Internal mail sent to wron IP address for domain

[coolemail]

We have a domain on our server which was hosted by us but at present is hosted elsewhere. When we send emails to that domain, our mail server sends them to the wrong place. About one month ago, they changed their MX records and it is since then that the problem occurs.

Code: Select all

dig mx domain.co.uk

from our server produces the correct MX records.

On Plesk we have been trying both DNS service off (with only the remote name servers showing) and also with the DNS service on showing all the correct details for name servers and MX records. When we send any emails, the maillog shows them going to the IP address of the old MX provider (which was mailcontroller - also remote)

It is as if there is some cache on the server storing what the MX records were.

Can someone help to tell us where we can pinpoint what is causing this and how we can resolve it? I wish to leave the domain on Plesk primarily as the hosting of it may come back after some external work being carried out.

[coolemail]

Can anyone help on this? This forum normally attracts help in a very short timeframe from helpful and experienced experts!

I've not yet flushed the DNS cache, but could this possibly help at all - not sure it would as the dig from the server produces the correct records? I found instructions on how to do that.

To flush the DNS cache in Linux, restart the nscd daemon:-
- To restart the nscd daemon, type

Code: Select all

/etc/rc.d/init.d/nscd restart

in your terminal
- Once you run the command your linux DNS cache will flush.

We have
OS Linux 2.6.32.43-6.art.x86_64
Plesk Panel version 10.4.4 Update #44

[faris]

wild guess: the mx records point to an A record (or CNAME).

Could it be that it is the A record (or CNAME) that's wrong?

Have you tried pinging the mx record to see where it really goes?

You can also change the IPs in resolv.conf to remove local IPs to make sure it uses an external dns server.

[coolemail]

Thank you for your help faris,

nslookup reports correctly:

[root@plesk3 ~]# nslookup domain.co.uk
Server: 127.0.0.1
Address: 127.0.0.1#53

Name: domain.co.uk
Address: 83.223.124.13

[root@plesk3 ~]# nslookup mx1.mail-domain.co.uk
Server: 127.0.0.1
Address: 127.0.0.1#53

Non-authoritative answer:
Name: mx1.mail-domain.co.uk
Address: 83.246.65.113
Name: mx1.mail-domain.co.uk
Address: 83.246.65.114
Name: mx1.mail-domain.co.uk
Address: 83.246.65.111
Name: mx1.mail-domain.co.uk
Address: 83.246.65.112

A ping of the mx1.mail-domain.co.uk from our server also goes to the right place strangely!

resolv.conf has only one entry:

nameserver 127.0.0.1

Are you suggesting that I remove that one line altogether? Do I need to restart any services to let it take effect?
And can resolv.conf have lots of lines with lots of different external DNS servers in the same format as 127.0.0.1?

EDIT. I got the following this morning if that has any bearing??:

From: Cron Daemon [mailto:root@hostname]
Sent: 17 October 2012 06:07
To: root@hostname
Subject: Cron <root@plesk3> /usr/share/spamassassin/sa-update.cron 2>&1 | tee -a /var/log/sa-update.log

Subroutine Net::DNS::Resolver::Base::AF_INET6 redefined at /usr/lib/perl5/5.8.8/Exporter.pm line 65.
at /usr/lib64/perl5/vendor_perl/5.8.8/x86_64-linux-thread-multi/Net/DNS/Resolver/Base.pm line 66

[faris]

I wouldn't remove localhost from resolv.conf, no. But anyway, all that output is nicely showing us that your dns is 100% fine and all is well as far as I can tell, so you don't have stale records or whatever.

So....what else would cause an email to be delivered somewhere else?

Have you made any changes to smtproutes for example? I can't see how that would affect outgoing email that's not first come in from an external source, but maybe it does. I'm only suggesting it in case at one point you set up store and forward to a particular IP external for that domain and did so via smtproutes.

The spamassassin error - not seen that one before. Don't know what to suggest

[coolemail]

Thank you so much faris,
You identified what is happening:
I had entries in morercpthosts and smtproutes for that domain from an issue before which you helped us with at http://www.atomicorp.com/forums/viewtop ... s&start=15 and especially your post at Mon May 18, 2009.
Removed that and it is no longer confused!
THANK YOU, as ever, very much indeed.

[faris]

woohoo! Glad to help

[coolemail]

Could this be linked? I had a domain which we set up on Plesk initially as http://www.TESTdomain.co.uk.
It used to cause problems with some website things so today I deleted it and set it up on our server from scratch as testdomain.co.uk. The mail goes externally with MX records pointing to the external domain mail settings.

Tested sending an email and got an "Undeliverable":

Your message did not reach some or all of the intended recipients.
Subject: test only
Sent: 21/11/2012 12:56
The following recipient(s) cannot be reached:

'user@testdomain.co.uk' on 21/11/2012 12:56
Server error: '550 sorry, no mailbox here by that name. (#5.7.17)
'

The domain appears in rcpthosts. There is nothing in morercpthosts or in smtproutes

The name servers are waiting promulgation, but if we send an email from a hosted domain, surely it should use the settings on our domain, so why is it not obeying the MX rules?

[root@plesk3 ~]# dig mx testdomain.co.uk

; <<>> DiG 9.3.6-P1-RedHat-9.3.6-20.P1.el5_8.5 <<>> mx testdomain.co.uk
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21967
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 4, ADDITIONAL: 18

;; QUESTION SECTION:
;testdomain.co.uk. IN MX

;; ANSWER SECTION:
testdomain.co.uk. 86400 IN MX 20 mx2.external-domain.co.uk.
testdomain.co.uk. 86400 IN MX 30 mx3.external-domain.co.uk.
testdomain.co.uk. 86400 IN MX 40 mx4.external-domain.co.uk.
testdomain.co.uk. 86400 IN MX 10 mx1.external-domain.co.uk.

Any clues, friendly, helpful gurus? Many thanks, as ever, in advance.

[faris]

If mail is switched on for the (web) hosted domain, messages will be delivered locally no matter what the MX records say.

You don't want the domain to appear in rcpthosts on the (web) hosting server - that's saying "email is hosted here" basically.

[coolemail]

THANK YOU faris,

I thought that having external MX was sufficient. But I've just switched off the mail and it is now working. Many thanks for the clarification.

[coolemail]

Am I right in saying that mail to external MX destinations will not show up on our maillog (unless of course an email is sent from an email address hosted by us when it does correctly show as sending "to remote")?

[faris]

Yup.

External mailservers will do an MX lookup (using your server is it is a DNS server and they use that one rather than the seconday). They will then send the mail to the IP of the A record specified by the MX record, and it won't go anywhere near your server.

Note that if the website, which is hosted on your server, has a form-to-email script then you'll see outgoing mail from localhost sent to the remote mailserver (in addition to any mail sent from other users on your server to that remote mailserver).