Educause Security Discussion mailing list archives

Re: Mysterious Email Problems


From: Theresa M Rowe <rowe () OAKLAND EDU>
Date: Fri, 12 Sep 2003 20:51:04 -0400

Wow, I thought we were alone.  We have some cases where the
mail doesn't deliver from some locations, and in some cases
it comes days late.  We've tried working this out with our
vendor and the organizations involved.

Technically we believe the problem is as follows:  The MX
record of the destination domain is not present in the
default DNS query, therefore, our mail server does not see a
legitimate destination mail system and causes the failure
reported.  In some cases the primary entry isn't processed
because it is not "valid" but several days later a secondary
entry will work.  We've been exploring the following items:
(1)  When we moved from BIND to Windows DNS in December of
2002, did the "query mechanism" change?  (2)  Are the
differences between the registration records for the sites
that work and the sites that don't work significant to the
problem we are experiencing - but that doesn't pan out.  We
note here that several of the places with email disruption
are medical facilities - hospitals in particular.  Are they
doing something different?

Theresa Rowe

---- Original message ----
Date: Fri, 12 Sep 2003 16:29:32 -0700
From: gmalone <gmalone () PCC EDU>
Subject: [SECURITY] Mysterious Email Problems
To: SECURITY () LISTSERV EDUCAUSE EDU

Hello Group,

Over the last two or three months, Portland Community
College (PCC) has had
mysterious email problems related to receiving incoming
email messages.  A
college or vendor will send an email message to an
individual at PCC and
sometimes it will go through and sometimes it won't.  We
have worked with
two vendors and two universities to try and determine the
root cause of the
problems.  It appears that when the sending email server
sends a reverse
look-up for our domain it can find it sometimes and other
times it
can't.  We have checked and rechecked our external DNS
records.  We have
even had IT staff at the sending institution perform DNS
look-ups at the
same time a message is sent.   We have found cases where the
DNS look-up
will work but the email will be rejected because our domain
is
unknown.   I've been told that both of the universities we
are working with
have similar intermittent problems.

We have heard and discussed several theories such as the
Spam software may
be casing the problem, or the need for a second
authoritative DNS server
out side PCC, and even the possibility that the virus
problem may be
causing this by flooding segments of the Internet
periodically.  I'll admit
that this is not my area of expertise and all these worms
and viruses have
caused us all to second guess our fundamental strategies.  I
like to find
out if this is an issue unique to PCC so I can decide what
actions to take
next.  Are there other colleges or universities out there
who have been
experiencing problems like this?   If so were you able to
determine the
root cause? Thanks.

Greg



=============================================================
==============
Greg Malone
Portland Community College
Manager, Technical Services
Sylvania Campus CC219
12000 SW 49th Ave
Portland, OR  97280-0990
email:  gmalone () pcc edu
Phone:  (503) 977-4390
Fax:  (503) 977-4390
=============================================================
==============

**********
Participation and subscription information for this EDUCAUSE
Discussion Group discussion list can be found at
http://www.educause.edu/cg/.
Theresa Rowe
Assistant Vice President
University Technology Services
www.oakland.edu/uts - the latest news from University Technology Services

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/cg/.

Current thread: