Link to home
Start Free TrialLog in
Avatar of fcsdata2
fcsdata2

asked on

Using Round Robin DNS between two different mail systems and not all the same user accounts

Here is my situation.   I am trying to set up Google Apps for Education for a client.   The apps part is all done except for the Gmail portion.    I'm trying to do this a little different than the Google recommended method.   I know someone who has done this, he's just not sure how he set it up to work on both system, they switched to straight Gmail.
Here is the scenario.   I have a Groupwise server with admin, staff, and faculty.   In Gmail I have some staff members and students.   The staff members in Gmail are also on the Groupwise server.   The users on Gmail will no longer use Groupwise, but the accounts will still be there for Groupwise members to communicate with.   In the Gmail client, we IMAP the Groupwise server and use a fake pop mail account with the actual pop server name.   This way, Gmail picks up all of the messages for that user and syncs them up.    My problem is getting a round robin DNS structure with the MX records that works correctly.   Previous attempts have had some mail bounced by the Gmail server because I wasn't doing the records correctly.    I would like to see if this round robin structure is likely to succeed or am I going about it wrong.   I've done this on Exchange before but never two totally different servers and different users in the same domain.   Here it is:

 1 ourdomain.s10a1.psmtp.com    (gmail postini spam server)
 1 ourdomain.s10a2.psmtp.com
 5 barracuda.ourdomain.com    (gateway to Groupwise server)
 5 aspmx.l.google.com              (Google mail server)
10 barracuda.ourdomain.com
10 alt1.aspmx.l.google.com
10 alt2.aspmx.l.google.com
15 ourdomain.s10b1.psmtp.com      
20 barracuda.ourdomain.com
20 aspmx2.googlemail.com
25 ourdomain.s10b2.psmtp.com
30 barracuda.ourdomain.com
30 aspmx3.googlemail.com

If I understand Postini correctly, all mail is directed to them first and them I want it to find the appropriate server for delivery.    So a Groupwise users mail goes to Postini, then Postini asks both Gmail server and Groupwise server if the user is valid and always give Groupwise mail to Groupwise (Gmail users can pick up mail from either server) and not bounce the message if Gmail server doesn't have that user.    I appreciate any and all imput.
Avatar of giltjr
giltjr
Flag of United States of America image

I think you are getting a few terms confused.  Round robin DNS is when you have multiple A records for the same host name pointing to multiple IP addresses.

What you are doing is just setting up multiple MX records.  

How this is designed to work is when a MX query for your domain is done, all MX records are returned.

The SMTP server that is sending the e-mail to you should choose the host name on the MX record with the highest priority, which is the lowest number.  That is 1 is a higher priority than 30.

If it can't get to any of the highest priority hosts, it will then try the next priority, and so on until it has tried all hosts from all MX records.

However, that is how it is designed to work.

For some unusual reason, the MX records are returned in random order, so the 1st time you query you could get them in this order:

    1 ourdomain.s10a2.psmtp.com
    5 barracuda.ourdomain.com
    5 aspmx.l.google.com
    10 barracuda.ourdomain.com

The next time you could get this order:

    10 barracuda.ourdomain.com
     5 barracuda.ourdomain.com
     1 ourdomain.s10a2.psmtp.com
     5 aspmx.l.google.com

What should occure is the querying SMTP server should sort the records in priority.  However some SMTP server just try them in the order they received them.  So in the  second instance, 10 barracuda.ourdomain.com could be tried before 1 ourdomain.s10a2.psmtp.com.  To make it worse, some SMTP server will only try the 1st one in the list and if it works great, if it fails, it stops and retries later on.

So Postini is correct in that e-mail SHOULD be sent to them 1st, but unfortunately in the real world it does not always work that way.
Avatar of fcsdata2
fcsdata2

ASKER

There are actually 4 Postini servers.   If I place the 4 Postini servers first, one priority level above the other and then mail servers listing a gmail and a groupwise server in the same priority leve, that won't always work?   Ex.
1 Postini 1
2 Postni 2
3 Postini 3
4 Postini 4
10 barracuda.domain.com
10 gmail1 server
20 barracuda.domain.com
20 gmail2 server
....etc.

Are you saying that what I want to do isn't really possible to pull off reliably using DNS?    The Google method uses email forwarding and that's a huge amount of work plus I would have to add several hundred users into Groupwise and I'm pretty sure we aren't licensed for that many.    We really want students to only exist in Gmail, but Groupwise doesn't use mx records so it would bounce student emails that are sent with the same domain name.    If the faculty that will use Google Apps with Students would have to stop using Groupwise and switch to Gmail, but we are just starting the pilot phase and I don't thank we want to nuke Groupwise for Gmail with everyone.
Also, what good  are prioritiy settings if they will just be randomly used?   I want them to be used in order, but you are saying that doesn't really happen.
Correct, what you want to do can not be reliable done just based on DNS.  

Most SMTP server are written so that they sort the MX records in priority order and use them in priority order.  

There are a few that do not, at least there used to be a few that did not.  

They could have been written by an inexperienced programmer who wanted to take short cuts, somebody that assumed MX records were returned in priority order, or just mis-understood the RFC's involved in writing a SMTP server.

Now, I need to try and wrap my head around why you would need to have anything other than the Postini servers.

The only time a SMTP server should use a MX record other than the highest priority one is if it can't connect to it.

If it connects and gets back a "no such account", the sending SMTP server is supposed to stop trying to send that e-mail.  It does not continue trying all of the other servers.

The only hosts you should have MX records for are the ones that can accept all e-mail that can be sent to you.
Postini is a spam and virus filter.   I currently use a Baracuda (hence the name in the mx record) Spam and Virus Firewall.   I would move to Postini but I need to have Postini ask both of my servers for it's list of users and pass it on to the correct server.    I don't think I can tell Postini to do this directly.   Google apps does most things by DNS records.    I have A records for the other services such as groups.domain.com instead of the regular groups.google.com and it points to a private holding of groups, etc.    Maybe I was getting bad advice and that's why all hell broke loose when I tried something similar to this.   My original idea was to set up a subdomain such as students.domain.com and create an mx record that would point the subdomain email to students.domain.com.   That way groupwise could also communicate with students (I think, or would the domain name in the address screw up Groupwise) and those messages get sent to the Postini servers.   After I reviewed what I tried, I saw what was happening.   I was doing round robin with both servers, but Gmail would always bounce the nonexistant e-mail (like it rightfully should).    I'm not sure how I can actually fix this with the pilot users, I may have to wait for summer break and redo the subdomain thing.
     Clarify this for me.   If you have two MX records with the same priority what happens)  Does it ask for a response from both or will it just alternate or randomly ask either server for info?    I've never done anything this complex with DNS MX records, so I'm just wondering.   Load balancing and failover is what I have done before, but never created two records with the same priority.   Thinking about it, would it just create a loop and case loads of DNS traffic?
I may have been given completely wrong information from the guy who told me how he made this work.   I checked what he does now and he only has the 4 postini servers.   Will a local email server like Groupwise be confused with an alias domain like @st.domain.com when regular mail is @domain.com or will it go to mx records to find the server for the alias domain?
ASKER CERTIFIED SOLUTION
Avatar of Chris Dent
Chris Dent
Flag of United Kingdom of Great Britain and Northern Ireland image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
This is starting to explain a lot.    I made the mistake of putting faith in someone I really wasn't fully sure of their technical ability.   We had implemented an MX record change per his suggestion but it wasn't fully working for us.   Students could send to us, but we couldn't send to them.   This would be because the way we set it up pointed to Groupwise first.   Groupwise had the staff member account and pass the mail on.   But the reply would bounce (Groupwise was taking it as a local address producing the NDR).   I expected it to work that way, but he claimed the my records weren't right and round robin would allow the mail through.   Supposedly he did this, but I don't believe it at all now.   I bet they had a lot of problems, Groupwise took the blame and they went strictly with Gmail.
I'll leave this question open for the day and award points tomorrow.   I like the comments and I'm learning from it.   Thanks.
I left out, that we were experiencing some odd behaviors and I didn't realize it until comments were made during a brief outage.    Makes a lot of sense now.
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Thanks for the feedback.   Part of what he told me does work, just not the DNS MX records.   I went back to my single MX record and everything works with Gmail like it did before.   The MX records didn't have anything to do with getting mail to users on the Gmail side, it was IMAP and a fake POP account that do the heavy lifting.    He was doing the MX stuff on a system half our size and it was probably more luck than anything that it didn't fall apart real quickly.   I looked at their MX records today and now he only has 4.   Just the 4 Postini servers, like Google recommends.   Maybe I helped him learn a little from the expierience I was having on a larger network.   It was probably going on there, but not a noticeable.    He has a lot of knowledge, just a little confused on this aspect.   What they have done with Google apps is very impressive.
Thanks again!
More of a learning excercise in DNS than anything.