Exchange server sends mail fine right after a reboot

[NetworkDOC]

Once I reboot the exchange server mail flows great. After a while though (a few days sometimes) it stops. I rebot and all mail flows fine. It only hangs on a few domains too.

I did the correction to fix the EDNS 0 issue. That allowed mail to flow out to hotmail/yahoo users fine. This is a hmmmmmmmmm Problem...

Any thoughts?

 

[mariov]

mstarrett

As per gfi post it says that even a reboot will not fix the issue when it does for us .

I will look into the GFi issue a bit more and GFi has reported that we are up to date with the patches

But I still there is another issue somewher

Regards,

Mario

 

[tedgoat]

I agree, there must be something else. I don't use GFI, and am experiencing the problem...

 

[MoobyCow]

I think this could be a problem with the firewall.

Sometimes Exchange has difficulty interpreting the error message sent by the firewall when it can not connect to the mail server indicated by the primary MX record. What happens is that Exchange just keeps trying to send mail to the IP indicated by the primary MX and never switches to the secondary MX record.

I had this with a Watchguard firewall, and it was consitent for the domain, but not consitent in that not every domain that had a primary MX that could not be contacted caused a problem. I have never heard a good explanation ofr why this would be.

Anyway, there are a couple of ways to work around this. You can take off SMTP relaying at the firewall and set up a policy to let the Exchange server send out it's own mail through the firewall. (This can cause a future problem as your sending IP will now be different than your receiving, which can cause companies to this you're sending spam).

You can also hard code the primary and secondary DNS entires in your DNS, either at the firewall or internally. This sucks, as it's a nightmare to keep up with.

I was lucky in that it was limited to a small number of domains. Also, when I upgraded to 2003 it fixed itself, but the 2000 Exchange server could not be fixed.

Supposedly this problem was fixed in Exchange 5.5, but it keeps popping up on different threads across all versions of Exchange.

Here's another example:

http://www.experts-exchange.com/Operating_Systems/Windows_Server_2003/Q_21322770.html#13365131

 

[mariov]

If it was a IIS issue then a restart of IIS would fix it but it doesnt.(not sure yet)

It is not a pix issue as it is the server that we reboot and not the pix.

It is not GFi as you are all experiencing the same issue and you do not have GFi.

It cant be a NIC as it is happening to both my SMTP servers and what are the chances of both NIC been faulty

Reboot fixes the issue so that points to an OS issue. All latest patches installed.

I did a virus scan on the servers as well and no viruses.

Sorry guys i am talking to myself here. ...

Regards,

Desperate Mario

 

[PScottC]

Something about this issue strikes me as a DNS caching issue. Servers and WSs keep a local name resolver cache. Consider reducing the TTL on the cache. Check this link for the related registry keys.

PSC

 

[mariov]

But why would that cause SMTP to stop processing emails? DNS was my number one suspect as well due to all the SMTP warnings (4000,4006) i receive on the event viewer.

Still looking

 

[NetworkGuy101]

Just curious, If you have your own DNS Servers why are you pointing your SMTP connector to an external server?

 

[NetworkDOC]

OK Folks... Here is the skinny. It is fixed....

First of all to answer a few questions above...

Yes we were using internal DNS and then having them forward to external DNS server. There is an issue with EDNS and using windows 2003 DNS. One of the resolutions is to use an external DNS server(s) on the smtp connector.

ANYWAY...

The answer was.......

The server had/has a antivirus client (symantec 9.1)that had an option to check outgoing mail. I unchecked that restarted the Antivirus service. BAM... Done deal....

Mail has been flowing for about 4 days with no burps at all.....

Hope this helps someone else....

 

[tedgoat]

NetworkDOC -

I'm glad this seemed to help! I, too, am using symantec 9.1, and that setting is already turned off at my site. I am still seeing the problem. Let us know if your problem comes back (hopefully not).

 

[mariov]

tedgoat

I am not even using Symantec and i am still seeing this occur.
There must be something else wrong.

Regards,

Mario

 

[Chambers]

Don't use external DNS addresses. Just make sure the NIC's DNS is set up correctly, never set up DNS in Exchange. I have seen this happenning because of just that!

Also, what were you thinking putting AV Client on Exchange? You NEED to use SAV Server edition for that pupose, or Symantec Mail Security. Putting just a client on a Server is a big no no

 

[ISAuser]

Having same problem using 2003 server standard, no cisco firewall. External DNS. If I change the ip address of nic, email will start flowing again. But after a hour or so, all stops. If I change IP again to same or other, then everything back to normal. Cannot browse internet via IE when this occurs. nslookup works fine when the error occurs. Can resolve using nslookup. Cannot telnet xxxx 25 when this error occurs. Using plain old IIS smtp virtual server for outbound email. The antivirus program is NOT the problem. This looks like the problem has not been resolved for any of the above posts? Need help.

 

[MoobyCow]

This thread might help.

http://forums.msexchange.org/ultimatebb.cgi?ubb=get_topic;f=18;t=000384;p=

It seems there are many different problems with the same symptoms. Adding a new SMTP connector that sent a HELO instead of EHLO command is what worked for me.

 

[NetworkDOC]

The Server does have the Symantec mail client on it. I pushed the client from the console. I guess that is what I ended up with.

It is still all flowing beautimously.

I would suggest to those with a similar problem, to peruse this post, there were many helpful solutions. One is all it may take to get yours working....

 

[NetworkGuy101]

ISAuser:

Sounds like a gateway issue or routing issue. Do you have a firewall? Are you translating a static for you address? You can do a NSlookup. That proves that whatever machine you are connected to for the lookup is abloe to get out fine. Are you using internal DNS? If you cant browse the web, have you tried pinging out? Like

http://www.google.com.

or a trace route.