One of our domains does not receive emails from ntlworld.com addresses.

[icanhazburger]

Hi all, anyone know possible reasons why something like this could happen. If someone on ntlworld emails one of our domains they get a message undeliverable bounce back after 4 days, it says that our domain was unreachable and the computer could be turned off or does not have a mail system running right now.

Our domains mx records are setup ok and any other domains are able to send to us fine.

So is this a problem with NTL?

[Splash]

Do you have SPF records setup for your mailservers?

EDIT - my bad, I misread that you were having issues sending *to* NTL addresses. They're a good idea anyways, but...

Don't suppose you have one of the NDRs handy do you? That way you can check that they're resolving the MXs to the relevant ip addresses. Does http://www.mxtoolbox.com/ give any indicator as to where the problem might lie?

[gss03]

DNS that NTL are using is not correct and causing those timeouts.

[peterb]

Do you have restrictive directives (such as reject NFQD) or reject invlaid host name for any domains, or insist on strict adherence to RFC standards? Could be that NTL's servers aren't sending correct data (although I'd have thought that if that was the case, you would be getting incoming mail bounced from other sources.

What mailserver app are you using? Any clues in the logs?

[Splash]

Just a thought - are you tarpitting? Could be that the NTLWorld mailservers aren't configured to play nicely with tarpits. As peterb says, the logs will help - have you had any connections ntl addresses?

[icanhazburger]

Got this email reply from ntl, does not make much sense to me -

Hello,

It appears there is an issue when we are trying to do a lookup for this domain ...

The problem seems to be that the specified authoritative name servers for the domain (ns1.tssc.org.uk. & ns2.tssc.org.uk.) aren't responding as authoritative for the domain.

> dig soa tssc.org.uk @ns1.tssc.org.uk

; <<>> DiG 8.3 <<>> soa tssc.org.uk @ns1.tssc.org.uk ; Bad server:
ns1.tssc.org.uk -- using default server and timer opts ; (2 servers
found) ;; res options: init recurs defnam dnsrch ;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 5252 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; QUERY SECTION:
;; tssc.org.uk, type = SOA, class = IN

---

It's the same for an NS lookup as well as SOA.

If you dig the MX records directly they do respond normally though.

> dig mx tssc.org.uk @ns1.tssc.org.uk

; <<>> DiG 8.3 <<>> mx tssc.org.uk @ns1.tssc.org.uk ; Bad server:
ns1.tssc.org.uk -- using default server and timer opts ; (2 servers
found) ;; res options: init recurs defnam dnsrch ;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45466 ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 2 ;; QUERY SECTION:
;; tssc.org.uk, type = MX, class = IN

;; ANSWER SECTION:
tssc.org.uk. 43m32s IN MX 2 hermes.hosts.co.uk.
tssc.org.uk. 43m32s IN MX 2 athena.hosts.co.uk.

;; AUTHORITY SECTION:
tssc.org.uk. 1d23h43m32s IN NS ns2.tssc.org.uk.
tssc.org.uk. 1d23h43m32s IN NS ns1.tssc.org.uk.

;; ADDITIONAL SECTION:
hermes.hosts.co.uk. 23h43m32s IN A 85.233.160.21 athena.hosts.co.uk. 23h43m32s IN A 85.233.160.20

---

Ultimately, there's nothing we can do. Our DNS resolvers are working properly and trying to verify the name servers are actually authoritative but as they're not responding as such, the lookup is failing.

Regards,
Postmaster

[Splash]

From my PC at home

; <<>> DiG 8.2 <<>> @ns1.tssc.org.uk tssc.org.uk SOA
; Bad server: ns1.tssc.org.uk -- using default server and timer opts
; (3 servers found)
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 0
;; QUERY SECTION:
;; tssc.org.uk, type = SOA, class = IN

;; ANSWER SECTION:
tssc.org.uk. 52m7s IN SOA ns1.qservicesxtra.co.uk. root.tssc.org.uk. (
9 ; serial
15M ; refresh
10M ; retry
1D ; expiry
1H ) ; minimum


;; AUTHORITY SECTION:
tssc.org.uk. 52m7s IN NS ns1.qservicesxtra.co.uk.
tssc.org.uk. 52m7s IN NS ns2.qservicesxtra.co.uk.

;; Total query time: 1 msec
;; FROM: gp.centergate.com to SERVER: default -- 204.74.68.5
;; WHEN: Tue Apr 14 06:48:55 2009

Now I'm not 100% sure on this, it's a little more in depth than my DNS knowledge goes but it looks to me like the 2 authoritative nameservers for your domain are ns1.qservicesxtra.co.uk and ns2.qservicesxtra.co.uk - as such when a lookup is performed it looks to ns1.tssc.org.uk and ns2.tssc.org.uk, neither of which are authoritative for the domain.

Though I could well be wrong.

EDIT - especially since both ns1 and ns2.tssc.org.uk point to the same ip as ns1.qservicesextra.co.uk. Who looks after DNS for your domain?

[icanhazburger]

From my PC at home



Now I'm not 100% sure on this, it's a little more in depth than my DNS knowledge goes but it looks to me like the 2 authoritative nameservers for your domain are ns1.qservicesxtra.co.uk and ns2.qservicesxtra.co.uk - as such when a lookup is performed it looks to ns1.tssc.org.uk and ns2.tssc.org.uk, neither of which are authoritative for the domain.

Though I could well be wrong.

qservicesxtra.co.uk is setup as its authoritative nameserver based on the instructions from hosts of the dedi server.

The Primary Name Server must be set to match a valid host on this server. The domain of the primary server should match the primary domain of this appliance

The primary domain is qservicesxtra.co.uk

My boss decided to use fasthosts, so I emailed them and they said something along the lines of the email for the tssc domain is hosted by namesco so nothing to do with fast hosts support, despite me saying its a dns issue and could they please help me with it. Just got another reply from them.

Dear Sir,

Thank you for your email.

I can confirm the nameservers are resolving fine.

The issues lies with the person providing you email (Namesco)

Please get back to them in regards to this.

Kind regards

So namesco blame ntl, ntl blame us/fasthosts and fasthosts blame namesco

[Splash]

Do you have proper management of your zonefile, or is it all purely web based?

Can you post your zonefile here or pm a copy to me?

[i4000]

I'll preface this by saying that I am no DNS expert, but the problem looks to be with whoever you have your domain name registered with, I'm a Virgin Media customer so I am able to query from within the Virgin network, here's what I see using NSLOOKUP.

If I check my domain (i4000.net)

NSLOOKUP
> Server 194.168.4.100 (to switch to Virgin's DNS servers)
> Set type=ns (to query a nameserver)
> i4000.net

Non-authoritative answer:
i4000.net nameserver = ns1.webhostingpad.com
i4000.net nameserver = ns2.webhostingpad.com

ns2.webhostingpad.com internet address = 69.65.24.125
ns1.webhostingpad.com internet address = 216.239.135.2

So Virgin Media's DNS servers have said that if I want to know anything about i4000.net then I need to talk to either ns1.webhostingpad.com or ns2.webhostingpad.com and I have the IP address for both.

Now if I do the same for your domain (tssc.org.uk):

NSLOOKUP
> Server 194.168.4.100 (to switch to Virgin's DNS servers)
> Set type=ns (to query a nameserver)
> tssc.org.uk

Non-authoritative answer:
tssc.org.uk nameserver = ns1.qservicesxtra.co.uk
tssc.org.uk nameserver = ns2.qservicesxtra.co.uk

Notice the IP addresses of the name servers are missing, I thought that was a bit strange so I queried for the IP addresses of the nameservers:

NSLOOKUP
> Server 194.168.4.100 (to switch to Virgin's DNS servers)
> ns1.qservicesxtra.co.uk
Server: cache1.service.virginmedia.net
Address: 194.168.4.100

*** cache1.service.virginmedia.net can't find ns1.qservicesxtra.co.uk: Non-existent domain

Same result if I look for ns2.qservicesxtra.co.uk

I've tried a few online NSLOOKUP tools and get the same result (networking.ringofsaturn.com, dig-nslookup.nmonitoring.com).

My best guess is that your email problems are due to the nameservers for your domain not being registered properly. I would suggest that for resolution you should approach whoever you have your domain name registered with (Fasthosts), as you have no direct relationship with Namesco (i.e. that is managed by fasthosts).

[icanhazburger]

Do you have proper management of your zonefile, or is it all purely web based?

Can you post your zonefile here or pm a copy to me?

We have total access to the server, its windows 2003 if that makes a difference. I'll have a look and see what I can find.

pm sent.