Problems with Name Resolution

[mukluk123]

Heres the situation, Im running Exchange 2000, and im having trouble with name resolution for internet emails. This is for a small business so all servers (DNS, exchange, web, etc.) are on the same box. I have DSL with a dynamic IP and im using DynDNS for my internet domain name so its in this form custom.dyndns.net. Everything is set up fine with dyndns but when i send internet emails the SMTP cannot resolve the names. My DNS server was setup after i installed AD and i have one forward lookup zone named local.custom.dyndns.net. I've set the forwarding to my ISP's DNS server and my TCP/IP properties point DNS to my local IP. i can recieve mail fine when it is sent to my user@custom.dyndns.net address but when sending from outlook it just sits for a really long time and eventuall gets an error saying the SMTP timed out while attempting to send the mail. Ive tested both internally and externally and nothing works for outgoing mail. ive even setup my SMTP virtual server to use the same external DNS for delivery and still doesnt work. im forwarding ports 25 to this computer from my firewall. theres also another odd occurance. whenever i NSlookup on this server it attempts to resolve names from within dyndns.com. forexample if i try to lookup

http://www.company.com

it will return the IP of company.dyndns.com if it exists in the dyndns domain. but when done externally it doesnt do this. I assumed setting up the SMTP virtual server to use external DNS of my ISP would correct this but it didnt. Any ideas? I dont know if the ISP's not resolving the name or if my exchange server is not even making a query. i know this is a kind of weird setup but my company has already had this dyndns name and they dont want to change. Thanking you in advance,
Matt

 

[mukluk123]

oh also, after reading this i noticed it wasnt that clear. if the domain (companny.dyndns.com) doesnt exists snlookup does give the correct IP address

 

[robbyb]

Whew. I suppose a main problem is that you are forced to run everything on the same box!

Perhaps we could focus on the 'odd occurance'. I reckon your problem lies there. It's all about DNS, and so we should start sleuthing from there.

You say that when you use NSlookup it suffixes dyndns.com to your lookup. We need to fix this, cause that's not right.
DNS is trying this first (locally) before going off to your ISP's DNS servers.

You can adjust this behaviour with the advanced tcpip settings, on the DNS tab.

See if you can get your box to resolve properly (and maybe check that the Internet is working too).. and you'll likely find that Exchange will start working too!

If not, it's on to episode 2!

Good Luck,


RobbyB

 

[mukluk123]

Ok I rid myself of the "odd occurance" by setting DNS to apply no suffix to the query. so this problem is fixed. But the outgoing mail is still not working. does putting external DNS servers in the delivery settings of the SMTP virtual server override a query to the local DNS or does it first query the local DNS? Is there anyway to tell whats actually going on when i try to send through. For all i know the SMTP server could just not be responding at all. I am fairly new to all this and im doing this as a favor to one of my friends parents so please bear with me.

 

[mukluk123]

ok heres a little snippet of the log file from my SMTP server if this helps anyone

19:33:17 216.196.5.22 EHLO - 250
19:33:17 216.196.5.22 MAIL - 250
19:33:17 216.196.5.22 RCPT - 250
19:35:17 216.196.5.22 TIMEOUT - 121
19:35:17 216.196.5.22 QUIT - 0

notice the timeout. what does this mean? is this a failed DNS query or is it failing to connect to the mail server on the other end. this log is me trying to send through the server from an outside dialup account in outlook

 

[robbyb]

Your logs look like your server is trying to talk to the remote server, OK. The timeout? Could be the remote server has timed out for some reason.

I wonder if your ISP is blocking port 25 for outgoing? This is something that a lot of ISP's are doing, to prevent spamming. If this is the case, you'll need to find a way to redirect to another port on your box.

Try asking your ISP, or perhaps test by trying to telnet to port 25 on another remote server. You'll need the MX record of a domain to find out an IP to telnet to. nslookup can help here, or browse to a web site that lets you peep DNS records...

Episode 3?


RobbyB

 

[mukluk123]

Yes after much investigation I have found that the ISP does block port 25. But they do allow redirection through their SMTP. Which i found out by accident. This seems to make them just as vulnerable to attacks. They dont say anything about it on their website so maybe thats their security method. So I set up an SMTP connector and forwarded through their SMTP and everything works fine. Im just hoping that this isnt somehow against their rules. But I have secured the server so no one but those who authenticate can relay through the server. Well episode 3 is going to have to wait for another rainy day. Thanks for your help,
Matt

 

[Davetoo]

You're ok using your ISP's SMTP server, that's what it's there for. It allows you to "forward" through their SMTP because you're IP is on their network, just like you secured your server to only allow outbound mail from your network. All should be ok.

 

[mukluk123]

Yeah but if spammer were to relay through you with a trojan (which is the popular method nowadays. Ive seen plenty of this with another company I worked for) and tweaked the trojan to send through the victim's ISP's SMTP server that would make them just as vulnerable. But I suppose the only way to prevent this is to disable mail altogether.

The only reason I was worried about this is because on their website it stated that if you have other email addresses you "will not" be allowed to send through their server and not only that but they said their is "no way" to send it using Outlook. They never said anything about using their SMTP server. That's the reason I was worried about it. But if you say it's OK then I'll take your word for it Thanks again for everyone's help,
Matt

 

[robbyb]

Cool!

If your ISP starts acting up in the future about your use of their SMTP server, there are other companies which will, for a couple of $'s a year, allow you to forward through to them on a diff port number.

Robbyb