Switching ISPs - DNS Changes

We are in the process of switching ISPs to improve our bandwidth - service will overlap - we have not cancelled the first one but the new one will be providing service next week - they have provided me with my new block of static ip addresses.

Now internally I've got a Fortigate 80C firewall (V4MR2 - Patch2 ) so theoritically I could be supporting two wan interfaces (I would rather not have to figure out how to configure that and then put it back after we get rid of ISP 1 unless you give me a compelling reason to).

Behind the firewall are three servers - all running Server 2003; one is our primary domain controller and handles AV installations (attached to logon scripts) as well as hosting a web based paging service for our staff.  Second server is Exchange 2003 (we are currently hosting our own mail although incoming  is screened by third party SPAM Filter before delivery to us).  

Now I know I need to reconfigure firewall with new addresses and I need to get the company who hosts our domain name to alter DNS records for us - which dns records do I have to request changes to and given the potential delay in propagation of dns changes how to I best time this to minimize disruption of service to all of our users (I can't afford to have 100+ users upset about missing e-mail!)

Thanks!
Lisaa_GAsked:
Who is Participating?
 
Alan HardistyConnect With a Mentor Co-OwnerCommented:
Get your hosting company to add a new MX record as a lower priority for one of your new IP Addresses as soon as you have decided which one you are going to use, make sure that IP Address is clean (check on www.mxtoolbox.com/blacklists.aspx and www.blacklistalert.org) and get your ISP to configure Reverse DNS on the new IP Address once the MX record is in place (some won't put Reverse DNS in place until an MX record exists!).

Then when you are ready to switch over (a minimum of 48 hours later) - there should be no loss of email because your MX records will have replicated globally and as your primary IP won't be available, the secondary one will.

When the switch is complete, remove the old MX record and job done.

Please also have a read of my article to check the new IP Address is configured correctly:

http://www.experts-exchange.com/Software/Server_Software/Email_Servers/A_2427-Problems-sending-mail-to-one-or-more-external-domains.html
0
 
droydenConnect With a Mentor Commented:
Prior to the DNS change you should ask the current company who runs the dns to drop the cache and time to live (TTL) values down very low. Although this will mean that their DNS servers will get more traffic over the migration period it will also mean that dns changes are reflected and propagated across other servers alot quicker (since they arent caching for so long)
0
 
Llacy80Connect With a Mentor Commented:
You will need to change the A and MX records and any other host records through your DNS provider (most offer you the ability to login in to their web interface to change it). I would change on a Friday evening if possible because it can sometimes take up to 48 hours to propogate.

0
Evaluating UTMs? Here's what you need to know!

Evaluating a UTM appliance and vendor can prove to be an overwhelming exercise.  How can you make sure that you're getting the security that your organization needs without breaking the bank? Check out our UTM Buyer's Guide for more information on what you should be looking for!

 
sshah254Connect With a Mentor Commented:
Droyden is right - drop the TTL.  Your TTL must be 86400 (1 day).  If you have it lower you are lucky.  Most registrars will allow you to lower your TTL to between 300 (5 mins) to 14400 (4 hours).  Drop it to as low as value as possible, and then follow alanhardisty's steps.

Ss
0
 
Lisaa_GAuthor Commented:
Thank you all - great input and really fast !  This sounds great from a service continuity perspective which is my primary concern - this sound like I'll have to keep both wan interfaces on the firewall for a short period though - am I correct?

0
 
Llacy80Connect With a Mentor Commented:
Also since you do have a third party spam in place your lowest MX record is already set to them so I am pretty sure any undeliverable mail should be queued up on their end...
0
 
Alan HardistyConnect With a Mentor Co-OwnerCommented:
You won't need to keep both WAN interfaces alive - if you have two MX records - one pointing to the old IP and one to the new IP - you can switch ISP's at your leisure and then only have one working WAN port.  Mail will try delivery to the primary MX record and then failover to the secondary.
0
 
Lisaa_GAuthor Commented:
Thank you all - hope you don't mind sharing the points.

Great answers - complete - I can proceed with confidence now - you all make me look good!
0
All Courses

From novice to tech pro — start learning today.