Solved

Using Round Robin DNS between two different mail systems and not all the same user accounts

Posted on 2011-03-18
12
734 Views
Last Modified: 2012-05-11
Here is my situation.   I am trying to set up Google Apps for Education for a client.   The apps part is all done except for the Gmail portion.    I'm trying to do this a little different than the Google recommended method.   I know someone who has done this, he's just not sure how he set it up to work on both system, they switched to straight Gmail.
Here is the scenario.   I have a Groupwise server with admin, staff, and faculty.   In Gmail I have some staff members and students.   The staff members in Gmail are also on the Groupwise server.   The users on Gmail will no longer use Groupwise, but the accounts will still be there for Groupwise members to communicate with.   In the Gmail client, we IMAP the Groupwise server and use a fake pop mail account with the actual pop server name.   This way, Gmail picks up all of the messages for that user and syncs them up.    My problem is getting a round robin DNS structure with the MX records that works correctly.   Previous attempts have had some mail bounced by the Gmail server because I wasn't doing the records correctly.    I would like to see if this round robin structure is likely to succeed or am I going about it wrong.   I've done this on Exchange before but never two totally different servers and different users in the same domain.   Here it is:

 1 ourdomain.s10a1.psmtp.com    (gmail postini spam server)
 1 ourdomain.s10a2.psmtp.com
 5 barracuda.ourdomain.com    (gateway to Groupwise server)
 5 aspmx.l.google.com              (Google mail server)
10 barracuda.ourdomain.com
10 alt1.aspmx.l.google.com
10 alt2.aspmx.l.google.com
15 ourdomain.s10b1.psmtp.com      
20 barracuda.ourdomain.com
20 aspmx2.googlemail.com
25 ourdomain.s10b2.psmtp.com
30 barracuda.ourdomain.com
30 aspmx3.googlemail.com

If I understand Postini correctly, all mail is directed to them first and them I want it to find the appropriate server for delivery.    So a Groupwise users mail goes to Postini, then Postini asks both Gmail server and Groupwise server if the user is valid and always give Groupwise mail to Groupwise (Gmail users can pick up mail from either server) and not bounce the message if Gmail server doesn't have that user.    I appreciate any and all imput.
0
Comment
Question by:fcsdata2
  • 8
  • 3
12 Comments
 
LVL 57

Expert Comment

by:giltjr
Comment Utility
I think you are getting a few terms confused.  Round robin DNS is when you have multiple A records for the same host name pointing to multiple IP addresses.

What you are doing is just setting up multiple MX records.  

How this is designed to work is when a MX query for your domain is done, all MX records are returned.

The SMTP server that is sending the e-mail to you should choose the host name on the MX record with the highest priority, which is the lowest number.  That is 1 is a higher priority than 30.

If it can't get to any of the highest priority hosts, it will then try the next priority, and so on until it has tried all hosts from all MX records.

However, that is how it is designed to work.

For some unusual reason, the MX records are returned in random order, so the 1st time you query you could get them in this order:

    1 ourdomain.s10a2.psmtp.com
    5 barracuda.ourdomain.com
    5 aspmx.l.google.com
    10 barracuda.ourdomain.com

The next time you could get this order:

    10 barracuda.ourdomain.com
     5 barracuda.ourdomain.com
     1 ourdomain.s10a2.psmtp.com
     5 aspmx.l.google.com

What should occure is the querying SMTP server should sort the records in priority.  However some SMTP server just try them in the order they received them.  So in the  second instance, 10 barracuda.ourdomain.com could be tried before 1 ourdomain.s10a2.psmtp.com.  To make it worse, some SMTP server will only try the 1st one in the list and if it works great, if it fails, it stops and retries later on.

So Postini is correct in that e-mail SHOULD be sent to them 1st, but unfortunately in the real world it does not always work that way.
0
 

Author Comment

by:fcsdata2
Comment Utility
There are actually 4 Postini servers.   If I place the 4 Postini servers first, one priority level above the other and then mail servers listing a gmail and a groupwise server in the same priority leve, that won't always work?   Ex.
1 Postini 1
2 Postni 2
3 Postini 3
4 Postini 4
10 barracuda.domain.com
10 gmail1 server
20 barracuda.domain.com
20 gmail2 server
....etc.

Are you saying that what I want to do isn't really possible to pull off reliably using DNS?    The Google method uses email forwarding and that's a huge amount of work plus I would have to add several hundred users into Groupwise and I'm pretty sure we aren't licensed for that many.    We really want students to only exist in Gmail, but Groupwise doesn't use mx records so it would bounce student emails that are sent with the same domain name.    If the faculty that will use Google Apps with Students would have to stop using Groupwise and switch to Gmail, but we are just starting the pilot phase and I don't thank we want to nuke Groupwise for Gmail with everyone.
0
 

Author Comment

by:fcsdata2
Comment Utility
Also, what good  are prioritiy settings if they will just be randomly used?   I want them to be used in order, but you are saying that doesn't really happen.
0
 
LVL 57

Expert Comment

by:giltjr
Comment Utility
Correct, what you want to do can not be reliable done just based on DNS.  

Most SMTP server are written so that they sort the MX records in priority order and use them in priority order.  

There are a few that do not, at least there used to be a few that did not.  

They could have been written by an inexperienced programmer who wanted to take short cuts, somebody that assumed MX records were returned in priority order, or just mis-understood the RFC's involved in writing a SMTP server.

Now, I need to try and wrap my head around why you would need to have anything other than the Postini servers.

The only time a SMTP server should use a MX record other than the highest priority one is if it can't connect to it.

If it connects and gets back a "no such account", the sending SMTP server is supposed to stop trying to send that e-mail.  It does not continue trying all of the other servers.

The only hosts you should have MX records for are the ones that can accept all e-mail that can be sent to you.
0
 

Author Comment

by:fcsdata2
Comment Utility
Postini is a spam and virus filter.   I currently use a Baracuda (hence the name in the mx record) Spam and Virus Firewall.   I would move to Postini but I need to have Postini ask both of my servers for it's list of users and pass it on to the correct server.    I don't think I can tell Postini to do this directly.   Google apps does most things by DNS records.    I have A records for the other services such as groups.domain.com instead of the regular groups.google.com and it points to a private holding of groups, etc.    Maybe I was getting bad advice and that's why all hell broke loose when I tried something similar to this.   My original idea was to set up a subdomain such as students.domain.com and create an mx record that would point the subdomain email to students.domain.com.   That way groupwise could also communicate with students (I think, or would the domain name in the address screw up Groupwise) and those messages get sent to the Postini servers.   After I reviewed what I tried, I saw what was happening.   I was doing round robin with both servers, but Gmail would always bounce the nonexistant e-mail (like it rightfully should).    I'm not sure how I can actually fix this with the pilot users, I may have to wait for summer break and redo the subdomain thing.
     Clarify this for me.   If you have two MX records with the same priority what happens)  Does it ask for a response from both or will it just alternate or randomly ask either server for info?    I've never done anything this complex with DNS MX records, so I'm just wondering.   Load balancing and failover is what I have done before, but never created two records with the same priority.   Thinking about it, would it just create a loop and case loads of DNS traffic?
0
 

Author Comment

by:fcsdata2
Comment Utility
I may have been given completely wrong information from the guy who told me how he made this work.   I checked what he does now and he only has the 4 postini servers.   Will a local email server like Groupwise be confused with an alias domain like @st.domain.com when regular mail is @domain.com or will it go to mx records to find the server for the alias domain?
0
Enabling OSINT in Activity Based Intelligence

Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

 
LVL 70

Accepted Solution

by:
Chris Dent earned 350 total points
Comment Utility
> will it go to mx records to find the server for the alias domain?

It should go and find the MX record. That depends a bit on how Groupwise works, but it's the behaviour I'd expect.

> If you have two MX records with the same priority what happens)  Does it ask for a response from both or will it just
> alternate or randomly ask either server for info?

Alternates, round robin style. A cheap form of load balancing, it's not load aware, but connections are roughly equally distributed between each participating server.

giltjr is, as always, quite correct with this:

> If it connects and gets back a "no such account", the sending SMTP server is supposed to stop trying to send that e-mail.  
> It does not continue trying all of the other servers.

I just felt that needed highlighting because it breaks the design in the original question.

Chris
0
 

Author Comment

by:fcsdata2
Comment Utility
This is starting to explain a lot.    I made the mistake of putting faith in someone I really wasn't fully sure of their technical ability.   We had implemented an MX record change per his suggestion but it wasn't fully working for us.   Students could send to us, but we couldn't send to them.   This would be because the way we set it up pointed to Groupwise first.   Groupwise had the staff member account and pass the mail on.   But the reply would bounce (Groupwise was taking it as a local address producing the NDR).   I expected it to work that way, but he claimed the my records weren't right and round robin would allow the mail through.   Supposedly he did this, but I don't believe it at all now.   I bet they had a lot of problems, Groupwise took the blame and they went strictly with Gmail.
I'll leave this question open for the day and award points tomorrow.   I like the comments and I'm learning from it.   Thanks.
0
 

Author Comment

by:fcsdata2
Comment Utility
I left out, that we were experiencing some odd behaviors and I didn't realize it until comments were made during a brief outage.    Makes a lot of sense now.
0
 
LVL 57

Assisted Solution

by:giltjr
giltjr earned 150 total points
Comment Utility
--> I made the mistake of putting faith in someone I really wasn't fully sure of their technical ability.

Don't be so hard on yourself or this other person.  I have been doing networking in some way shape or form since 1982.  There are thousands of RFC's and unless you write low level code or really do low level networking problem determination you may not always understand things fully.  I don't mean to sound cocky if it comes across this way, but there is still a TON of stuff I don't understand and things that I learn I have mis-understood for years.

It could have been explained to him in a simple way or without full detail.  There are many times over the years were I explained something in the simplest form I could so somebody could get the idea of how it worked.  But it may not have been 100% technically correct  For that situation it did not need to be, because the goal was to understand a concept.

He is 100% right, if you have multiple MX records all with the same priority.  You will get round robin and load will be equally distributed.   If one host is down, most SMTP servers will try the next one.

However, once you start mixing in different priorities, the whole thing changes.  Most companies don't have multiple MX records with different priorities, they have everything as a equal priority.

What amazes me is that any of this stuff really works.  Take some time and read a RFC that describes how SMTP works.  Now imagine a few thousand different people all writing programs independently of each other following the RFC and getting them to talk to each other.   Amazing.  Now just image that everything on the Internet just about was developed this way.  IP stacks, TCP, UDP, telnet, ftp, http, html, pop, imap, ssh, rcp, scp, sftp, tls, and so on and so on.

Its like having millions of people all come with with their own sentence and writing them all down independently of each other and coming up with a book that makes sense to everybody.
0
 

Author Comment

by:fcsdata2
Comment Utility
Thanks for the feedback.   Part of what he told me does work, just not the DNS MX records.   I went back to my single MX record and everything works with Gmail like it did before.   The MX records didn't have anything to do with getting mail to users on the Gmail side, it was IMAP and a fake POP account that do the heavy lifting.    He was doing the MX stuff on a system half our size and it was probably more luck than anything that it didn't fall apart real quickly.   I looked at their MX records today and now he only has 4.   Just the 4 Postini servers, like Google recommends.   Maybe I helped him learn a little from the expierience I was having on a larger network.   It was probably going on there, but not a noticeable.    He has a lot of knowledge, just a little confused on this aspect.   What they have done with Google apps is very impressive.
Thanks again!
0
 

Author Closing Comment

by:fcsdata2
Comment Utility
More of a learning excercise in DNS than anything.
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

I wrote this article to explain some important DNS concepts that should be known to avoid some typical configuration errors I often see in forums. I assume that what is described here is the typical behavior of Microsoft DNS client. I don't know …
BIND is the most widely used Name Server. A Name Server is the one that translates a site name to it's IP address. There is a new bug in BIND (https://kb.isc.org/article/AA-01272), affecting all versions of BIND 9 from BIND 9.1.0 (inclusive) thro…
When you create an app prototype with Adobe XD, you can insert system screens -- sharing or Control Center, for example -- with just a few clicks. This video shows you how. You can take the full course on Experts Exchange at http://bit.ly/XDcourse.
This tutorial demonstrates a quick way of adding group price to multiple Magento products.

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

6 Experts available now in Live!

Get 1:1 Help Now