Re: Mysterious Email Problems

[Brian Kaye <bdk () UNB CA>]

We have had this problem a number of times over the past few years. In
some cases we could send mail to them but they could not reply. Sometimes
the first message would go through after restarting our DNS servers but
the second one would not. We did a debug traceroute to all the nameservers
in the chain and these always works but most of the time a normal
traceroute did not work because there were bad cached entries in one or
more of the nameservers. Once these entries timed out all would work for
a while.


We did a lot of local checking on our DNS servers before we went outside.
It seemed that our local DNS didn't work and our external ones did so
depending on which one you used it worked or didn't. It al depended on
what they had cached. We tried new versions of BIND, new operating systems
etc all to no avail.


....Brian Kaye
....UNB





On Mon, 15 Sep 2003, Barros, Jacob wrote:

> Date: Mon, 15 Sep 2003 10:06:17 -0500
> From: "Barros, Jacob" <jkbarros () GRACE EDU>
> Reply-To: The EDUCAUSE Security Discussion Group Listserv
>     <SECURITY () LISTSERV EDUCAUSE EDU>
> To: SECURITY () LISTSERV EDUCAUSE EDU
> Subject: Re: [SECURITY] Mysterious Email Problems
>
> We too have had similar occasions with outside companies.  Each time the
> problem seemed to be on their end.  Our exchange admin said that we used
> http://dnsreport.com to check the accuracy of their DNS setup and found
> that they did not have the reverse lookup working.  (But they do now...
> thus the problem no longer exits.)  We've never been curious enough to
> follow up and ask what they did or how they did it.
>
>
>
>
> -----Original Message-----
> From: gmalone [mailto:gmalone () PCC EDU]
> Sent: Friday, September 12, 2003 6:30 PM
> To: SECURITY () LISTSERV EDUCAUSE EDU
> Subject: [SECURITY] Mysterious Email Problems
>
>
> Hello Group,
>
> Over the last two or three months, Portland Community College (PCC) has
> had mysterious email problems related to receiving incoming email
> messages.  A college or vendor will send an email message to an
> individual at PCC and sometimes it will go through and sometimes it
> won't.  We have worked with two vendors and two universities to try and
> determine the root cause of the problems.  It appears that when the
> sending email server sends a reverse look-up for our domain it can find
> it sometimes and other times it can't.  We have checked and rechecked
> our external DNS records.  We have even had IT staff at the sending
> institution perform DNS look-ups at the
> same time a message is sent.   We have found cases where the DNS look-up
> will work but the email will be rejected because our domain is
> unknown.   I've been told that both of the universities we are working
> with
> have similar intermittent problems.
>
> We have heard and discussed several theories such as the Spam software
> may be casing the problem, or the need for a second authoritative DNS
> server out side PCC, and even the possibility that the virus problem may
> be causing this by flooding segments of the Internet periodically.  I'll
> admit that this is not my area of expertise and all these worms and
> viruses have caused us all to second guess our fundamental strategies.
> I like to find out if this is an issue unique to PCC so I can decide
> what actions to take next.  Are there other colleges or universities out
> there who have been
> experiencing problems like this?   If so were you able to determine the
> root cause? Thanks.
>
> Greg
>
>
>
> ========================================================================
> ===
> Greg Malone
> Portland Community College
> Manager, Technical Services
> Sylvania Campus CC219
> 12000 SW 49th Ave
> Portland, OR  97280-0990
> email:  gmalone () pcc edu
> Phone:  (503) 977-4390
> Fax:  (503) 977-4390
> ========================================================================
> ===
>
> **********
> Participation and subscription information for this EDUCAUSE Discussion
> Group discussion list can be found at http://www.educause.edu/cg/.
>
> **********
> Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
> http://www.educause.edu/cg/.

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/cg/.