Exchange 2010 Mail delayed to specific domains

popeyedcts
popeyedcts used Ask the Experts™
on
We have an on premises Exchange 2010 server running on Windows Server 2008 r2 that recently changed IP address (ISP change).  We updated the MX records, and mail flows properly to most domains.  However Some domains (most notably Gmail.com) return various delay errors.

Gmail.com returns the error: 451 4.4.0 DNS Query failed
Other servers return the error: 451 4.4.0 Primary Target IP responded with: "421 4.2.1 unable to connect." Attempted failover to alternate host, but did not succeed. Either there are no alternate hosts, or delivery failed to all alternate hosts.

We can work around the issue by creating a custom send connector for the domain, and manually entering the domain's mail servers in the network tab.

As far as we can tell, we are not on any blacklists.
SMTPDiag comes back clean.
Microsoft's Remote Connectivity Analyzer comes back clean.
MXToolbox's SMTP test returns a warning about transaction time, and this error: SMTP Banner Check: Reverse DNS does not match SMTP Banner
The Send Connector and Hub Transport are configured to use external DNS servers (Cloudflare and Google).
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
David FavorFractional CTO
Distinguished Expert 2018

Commented:
Message is clear.

At the point in time of delivery the target recipient's IPs (all MX records) are glitching out.

If you own the DNS for this system, likely best to move DNS records to stable DNS.

If you don't own DNS for this system, nothing you can do...

Where this system refers to the chain of MX IPs returned for host/domain in recipient's email address where problem is occurring.

DNS problems are super easy to fix, if you use a tool like dig + start test DNS end to end.
timgreen7077Exchange Engineer
Distinguished Expert 2018

Commented:
I would suggest removing the DNS settings from the External DNS settings. I would leave it set to "all network adapters" which is the default.

Author

Commented:
David,
Thank you we will look into dig +

Tim,
When the problem originally appeared the server was configured to use internal DNS for all lookups. However as part of our troubleshooting we configured the Send Connector and Hub Transport Server to use external DNS for external lookups.  The problem appears to exist regardless of what DNS servers we use.
Ensure you’re charging the right price for your IT

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Exchange Engineer
Distinguished Expert 2018
Commented:
you can try to use your ISP for DNS resolution instead of the ones you are currently using.
David FavorFractional CTO
Distinguished Expert 2018

Commented:
So here's how to use dig in your situation.

First dig out the ns records + then hammer a DNS A record lookup to every NS record every 1 second.

All returned A records should be the same + there should never be any errors.

And likely Tim's suggestion of getting rid of internal DNS lookups may solve your problem.

Author

Commented:
Switching to the ISP's DNS fixed the gmail issue.

The other error appears to be the result of a user mistyping an email address and sending to a parked domain.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial