SMTP 5.4.7 - Delivery expired - unable to reach nameserver on any valid IP

[hans.schroeder]

We recently started having issues delivering email to hotmail.com, aol.com, and amtrak.com addresses (possibly more domains, but

haven't heard of others yet).  They return the following error (email addresses have been altered):

Diagnostic information for administrators:

Generating server: edmironport.internal.edmondok.com

user@aol.com

#< #5.0.0 smtp; 5.4.7 - Delivery expired (message too old) 'DNS Soft Error looking up aol.com (MX) while asking recursive_nameserver1.parent. Error was: unable to reach nameserver on any valid IP' (delivery attempts: 0)> #SMTP#

Original message headers:

Received: from exch01.internal.edmondok.com ([192.168.xxx.xxx])  by
edmironport.edmondok.com with ESMTP; 29 Dec 2009 09:15:36 -0600
Received: from exch01.internal.edmondok.com ([192.168.xxx.xxx])
  by edmironport.edmondok.com with ESMTP; 29 Dec 2009 09:15:40 -0600
Received: from EXCH01.internal.edmondok.com ([fe80::45fe:26d:54cd:6aeb]) by
EXCH01.internal.edmondok.com ([fe80::xxxx:xxxx:xxxx:xxxx%10]) with mapi; Tue, 29
Dec 2009 09:15:19 -0600
From: Internal User <user@edmondok.com>
To: User <user@aol.com>
Date: Tue, 29 Dec 2009 09:15:18 -0600
Subject: Blood Drive Today
Thread-Topic: Blood Drive Today
Thread-Index: AcqImccN9I6lWOw9QuGSrMji25lA2A==
Message-ID: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx@EXCH01.internal.edmondok.com
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
acceptlanguage: en-US
Content-Type: multipart/alternative;
            boundary="_000_08B7F743EE3EF44F8B51C43EEB8902C4034FF1F5EXCH01interaled_"
MIME-Version: 1.0
X-Auto-Response-Suppress: DR, OOF, AutoReply

Any ideas as to why this is occuring?  I have the ironport appliance's (C150) DNS pointing to our internal DNS servers.  I am able to resolve all mailservers to IPs via nslookup and can ping hotmail.com's servers, but not aol.com's or amtrak.com's (possibly by their design?).  There are some MX issues with AOL and Amtrak, but not Hotmail.  Any help is appreciated.  Thanks,

Hans Schroeder | Network Specialist

City of Edmond | www.edmondok.com

hans.schroeder@edmondok.com

[steven_geerts]

Hello Hans,

It looks like your DNS server(s) are overloaded or refusing their job for some other reason.

What is the response of your DNS servers when you request the problematic domains? Please try from Ironport nslookup and from any other nslookup/dig that is using the same DNS servers.

One thing that once bothered us was that our DNS servers where allowed to perform UDP queries only, some MX targets with a lot (in this case 18) of servers in their MX records exceeded the UDP packet size and DNS tried to switch over to TCP. that traffic was dropped so the DNS server never got it's result back. I think the MX records of AOL and Amtrak are not that bid (4 and 3 mail servers) but maybe it's a start.

You can also try to enable query logging on your DNS servers and check the results of that.

Good luck,

Steven