Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a mail server and web server running on the same IP. Most domains use both servers so their respective DNS records all point to the same spot.

There is one domain that uses my server for web and google servers for mail. The DNS record for this one domain has only the A record point to my server and everything else pointed to google. Over the past 4 days, there have been 6 emails that hit my mail server (and were rejected forwarding) while all others (hundreds) went directly to google with no problems.

Any ideas what is happening here?

share|improve this question

3 Answers 3

It sounds like the MX record for this domain doesn't exist or can't be found. Have you verified that an MX record exists and that a DNS query resolves it correctly?

share|improve this answer
    
MOST emails for this domain are going through just fine. The MX record is there and resolving just fine for all those. Only a small handful of emails are hitting the wrong spot. –  Lee Quarella Feb 24 '11 at 19:18
1  
It's probably a problem on the sending servers then. They may be having problems resolving the MX record. I would suggest testing the MX record for the domain in question using MXToolbox, etc. to make sure there aren't any problems resolving the MX record. –  joeqwerty Feb 24 '11 at 19:20
    
MXtoolbox shows everything resolving fine. –  Lee Quarella Feb 24 '11 at 19:33
    
There's probably not much you can do then. –  joeqwerty Feb 24 '11 at 19:37
    
As described above, I too have seen this behavior from mail servers unable to resolve the MX record, and instead trying to send it to whatever the A record for the domain is as some form of last resort.. –  3molo Feb 24 '11 at 20:48

Were those six emails spam or legit email? Spammers use a variety of tricks including mining DNS records. For example, some spammers will send email to lower priority MX records rather than honoring the higher priority ones. A spammer might be sending emails to A records in the hopes that perhaps, just perhaps, there's an email server running on it that will accept the email or contribute to backscatter spam. If it was spam, then don't worry about it.

If it was not spam, then you'll need to check the possibility that there's a misconfigured DNS server out there that is not refreshing its DNS records. Those 6 emails that were sent to the wrong email server, were they all from the same domain? If so, see if you can find what DNS servers that domain is using (for example, if it was a single company, their corporate DNS servers are likely misconfigured. If it was from a single ISP, see if you can work with that ISP to check their DNS servers that they have their clients use).

EDIT: So those six emails were not all from the same domain. Do all emails from those six domains hit the wrong email server or just some? Perhaps each of those domains' DNS servers are flawed in their configurations. Six domains out of the hundreds or thousands that send email to that customer of yours is still small I suppose. In my opinion, most DNS servers are intentionally misconfigured for "performance" reasons, especially for TTL values. Use dig or nslookup, select that domain's DNS servers to query against (if you can find them; shouldn't be too hard) and then look for the MX records for the domain that received the emails at the wrong email server.

Example: Domain being sent to: LeeQuarellaCustomer.com Domain of one of the emails that was sent to the wrong server: ErrantSender.com DNS Server of the sender: 10.0.0.1

nslookup server 10.0.0.1
set type=mx
LeeQuarellaCustomer.com
share|improve this answer
    
+1. Good point about spammers, Wes. Good to see you. –  joeqwerty Feb 24 '11 at 20:07
    
Thought of both of these instances, the emails are neither spam nor coming from the same domain. –  Lee Quarella Feb 25 '11 at 16:20

just a guess - how many/which Google MX servers did you include in the zone file for that particular/sometimes failing domain? I've played with Google mail too (a year ago) and at that time Google recommended to set about 6 MX servers in the zone file. Today Google asks for 5 MX entries: Google Apps mail servers. It could be that your zone file points to non existent MXs?

Best Regards

share|improve this answer
1  
Seems unlikely to be the problem. If there was one too many MX records pointing to the Google servers (or one too few), that still doesn't explain how email was sent to the wrong non-Google email server. –  Wesley Feb 24 '11 at 20:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.