Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

To make a long story short, some users at another company who I have a lot of email correspondence with started having problems sending me email, they would get a message from the mailer daemon at MessageLab (which hosts their email) that Delivery is delayed to these recipients or distribution lists:, etc. etc. Since the message was coming from their server and nobody else was having a problem sending me mail, I figured the problem must be on their end, but just to be sure I checked with Rackspace (who hosts our email). Sure enough, none of the affected emails had hit our server at any point, which isn't surprising at all because none of them ever actually left their server[s] at MessageLab as it turns out. According to what MessageLab is telling them, UltraDNS handles Rackspace's DNS and UltraDNS has blacklisted some of MessageLabs's IPs, with the end result that their server is unable to do a DNS lookup for our MX, which is why the mail is not getting sent, much less delivered.

My question is does this make any sense? My knowledge of the workings of DNS is high-level at best, but it seems unlikely that a) there would be a blacklist on doing DNS lookups,or b) that even if the authoritative nameserver did have such a blacklist that it would come into play all that much due to the distributed nature of DNS. I realize of course that there are blacklists of IPs used to filter spam and the like, but my understanding is that that's something that the server receiving email would use to do a lookup of the sender's IP, not something that would affect the originating server's ability to query the DNS system. But maybe I'm wrong?

Edit: In case it helps, here's an example of the message log that shows the failure; this is what was sent to me from the tech person at the other company -- I think it's the output from an admin panel, but I don't really have any more info than what's below:

2013-01-23 06:13:25   Connection from: xxx.xxx.x.xxx
2013-01-23 06:13:25   Sending server HELO string: xxxxxxxxxx.xxxxxxx.com
2013-01-23 06:13:25   Message id:
2013-01-23 06:13:25   Message reference: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
2013-01-23 06:13:25   Sender: xxxxx@xxxxxx.com
2013-01-23 06:13:25   Recipient: xxxxxx@xxxxxx.com
2013-01-23 06:13:26   SMTP Status: OK
2013-01-23 06:13:27   Delivery attempt #1
2013-01-23 06:13:27   Recipient server: 0.0.0.0
2013-01-23 06:13:27   Response: 421 4.4.0 [internal] no MXs for this domain could be reached at this time
2013-01-23 06:19:57   Delivery attempt #2 (final)
2013-01-23 06:19:57   Recipient server: 0.0.0.0
2013-01-23 06:19:57   Response: 421 4.4.0 [internal] no MXs for this domain could be reached at this time

I've replaced all of the identifying bits obviously, but just to make it clear, the bit about Recipient server: 0.0.0.0 is what's actually in the log.

share|improve this question
    
If you can provide a complete bounce message, perhaps we can actually verify this story. –  Michael Hampton Jan 25 '13 at 3:29
    
I can post an example of the message log they sent me, I'll add it. –  ultranaut Jan 25 '13 at 3:32

2 Answers 2

up vote 1 down vote accepted

Yes, it is possible to blacklist IPs for probing DNS. Imagine a scenario where an abusive user probes the DNS server million times a second (just figurative number). It would certainly cause a strain. Such are reasons for blacklisting IPs for DNS inqueries.

Ironically, this is a bit of a self-fulling scenario. You make a request because there is no entry in the cache. Then it denies the request and thus saves nothing in the request. Then you repeat the situation ending up making countless requests.

I (or we) cannot conclude how MessageLabs would have structured their DNS resolution. However, if they set it so that they are the last fetcher from UltraDNS for your MX records, this scenario can indeed occur.

The only resolution is to either 1) un-blacklist their IPs by ultradns. or 2) they use a different DNS system one way or another. or 3) make hard links for dns by attaching IP to hostname in the hosts file for the sender.

share|improve this answer
    
Yeah, I could imagine that scenario arising, and obviously it could be done, but is it something that actually is done that you're aware of? I'm not disputing what you're saying, just asking if you know whether it's an actual practice. –  ultranaut Jan 25 '13 at 20:57
    
(D)DoS attacks on DNS systems aren't rare. As such, I would suspect it to be a common implementation. Though, I wouldn't try to figure it out... since it is a form of attack. –  Grumpy Jan 26 '13 at 16:57
    
Sounds like it makes sense, thanks @Grumpy. –  ultranaut Jan 26 '13 at 22:08

A lot of times over the course of a week, IP's that are blacklisted fall off, if the abuse stops. I always scan blacklists of all the IP's involved in sending an email, My Ip, the MX Ip's etc. We'll I don't actually scan, I just set up alerts that do the work for and will notify me from one of those online monitoring places.

The only issue is, the places that maintain those private blacklist, you won't get notified about. I cleared IP issues up for myhosting company to, because most will block the full C range.

share|improve this answer
    
This isn't an answer to the question. –  Sven Jan 25 '13 at 16:29
    
Are you talking about the run-of-the-mill spam blacklists that the recipient checks against? –  ultranaut Jan 25 '13 at 21:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.