Bizzarre DNS / message labs issue

[mattley]

I run a domain, DNS is held with Network solutions, MX record points directly at my Exchange server. It all works fine, has done for ages. Office moved a month ago, IP changed, changed MX record, worked fine.

Except, as of last night anyone who sends mail via messagelabs gets this bounce.


I was not able to deliver your message to the following addresses.

<[e-mail]>:

nnn.nnn.nnn.nnn does not like recipient.

Remote host said: 550 5.1.1 User unknown



Fair enough except nnn.nnn.nnn.nnn is not my IP address. I've checked with network solutions and they've confirmed my changes and no other attempts to alter the MX record. dnsreport.com reports correctly, and I've spoken to some of the people getting this failure and using nslookup it appears that their ISP's name servers all resolve to the correct IP.

There is however some history, the domain was originally setup by someone who works at the company that has nnn.nnn.nnn.nnn, but this was about a year ago. I don't suspect malice, but obviously have to exercise extreme caution. Message labs won't talk to me as I'm not a customer, so I find myself very vexed.

Any pointers appreciated as I don't know where to go with this, but urgent resolution is necessary.

TIA, mattley.

[shocker-z]

Sounds as if it's saying there is no mailbox. try a local send to local address and then try remote on with telnet and send a test email via telnet to check you can authenticate and so on.


I've never come across this message myself tho

Regards
Liam

Edited by shocker-z on Tuesday 6th February 22:29

[mattley]

shocker-z said:

Sounds as if it's saying there is no mailbox.

Well normally there woudn't be .

[e-mail] wouldn't normally match a mailbox at [e-mail], what troubles me is that potentially if name matched mail could be delivered to the nnn.nnn.nnn.nnn party.

do you see my problem?

[theboss]

mattley said:

I run a domain, DNS is held with Network solutions, MX record points directly at my Exchange server. It all works fine, has done for ages. Office moved a month ago, IP changed, changed MX record, worked fine.

Except, as of last night anyone who sends mail via messagelabs gets this bounce.


I was not able to deliver your message to the following addresses.

<[e-mail]>:

nnn.nnn.nnn.nnn does not like recipient.

Remote host said: 550 5.1.1 User unknown



Fair enough except nnn.nnn.nnn.nnn is not my IP address. I've checked with network solutions and they've confirmed my changes and no other attempts to alter the MX record. dnsreport.com reports correctly, and I've spoken to some of the people getting this failure and using nslookup it appears that their ISP's name servers all resolve to the correct IP.

There is however some history, the domain was originally setup by someone who works at the company that has nnn.nnn.nnn.nnn, but this was about a year ago. I don't suspect malice, but obviously have to exercise extreme caution. Message labs won't talk to me as I'm not a customer, so I find myself very vexed.

Any pointers appreciated as I don't know where to go with this, but urgent resolution is necessary.

TIA, mattley.

Do you know if MessageLabs was used in the past for your domain? I would ring them, give them your domain and see what they say.

Whether you are still paying for their service or not, it appears as though their servers are still programmed to receive and relay mail for your domain to nnn.nnn.nnn.nnn

Of course most sending mail servers will just resolve your MX record using DNS and the message will be delivered normally, but any MessageLabs customers will relay their outbound mail through MessageLabs, at which point the mail will be forwarded to the hosts that MessageLabs have been configured to relay to, rather than routed by DNS. If that makes sense - I've had a few beers!

[sneakyneil]

Sounds like a messagelabs networking issue if the sender resolves you OK. If one of the failing sites is agreeable how about getting them to send a message to you MX direct rather than via messagelabs, to confirm? And if they're very agreeable get them to complain about it for you

[theboss]

I just noticed you said MessageLabs won't talk to you as you're not a customer.

Therefore in order to prove whether or not they are acting as authoritative hosts for your domain, open up an SMTP session on one of their servers (e.g. telnet cluster3.eu.messagelabs.com on port 25) and try sending a message to your domain. If it's accepted then you know they are receiving for your domain (and you'll get the same NDR a few minutes later) or if it's rejected with a 550 5.7.1 relay error then you know they aren't configured to accept mail for you.

If the former, ring them up and have a go at them, if the latter then it's anybody's guess, you might need to talk to the people who have been receiving the error and see if they're doing anything unusual.

[mattley]

sneakyneil said:

Sounds like a messagelabs networking issue if the sender resolves you OK. If one of the failing sites is agreeable how about getting them to send a message to you MX direct rather than via messagelabs, to confirm? And if they're very agreeable get them to complain about it for you

Thanks for that, got a friend on that case, but no reponse yet.

[mattley]

theboss said:

I just noticed you said MessageLabs won't talk to you as you're not a customer.

Therefore in order to prove whether or not they are acting as authoritative hosts for your domain,

How could they be? is there anything I'm missing?

theboss said:

open up an SMTP session on one of their servers (e.g. telnet cluster3.eu.messagelabs.com on port 25) and try sending a message to your domain. If it's accepted then you know they are receiving for your domain (and you'll get the same NDR a few minutes later) or if it's rejected with a 550 5.7.1 relay error then you know they aren't configured to accept mail for you.

Sorry, I don't know how to send a message through telnet, and even if I did I can't imagine they;d let me as I'm not a customer, though that kinda makes sense I need a little more help. thanks anyway.

[theboss]

mattley said:

theboss said:

I just noticed you said MessageLabs won't talk to you as you're not a customer.

Therefore in order to prove whether or not they are acting as authoritative hosts for your domain,

How could they be? is there anything I'm missing?

theboss said:

open up an SMTP session on one of their servers (e.g. telnet cluster3.eu.messagelabs.com on port 25) and try sending a message to your domain. If it's accepted then you know they are receiving for your domain (and you'll get the same NDR a few minutes later) or if it's rejected with a 550 5.7.1 relay error then you know they aren't configured to accept mail for you.

Sorry, I don't know how to send a message through telnet, and even if I did I can't imagine they;d let me as I'm not a customer, though that kinda makes sense I need a little more help. thanks anyway.

I'm not insisting that you *are* one of their customers, I'm just saying that for whatever reason it appears that their systems are configured to receive mail for your domain. That could be because your domain was configured to use Messagelabs at some point in the past.

As I said - a simple test would be to see if they are receiving mail for your domain. If you want to then send me an email with your domain name and I'll test it for you.

[BliarOut]

nslookup
> set type=ns
> messagelabs.com
Server: ns.murphx.net
Address: 62.69.62.6

Non-authoritative answer:
messagelabs.com nameserver = dns4.messagelabs.com
messagelabs.com nameserver = dns5.messagelabs.com
messagelabs.com nameserver = dns1.messagelabs.com
messagelabs.com nameserver = dns2.messagelabs.com
messagelabs.com nameserver = dns3.messagelabs.com

dns1.messagelabs.com internet address = 194.106.221.36
dns2.messagelabs.com internet address = 85.158.137.227
dns3.messagelabs.com internet address = 195.245.231.121
dns4.messagelabs.com internet address = 216.82.243.195
dns5.messagelabs.com internet address = 216.82.247.227
>


Run some MX queries against the messagelabs servers listed above and see if they're correct for your domain.

[mattley]

BliarOut said:

nslookup
> set type=ns
> messagelabs.com
Server: ns.murphx.net
Address: 62.69.62.6

Non-authoritative answer:
messagelabs.com nameserver = dns4.messagelabs.com
messagelabs.com nameserver = dns5.messagelabs.com
messagelabs.com nameserver = dns1.messagelabs.com
messagelabs.com nameserver = dns2.messagelabs.com
messagelabs.com nameserver = dns3.messagelabs.com

dns1.messagelabs.com internet address = 194.106.221.36
dns2.messagelabs.com internet address = 85.158.137.227
dns3.messagelabs.com internet address = 195.245.231.121
dns4.messagelabs.com internet address = 216.82.243.195
dns5.messagelabs.com internet address = 216.82.247.227
>


Run some MX queries against the messagelabs servers listed above and see if they're correct for your domain.

Hmm we may be getting some where, they return a load of 192. addresses. all from the .gltd.

this seems very wrong :?

Edited by mattley on Wednesday 7th February 00:22

[mattley]

theboss said:

I'm not insisting that you *are* one of their customers, I'm just saying that for whatever reason it appears that their systems are configured to receive mail for your domain. That could be because your domain was configured to use Messagelabs at some point in the past.

Not ever, I've never used messagelabs.

theboss said:

As I said - a simple test would be to see if they are receiving mail for your domain. If you want to then send me an email with your domain name and I'll test it for you.

your idea of simple and mine are a world appart at this level. I really appreciate your offer and will take you up on it later if this isn't resolved. I can see what you you mean, but I don't know how to send a mail using telnet. I can connect and quit, but that's about it.

[BliarOut]

http://support.microsoft.com/kb/15311

Tells you how to test using telnet. Start about half way down where it says basic testing.


However if Messagelabs DNS servers have incorrect MX records for you it'll never work.