Email relaying and DNS MX records

[aobrien5]

I think this is a more DNS than Email/Exchange question, so I'll post it here.


I'm transitioning to Exchange 2007 and want to clean up some bad DNS records that we've been required to have to avoid being placed on spam lists. We have a couple application servers that relay email to the Internet through our Exchange server (one anonymously, one with authentication).

To allow the anonymous relaying, we have to have a second receive connector configured (with a separate IP address) on our Exchange server that only allows connections from our application servers. Because we're not using an Edge Transport Server, we can't bind our Send Connector to a specific IP address. Therefore, we have to allow both IP addresses to send email to the Internet, and configure them both in DNS with MX records, otherwise, servers that do reverse MX lookups would mark email coming from the relaying IP address as spam and put us on a black hole list (this has happened previously).

Now, MX records are for servers that can RECEIVE email, and obviously, our relaying connector will deny any connections attempted from the Internet. The same goes for our Application server that has to be listed as an MX as well, because the message headers contain that server name and will fail the same reverse MX lookup otherwise. So, everything works properly when configured this way, but 2 of our MX records are actually invalid and will fail any DNS tests done on them.

Any advice that could be offered to help clean this up would be very much appreciated.

Thank you.

 

[elgrandeperro]

I've intentionally put unreachable hosts in my MX records, as long as the precedence is setup correctly you will only see a small delay for mail reception. You want the "failing" ones at a lower numerical MX precedence.

If you got the application servers to send direct, that removes the need for the bad MX records, correct? Easily done in Unix (don't know your situation)

 

[aobrien5]

We're a full on M$ shop here. I do have the app servers listed with a lower priority in my MX records, so mail delivery is fine, as far as I can tell.

I'm glad to hear we're not the only ones who have bogus MX records. I may be able to configure one of the App servers to accept NDRs, though we'll have to decide if we want to or not.

The other Address for our anonymous relay is the one I would most like to get rid of, but I think that's more of an Exchange/Windows Server question than a DNS one. The problem there is that the Exchange 2007 Hub Transport Server ignores the setting for Sending IP Address and relies on the Windows Routing Table instead.

 

[elgrandeperro]

I worked at a place that had the same problem integrating exchange. We had to allow the anonymous inbound because there was no way for other apps to send authentication data, but we limited it by forcing through a Unix box so we could log and restrict the traffic both to the unix box and to the inbound anonymous IP (I believe my networking guys setup cisco access lists for the inbound restrictions.)