Need to verify my MX records are correct 1

[pgaliardo]

I have a feeling our MX records are not totally set up correctly and I wanted some input from the experts. Here is our setup:

Exchange Server 2000 - name is EX2
Symantec Mail Security Appliance - Name: Mail8240
Cisco Router NATS public ip address used for mail to the Mail8240 appliance.

So when we receive mail, it first hits the appliance and if the mail is spam free, it is forwarded to our Exchange Server. However, outgoing mail goes directly from Exchange to the outside world. I changed this at one point on the advice of Symantec because a version upgrade had a problem sending outgoing mail.

First question: When I registered the MX record with our ISP, I gave the the name of the Exchange Server - EX2. This is associated with the public IP address. Is this correct, or should the DNS name be Mail8240? When I do a test with DNSStuff, I get the following warning:

WARNING: One or more of your mailservers is claiming to be a host other than what it really is (the SMTP greeting should be a 3-digit code, followed by a space or a dash, then the host name). If your mailserver sends out E-mail using this domain in its EHLO or HELO, your E-mail might get blocked by anti-spam software. This is also a technical violation of RFC821 4.3 (and RFC2821 4.3.1). Note that the hostname given in the SMTP greeting should have an A record pointing back to the same server. Note that this one test may use a cached DNS record.

ex2.corp.<domain_name>.com claims to be non-existent host mail8240.corp.<domain_name>.com:
220 mail8240.corp.<domain_name>.com ESMTP Symantec Mail Security

This concerns me. Also note that the server name is being resolved to the internal domain name with the CORP prefix. I have a feeling this is not correct. If it isn't, how do I correct that?

We are not really having problems sending or receiving e-mail, but lately we are getting 4.4.7 messages back from one particular domain. That error seems to be a server timeout on the receiving end, but I'm wondering if any of the above concerns have anything to do with it.

If anyone has advice or can point to a really in depth document on the correct configurations on an Exchange Server, I would really appreciate it.

Thanks.

 

[Zelandakh]

Set up one MX record, priority 10 that is the public IP of the Cisco that is for inbound.
Set up one MX record, priority 20 that is the public IP of the Exchange server that is essentially outbound. Set the Exchange server up to receive email.

Then set up an SPF record for your domain based on the 2 above and have your Symantec appliance do SPF checking.

That should do more than you need.

 

[pgaliardo]

You come through as always Zelandakh. Just to clarify, this all needs to be set up by the ISP so that the external DNS servers have this info, correct? Is there anything that needs to be done on my internal Active Directory Integrated DNS server? Thanks again.

 

[Zelandakh]

ISP? Correct.
On your DNS, if your appliance uses internal DNS in its network config (i.e. directly below the IP address) then yes you need to put the external IP of the 2 mail servers and an SPF tag to match.

Other than that, I can't think of anything and it is not too disimilar to how I have corp configured.