Zimbra receiving problem

[luismoliveira]

Hi to all,

I'm using Zimbra Release 7.1.3_GA_3346.RHEL5_20110928134520 CentOS5 FOSS edition, Patch 7.1.3_P1.

Recently I upgraded from version 7.0.1.

I'm having the following problem:
- I'm not receiving some mails from outside, and until now I didn't find out what is the pattern. For instance using an email account that I have in gmail I didn't receive the e-mail in my zimbra account. But I already received e-mails in my zimbra account from other @gmail.com accounts....

As far as I know in 7.0.1 configuration I don't have this problem.

Any help it will be very welcomed.

Thanks in advance
Luis

[Labsy]

How do you mean that you do not receive mail?
- does it get bounced back to your gmail?
- or lands in SPAM folder of your Zimbra account?
- or gets lost somewhere in space?

[luismoliveira]

Hi,

First of all thank you for your reply.

I didn't get any error message back in my gmail account and it's not in my SPAM folder.

I didn't find any track of the message in zimbra.log. So, answering your question, it seems that the e-mail didn't reach zimbra server.

There is maybe a problem in the MX record of my domain (clearis.pt). But I don't understand why I receive some external e-mails and others don't.

Thanks,
Luis

[Labsy]

Hi Luis,

yes, your main problem is not only MX problem, but general problem with your DNS:

1.) At first, you made general "DO NOT" mistake by configuring ns*.yourdomain.com as DNS for the same yourdomain.com. It's a typical loop:
Hey, DNS servers, does anybody know, where "yourodmain.com" is located?
And DNS servers answer: yes, we know. Ask DNS server, located at "yourdomain.com" to tell you where "yourdomain.com" is located...
How could he...he is not aware of himself

So, here you have an option:
- either use your domain REGISTRAR's DNS servers and configure DNS zone for "yourdomain.com" there,
- or use some free DNS host, like Advanced DNS Management - Easy, web-based domain manager - ZoneEdit.com, and set zoneedit's DNS servers within your registrar for "yourdomain.com"


Why you receive some mail and some not?
Probably because of CACHE.

[luismoliveira]

Hi Labsy,

Thank you for your time again.

Our domain is managed by www.dns.pt. In dns.pt are configured the following NS:
ns1.clearis.pt (66.240.231.42)
ns2.clearis.pt (72.9.106.68)
ns.clearis.pt (85.139.249.2). It's our public ip

This configuration is unchanged for the last 2 years.

How can I check what ns1.clearis.pt is answering?

Cheers

[phoenix]

Originally Posted by luismoliveira

How can I check what ns1.clearis.pt is answering?

You should check "man dig" for the syntax you require. Neither of the servers you list above give valid responses:

dig @66.240.231.42 clearis.pt mx

; <<>> DiG 9.8.1-P1 <<>> @66.240.231.42 clearis.pt mx
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27505
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 13, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;clearis.pt.                    IN      MX

;; AUTHORITY SECTION:
.                       3600000 IN      NS      A.ROOT-SERVERS.NET.
.                       3600000 IN      NS      B.ROOT-SERVERS.NET.
.                       3600000 IN      NS      C.ROOT-SERVERS.NET.
.                       3600000 IN      NS      D.ROOT-SERVERS.NET.
.                       3600000 IN      NS      E.ROOT-SERVERS.NET.
.                       3600000 IN      NS      F.ROOT-SERVERS.NET.
.                       3600000 IN      NS      G.ROOT-SERVERS.NET.
.                       3600000 IN      NS      H.ROOT-SERVERS.NET.
.                       3600000 IN      NS      I.ROOT-SERVERS.NET.
.                       3600000 IN      NS      J.ROOT-SERVERS.NET.
.                       3600000 IN      NS      K.ROOT-SERVERS.NET.
.                       3600000 IN      NS      L.ROOT-SERVERS.NET.
.                       3600000 IN      NS      M.ROOT-SERVERS.NET.

;; Query time: 182 msec
;; SERVER: 66.240.231.42#53(66.240.231.42)
;; WHEN: Thu Feb  2 12:14:22 2012
;; MSG SIZE  rcvd: 239

dig @72.9.106.68 clearis.pt mx

; <<>> DiG 9.8.1-P1 <<>> @72.9.106.68 clearis.pt mx
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

[luismoliveira]

Hi Bill,

Thanks for your reply.

It seems that the last machine listed gives a valid response:

dig @85.139.249.2 clearis.pt mx

; <<>> DiG 9.7.3-P3 <<>> @85.139.249.2 clearis.pt mx
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 35117
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 4
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;clearis.pt. IN MX

;; ANSWER SECTION:
clearis.pt. 1800 IN MX 10 smtp.clearis.pt.

;; AUTHORITY SECTION:
clearis.pt. 1800 IN NS ns.clearis.pt.
clearis.pt. 1800 IN NS ns1.clearis.pt.
clearis.pt. 1800 IN NS ns2.clearis.pt.

;; ADDITIONAL SECTION:
smtp.clearis.pt. 1800 IN A 85.139.249.2
ns.clearis.pt. 1800 IN A 85.139.249.2
ns1.clearis.pt. 1800 IN A 66.240.231.42
ns2.clearis.pt. 1800 IN A 72.9.106.68

;; Query time: 13 msec
;; SERVER: 85.139.249.2#53(85.139.249.2)
;; WHEN: Thu Feb 2 11:47:06 2012
;; MSG SIZE rcvd: 166


Best regards
Luis

[Labsy]

Hi Luis,

as I already told, please, get rid of having Name Servers for domain "clearis.pt" on the same named DNS "*.clearis.pt".
After second thought I figured out, why it sometimes works and sometimes not:
Some DNS regard your NS IP address, while some do not. But anyways, it's definite DO NOT principle.

Please, take a look at DNS Report for your domain:
http://www.dnssy.com/report.php?q=clearis.pt
Countless errors and warnings, meaning you do not have not even close to properly configured DNS!

PROPER CONFIG:
1.) You should have created DNS zone for your domain "clearis.pt" at www.dns.pt or any other DNS provider.
For example:
IN NS ns1.dns.pt
IN NS ns2.dns.pt
(names are fictional, but close to reality!)
Use DIG to test:
dig @ns1.dns.pt clearis.pt
should return the same as
dig @ns2.dns.pt clearis.pt
and both should have "IN NS" records the same as lookup via WHOIS for clearis.pt

2.) At your DOMAIN REGISTRAR you should have above two DNS servers setup as your Name Servers:
Primary DNS: ns1.dns.pt
Secondary DNS: ns2.dns.pt

Also, please, DO NOT enter your mail @clearis.pt as contact mail at your registrar! It's a dead loop in case you forget to renew domain!

3.) Forget your own DNS.

4.) Configure all needed A and MX records for your domain with www.dns.pt control panel, and if possible, do not forget TXT record for SPF, at least those records:
* IN A 193.137.196.42
www IN A 193.137.196.42
smtp IN A 85.139.249.2
IN MX 10 smtp.clearis.pt.

[Labsy]

Some diagnostics:

Here you see that NS1.CLEARIS.PT does not have an idea, where your domain is. Meaning, it redirects to root DNS... so your NS1 is not functioning properly:

; <<>> DiG 9.7.0-P1 <<>> @ns1.clearis.pt clearis.pt
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43111
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 13, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;clearis.pt.                    IN      A

;; AUTHORITY SECTION:
.                       3600000 IN      NS      A.ROOT-SERVERS.NET.
.                       3600000 IN      NS      B.ROOT-SERVERS.NET.
.                       3600000 IN      NS      C.ROOT-SERVERS.NET.
.                       3600000 IN      NS      D.ROOT-SERVERS.NET.
.                       3600000 IN      NS      E.ROOT-SERVERS.NET.
.                       3600000 IN      NS      F.ROOT-SERVERS.NET.
.                       3600000 IN      NS      G.ROOT-SERVERS.NET.
.                       3600000 IN      NS      H.ROOT-SERVERS.NET.
.                       3600000 IN      NS      I.ROOT-SERVERS.NET.
.                       3600000 IN      NS      J.ROOT-SERVERS.NET.
.                       3600000 IN      NS      K.ROOT-SERVERS.NET.
.                       3600000 IN      NS      L.ROOT-SERVERS.NET.
.                       3600000 IN      NS      M.ROOT-SERVERS.NET.

;; Query time: 173 msec
;; SERVER: 66.240.231.42#53(66.240.231.42)
;; WHEN: Fri Feb  3 00:31:29 2012
;; MSG SIZE  rcvd: 239

Now, let's ask NS2.CLEARIX.PT...
Oups...NS2 waits for about a minute, then times out. This DNS is not in function at all:

; <<>> DiG 9.7.0-P1 <<>> @ns2.clearis.pt clearis.pt
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

Finally, the last server, NS.CLEARIS.PT...
Well, this one responds fine, and has all records as it should have. This is the ONLY ONE properly configured DNS server for your domain (...but has the wrong name!)

; <<>> DiG 9.7.0-P1 <<>> @ns.clearis.pt clearis.pt
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57367
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 3
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;clearis.pt.                    IN      A

;; ANSWER SECTION:
clearis.pt.             1800    IN      A       85.139.249.2

;; AUTHORITY SECTION:
clearis.pt.             1800    IN      NS      ns1.clearis.pt.
clearis.pt.             1800    IN      NS      ns2.clearis.pt.
clearis.pt.             1800    IN      NS      ns.clearis.pt.

;; ADDITIONAL SECTION:
ns.clearis.pt.          1800    IN      A       85.139.249.2
ns1.clearis.pt.         1800    IN      A       66.240.231.42
ns2.clearis.pt.         1800    IN      A       72.9.106.68

;; Query time: 77 msec
;; SERVER: 85.139.249.2#53(85.139.249.2)
;; WHEN: Fri Feb  3 00:32:02 2012
;; MSG SIZE  rcvd: 145

[luismoliveira]

Hi Labsy

Thanks for your help.

Cheers,
Luis