First, a sordid story: My DNS server, for historical reasons, uses the Plesk Control Panel. I plan on migrating all of that server's duties to a new Windows server, without Plesk, so I told Plesk to switch from using Bind DNS to Windows DNS to ease the transition. There was a brief DNS service interruption, as Plesk seemed to hang after copying over the DNS records and disabling Bind, but before enabling MS DNS. That was easy to fix using services.msc, though Plesk is still horribly confused. That's okay; only the Windows DNS service is running and it has all the right settings, so Plesk can die in a fire.
Here's where my trouble began. Shortly after getting my DNS server running again, my MX records started working again from every server I could test on (MX Toolbox, for example). Still, email addresses on my domain couldn't send email to each other. Most external inbound and outbound mail was going through, but email@example.com couldn't email firstname.lastname@example.org. Specifically, the error message was:
Google tried to deliver your message, but it was rejected by the recipient domain. We recommend contacting the other email provider for further information about the cause of this error. The error that the other server returned was: 550 550 MX records inaccessible for too long for domain:mydomain.com - psmtp (state 14).
We use Google Apps Premier with Postini. We contacted Postini support, and it turns out that their "System 9" could not retrieve our MX records, and we happen to run on System 9. That means that anyone using Postini System 9 as their outbound gateway can't send us email. And the kicker: their System 8 can get our MX records, and when using that as our outbound gateway, internal mail is delivered properly. The Postini technician indicated the the problem was most likely on our end, not theirs.
Finally, the question: What could cause my server to refuse to serve DNS requests to one IP range but not another, and somewhat spontaneously, at that? No software firewall is enabled, and the hardware firewall "is configured to allow DNS from any source," according to our host company, SoftLayer.
The problem seems to have resolved itself as of this morning. I switched back to Postini's outbound gateway for some testing, and all is well so far. Still, I'd like to know what might have gone wrong. Any theories/wild guesses/clairvoyant divination?