 
LVL 4

Assisted Solution

by:Llacy80
Llacy80 earned 100 total points
ID: 34989073
You will need to change the A and MX records and any other host records through your DNS provider (most offer you the ability to login in to their web interface to change it). I would change on a Friday evening if possible because it can sometimes take up to 48 hours to propogate.

0
 
LVL 9

Assisted Solution

by:sshah254
sshah254 earned 50 total points
ID: 34989091
Droyden is right - drop the TTL.  Your TTL must be 86400 (1 day).  If you have it lower you are lucky.  Most registrars will allow you to lower your TTL to between 300 (5 mins) to 14400 (4 hours).  Drop it to as low as value as possible, and then follow alanhardisty's steps.

Ss
0
What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 

Author Comment

by:Lisaa_G
ID: 34989094
Thank you all - great input and really fast !  This sounds great from a service continuity perspective which is my primary concern - this sound like I'll have to keep both wan interfaces on the firewall for a short period though - am I correct?

0
 
LVL 4

Assisted Solution

by:Llacy80
Llacy80 earned 100 total points
ID: 34989095
Also since you do have a third party spam in place your lowest MX record is already set to them so I am pretty sure any undeliverable mail should be queued up on their end...
0
 
LVL 76

Assisted Solution

by:Alan Hardisty
Alan Hardisty earned 250 total points
ID: 34989103
You won't need to keep both WAN interfaces alive - if you have two MX records - one pointing to the old IP and one to the new IP - you can switch ISP's at your leisure and then only have one working WAN port.  Mail will try delivery to the primary MX record and then failover to the secondary.
0
 

Author Closing Comment

by:Lisaa_G
ID: 34989133
Thank you all - hope you don't mind sharing the points.

Great answers - complete - I can proceed with confidence now - you all make me look good!
0

Featured Post

Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

Utilizing an array to gracefully append to a list of EmailAddresses
Not sure what the best email signature size is? Are you worried about email signature image size? Follow this best practice guide.
In this video we show how to create a Contact in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Contact ta…
The basic steps you have just learned will be implemented in this video. The basic steps are shown to configure an Exchange DAG in a live working Exchange Server Environment and manage the same (Exchange Server 2010 Software is used in a Windows Ser…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now