Spam Filter ISP Forums : DNS Error: Timedout https://www.logsat.com/spamfilter/forums/ Mon, 16 Mar 2026 10:51:58 +0000 Tue, 30 Mar 2010 22:04:56 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 11.04 360 https://www.logsat.com/spamfilter/forums/RSS_post_feed.asp?TID=6808 <![CDATA[Spam Filter ISP Forums]]> https://www.logsat.com/spamfilter/forums/forum_images/web_wiz_forums.png https://www.logsat.com/spamfilter/forums/ <![CDATA[DNS Error: Timedout : lyndonje,Can you please try,...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6808&PID=13537&title=dns-error-timedout#13537 Author: LogSat
Subject: 6808
Posted: 30 March 2010 at 10:04pm

lyndonje,

Can you please try, *from the server running spamfilter*, to issue the set of DNS lookups I mentioned above:

c:\>nslookup
> server 192.168.1.1  (replace this IP with your DNS server)
Default server: 192.168.1.1
Address: 192.168.1.1#53
> 247.47.246.41.bl.spamcop.net
Server:         192.168.1.1
Address:        192.168.1.1#53

Non-authoritative answer:
Name:   49.201.79.189.bl.spamcop.net
Address: 127.0.0.2
> 

and re-running the query each time replacing the MAPS server name with all of the MAPS servers you have in your list? For exmaple:
247.47.246.41.bl.spamcop.net
247.47.246.41.cbl.abuseat.org

etc etc?
It's possible that one of those MAPS server is timing out (we see for example an issue with "xbl.spamhaus.org"), which would cause those errors to be logged.

]]> Tue, 30 Mar 2010 22:04:56 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6808&PID=13537&title=dns-error-timedout#13537 <![CDATA[DNS Error: Timedout : Sorry for the delay, I&#039;m...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6808&PID=13533&title=dns-error-timedout#13533 Author: lyndonje
Subject: 6808
Posted: 30 March 2010 at 6:51am

Sorry for the delay, I'm running version 4.1.2.812. Below are a few examples from my log:

03/30/10 02:06:49:151 -- (6720) Connection from: 91.194.249.192  -  Originating country : Austria
03/30/10 02:06:49:323 -- (6720) Received MAIL FROM: <xxx>
03/30/10 02:06:49:401 -- (6720) Received RCPT TO: xxx
03/30/10 02:06:49:463 -- (6720) Resolving 91.194.249.192 - xxx
03/30/10 02:06:49:713 -- (6720) found SPF record for xxx: v=spf1 redirect=xxx
03/30/10 02:06:49:713 -- (6720) found SPF record for xxx: v=spf1 a mx ip4:91.194.248.0/23 ip4:91.211.240.0/24 ip4:91.211.242.0/24 ip4:81.223.46.0/27 ~all
03/30/10 02:06:49:729 -- (6720) SPF query result: pass
03/30/10 02:06:49:729 -- (6720) - SPF analysis for xxx done: - pass
03/30/10 02:06:49:729 -- (6720) SPF query result: pass
03/30/10 02:06:49:729 -- (6720) - SPF analysis for xxx done: - pass
03/30/10 02:06:49:729 -- (6720) Mail from: xxx
03/30/10 02:06:54:869 -- (6720) DNS Error:TimedOut
03/30/10 02:06:54:869 -- (6720) DNS Server will rotate after query. New server will be d.c.b.a
03/30/10 02:06:58:479 -- (6720) - MAPS search done... 
03/30/10 02:06:58:479 -- (6720) RCPT TO: xxx accepted
03/30/10 02:06:58:807 -- (6720) Checking SFDC
03/30/10 02:06:59:041 -- (6720) Hash cache - Added OK
03/30/10 02:06:59:135 -- (6720) EMail from xxx to xxx passes Bayesian filter - 0% spam  (78ms)
03/30/10 02:06:59:135 -- (6720) Checking SURBL
03/30/10 02:07:04:182 -- (6720) DNS Error:TimedOut
03/30/10 02:07:04:182 -- (6720) DNS Server will rotate after query. New server will be a.b.c.d
03/30/10 02:07:09:822 -- (6720) DNS Error:TimedOut
03/30/10 02:07:09:822 -- (6720) DNS Server will rotate after query. New server will be d.c.b.a
03/30/10 02:07:09:869 -- (6720) Checking URLs in emails against MAPS
03/30/10 02:07:09:869 -- (6720) Resolving for URLsInMAPS: rover.ebay.com
03/30/10 02:07:15:151 -- (6720) DNS Error:TimedOut
03/30/10 02:07:15:151 -- (6720) DNS Server will rotate after query. New server will be a.b.c.d
03/30/10 02:07:20:291 -- (6720) DNS Error:TimedOut
03/30/10 02:07:20:291 -- (6720) DNS Server will rotate after query. New server will be d.c.b.a
03/30/10 02:07:20:354 -- (6720) Resolving for URLsInMAPS: www.w3.org
03/30/10 02:07:25:494 -- (6720) DNS Error:TimedOut
03/30/10 02:07:25:494 -- (6720) DNS Server will rotate after query. New server will be a.b.c.d
03/30/10 02:07:30:604 -- (6720) DNS Error:TimedOut
03/30/10 02:07:30:604 -- (6720) DNS Server will rotate after query. New server will be d.c.b.a
03/30/10 02:07:30:635 -- (6720) Resolving for URLsInMAPS: mail.ebay.co.uk
03/30/10 02:07:36:088 -- (6720) DNS Error:TimedOut
03/30/10 02:07:36:088 -- (6720) DNS Server will rotate after query. New server will be a.b.c.d
03/30/10 02:07:41:197 -- (6720) DNS Error:TimedOut
03/30/10 02:07:41:197 -- (6720) DNS Server will rotate after query. New server will be d.c.b.a
03/30/10 02:07:41:275 -- (6720) Resolving for URLsInMAPS: pics.ebaystatic.com
03/30/10 02:07:46:603 -- (6720) DNS Error:TimedOut
03/30/10 02:07:46:603 -- (6720) DNS Server will rotate after query. New server will be a.b.c.d
03/30/10 02:07:51:713 -- (6720) DNS Error:TimedOut
03/30/10 02:07:51:713 -- (6720) DNS Server will rotate after query. New server will be d.c.b.a
03/30/10 02:07:51:775 -- (6720) Resolving for URLsInMAPS: pics.ebaystatic..com
03/30/10 02:07:51:822 -- (6720) Error occurred during URLsInMAPS: DNS Server Reports Query Not Implemented Error
03/30/10 02:07:51:822 -- (6720) - URLs In MAPS search done... 
03/30/10 02:07:51:822 -- (6720) Start virus scan
03/30/10 02:07:51:916 -- (6720) Starting queueing procedures
03/30/10 02:07:51:932 -- (6720) EMail from xxx to xxx was queued. Size: 34 KB, 34816 bytes
03/30/10 02:07:51:932 -- (6720) Starting bayesian procedures
03/30/10 02:07:52:041 -- (6720) Disconnect

03/30/10 02:09:26:431 -- (8236) Connection from: 78.129.153.65  -  Originating country : United Kingdom
03/30/10 02:09:26:525 -- (8236) Received MAIL FROM: <xxx> SIZE=34487
03/30/10 02:09:26:556 -- (8236) Received RCPT TO: xxx
03/30/10 02:09:26:572 -- (8236) Resolving 78.129.153.65 - xxx
03/30/10 02:09:26:806 -- (8236) - SPF analysis for xxx done: - none
03/30/10 02:09:26:806 -- (8236) Mail from: xxx
03/30/10 02:09:31:915 -- (8236) DNS Error:TimedOut
03/30/10 02:09:31:915 -- (8236) DNS Server will rotate after query. New server will be d.c.b.a
03/30/10 02:09:35:540 -- (8236) - MAPS search done... 
03/30/10 02:09:35:540 -- (8236) RCPT TO: xxx accepted
03/30/10 02:09:35:540 -- (8236) Bypassed all rules for: xxx from xxx ( AutoWhiteList Force Delivery)
03/30/10 02:09:35:743 -- (8236) Bypassed all rules for: xxx from xxx
03/30/10 02:09:35:822 -- (8236) Start virus scan
03/30/10 02:09:35:978 -- (8236) Starting queueing procedures
03/30/10 02:09:35:978 -- (8236) EMail from xxx to xxx was queued. Size: 31 KB, 31744 bytes
03/30/10 02:09:35:993 -- (8236) Starting bayesian procedures
03/30/10 02:09:36:072 -- (8236) Disconnect

03/30/10 02:10:04:431 -- (9812) Connection from: 91.186.15.206  -  Originating country : United Kingdom
03/30/10 02:10:04:728 -- (9812) Received MAIL FROM: <xxx> SIZE=1349
03/30/10 02:10:04:759 -- (9812) Received RCPT TO: xxx
03/30/10 02:10:04:946 -- (9812) Resolving 91.186.15.206 - xxx
03/30/10 02:10:05:290 -- (9812) - SPF analysis for xxx done: - none
03/30/10 02:10:05:290 -- (9812) Mail from: xxx
03/30/10 02:10:10:431 -- (9812) DNS Error:TimedOut
03/30/10 02:10:10:431 -- (9812) DNS Server will rotate after query. New server will be a.b.c.d
03/30/10 02:10:15:524 -- (9812) DNS Error:TimedOut
03/30/10 02:10:15:524 -- (9812) DNS Server will rotate after query. New server will be d.c.b.a
03/30/10 02:10:15:587 -- (9812) - MAPS search done... 
03/30/10 02:10:15:587 -- (9812) RCPT TO: xxx accepted
03/30/10 02:10:15:884 -- (9812) Checking SFDC
03/30/10 02:10:16:259 -- (9812) Hash cache - Added OK
03/30/10 02:10:16:259 -- (9812) EMail from xxx to xxx passes Bayesian filter - 0% spam  (0ms)
03/30/10 02:10:16:259 -- (9812) Checking SURBL
03/30/10 02:10:16:259 -- (9812) Checking URLs in emails against MAPS
03/30/10 02:10:16:259 -- (9812) - URLs In MAPS search done... 
03/30/10 02:10:16:259 -- (9812) Start virus scan
03/30/10 02:10:16:274 -- (9812) Starting queueing procedures
03/30/10 02:10:16:274 -- (9812) EMail from xxx to xxx was queued. Size: 1 KB, 1024 bytes
03/30/10 02:10:16:274 -- (9812) Starting bayesian procedures
03/30/10 02:10:16:368 -- (9812) Disconnect

]]> Tue, 30 Mar 2010 06:51:23 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6808&PID=13533&title=dns-error-timedout#13533 <![CDATA[DNS Error: Timedout : I&#039;m seeing the same issue....]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6808&PID=13519&title=dns-error-timedout#13519 Author: dotme
Subject: 6808
Posted: 25 March 2010 at 6:17pm

I'm seeing the same issue. To fix another error we were seeing (557 Exceptions) I upgraded to 4.1.3.822 from 4.0.0.785
 
After the upgrade, getting tons of DNS timeouts. DNS servers are very responsive to NSLOOKUPS and I have even aimed monitoring at them. All is well.
 
The real issue for me is that these timeouts, when an incoming message (legit) is loaded with URLs (constantcontact... for example), there are some unfortunate side effects.
 
The SURBL checks take so long that although the message eventually passes all tests, the sending server gives up waiting and re-queues the email.
 
Result? Some users report receiving the same email over and over again. I have to whitelist the sender in those cases, so we bypass checks and the repeat deliveries stop. But that's not a long term solution. It does seem like either something is less tolerant of delays with the new build, or one of the blacklist servers is suddenly very slow to respond (or maybe throttling?).
 
Here's a logfile if it helps... as you can see, the whole "check" process exceeds 5 minutes. That's a long time. No wonder the sending server re-queues the message.
 
@lyndonje - Any chance you can check your logs to see if it's the same "Checking URLs in emails against MAPS" area that's creating the issue for you?
 
If it is, and we nail this down as the cause, what's the best next move? Thanks everyone.
 
03/24/10 10:42:41:539 -- (2028) Detected TCP Connection: 207.97.245.xxx
03/24/10 10:42:41:554 -- (2028) Connection from: 207.97.245.xxx  -  Originating country : United States
03/24/10 10:42:41:711 -- (2028) Received MAIL FROM: <jim@source.com>
03/24/10 10:42:41:742 -- (2028) Received RCPT TO: srose@dest.com
03/24/10 10:42:41:757 -- (2028) Resolving 207.97.245.xxx - smtp156.iad.source.com
03/24/10 10:42:41:929 -- (2028) - SPF analysis for source.com done: - none
03/24/10 10:42:41:929 -- (2028) Mail from: jim@source.com
03/24/10 10:42:49:117 -- (2028) DNS Error:TimedOut
03/24/10 10:42:49:117 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.168
03/24/10 10:43:01:101 -- (2028) - MAPS search done...
03/24/10 10:43:01:101 -- (2028) RCPT TO: srose@dest.com accepted
03/24/10 10:43:01:601 -- (2028) Checking SFDC
03/24/10 10:43:01:773 -- (2028) Hash cache - Added OK
03/24/10 10:43:01:773 -- (2028) Checking SURBL
03/24/10 10:43:11:101 -- (2028) Checking URLs in emails against MAPS
03/24/10 10:43:11:117 -- (2028) Resolving for URLsInMAPS: www.buffalo1.com
03/24/10 10:43:18:117 -- (2028) DNS Error:TimedOut
03/24/10 10:43:18:117 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.168
03/24/10 10:43:26:086 -- (2028) Resolving for URLsInMAPS: www.xxxxx.com 03/24/10 10:43:33:117 -- (2028) DNS Error:TimedOut
03/24/10 10:43:33:117 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.168
03/24/10 10:43:41:101 -- (2028) Resolving for URLsInMAPS: campaign.constantcontact.com
03/24/10 10:43:52:132 -- (2028) DNS Error:TimedOut
03/24/10 10:43:52:132 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.168
03/24/10 10:44:13:148 -- (2028) Resolving for URLsInMAPS: img.constantcontact.com
03/24/10 10:44:23:116 -- (2028) DNS Error:TimedOut
03/24/10 10:44:23:116 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.169
03/24/10 10:44:31:101 -- (2028) Resolving for URLsInMAPS: r20.rs6.net
03/24/10 10:44:40:132 -- (2028) DNS Error:TimedOut
03/24/10 10:44:40:132 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.168
03/24/10 10:44:56:101 -- (2028) Resolving for URLsInMAPS: ih.constantcontact.com
03/24/10 10:45:03:085 -- (2028) DNS Error:TimedOut
03/24/10 10:45:03:085 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.168
03/24/10 10:45:05:101 -- (2028) Resolving for URLsInMAPS: www.youtube.com
03/24/10 10:45:12:163 -- (2028) DNS Error:TimedOut
03/24/10 10:45:12:163 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.169
03/24/10 10:45:24:116 -- (2028) Resolving for URLsInMAPS: www.cartridgesareus.com
03/24/10 10:45:32:148 -- (2028) DNS Error:TimedOut
03/24/10 10:45:32:148 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.168
03/24/10 10:45:44:116 -- (2028) Resolving for URLsInMAPS: ui.constantcontact.com
03/24/10 10:45:58:148 -- (2028) DNS Error:TimedOut
03/24/10 10:45:58:148 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.169
03/24/10 10:46:19:163 -- (2028) Resolving for URLsInMAPS: visitor.constantcontact.com
03/24/10 10:46:27:148 -- (2028) DNS Error:TimedOut
03/24/10 10:46:27:148 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.169
03/24/10 10:46:41:132 -- (2028) Resolving for URLsInMAPS: franchise.constantcontact.com
03/24/10 10:46:52:116 -- (2028) DNS Error:TimedOut
03/24/10 10:46:52:116 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.168
03/24/10 10:47:08:085 -- (2028) Resolving for URLsInMAPS: www.w3.org
03/24/10 10:47:13:101 -- (2028) DNS Error:TimedOut
03/24/10 10:47:13:101 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.168
03/24/10 10:47:15:148 -- (2028) - URLs In MAPS search done...
03/24/10 10:47:15:148 -- (2028) Start virus scan
03/24/10 10:47:15:257 -- (2028) Starting queueing procedures
03/24/10 10:47:15:273 -- (2028) EMail from jim@source.com to srose@dest.com was queued. Size: 155 KB, 158720 bytes
03/24/10 10:47:15:273 -- (2028) Disconnect
03/24/10 10:47:15:273 -- (788) Sending email from jim@source.com to srose@dest.com --
03/24/10 10:47:15:444 -- (788) EMail from jim@source.com to srose@dest.com --  was forwarded to 10.10.10.166:25


Edited by dotme - 25 March 2010 at 6:25pm]]> Thu, 25 Mar 2010 18:17:47 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6808&PID=13519&title=dns-error-timedout#13519 <![CDATA[DNS Error: Timedout : SpamFilter will always use the...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6808&PID=13488&title=dns-error-timedout#13488 Author: LogSat
Subject: 6808
Posted: 12 March 2010 at 10:06pm

SpamFilter will always use the DNS servers specified in its configuration for its queries. The DNS server being queried will then take care of contacting the proper DNS server(s) responsible for the lookup and will provide the reply to SpamFilter (unless your DNS server already has the response in its cache).]]> Fri, 12 Mar 2010 22:06:39 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6808&PID=13488&title=dns-error-timedout#13488 <![CDATA[DNS Error: Timedout : When spamfilter is checking a...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6808&PID=13483&title=dns-error-timedout#13483 Author: yapadu
Subject: 6808
Posted: 11 March 2010 at 8:19pm

When spamfilter is checking a blacklist (like spamcop or something) it still processes the request through our local DNS server correct?  Or does spamfilter go direct to the blacklist provider?

I attempted to run an instance on Amazon Cloud, and found requests to many of the 3rd party blacklists were rejected automatically from the Amazon Cloud address space.
]]> Thu, 11 Mar 2010 20:19:33 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6808&PID=13483&title=dns-error-timedout#13483 <![CDATA[DNS Error: Timedout : ...you know what, I had never...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6808&PID=13481&title=dns-error-timedout#13481 Author: LogSat
Subject: 6808
Posted: 11 March 2010 at 4:33pm

...you know what, I had never thought about that either! We're evenSmile]]> Thu, 11 Mar 2010 16:33:39 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6808&PID=13481&title=dns-error-timedout#13481 <![CDATA[DNS Error: Timedout : Sorry, Roberto ]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6808&PID=13479&title=dns-error-timedout#13479 Author: lyndonje
Subject: 6808
Posted: 11 March 2010 at 5:30am

Sorry, Roberto Wink]]> Thu, 11 Mar 2010 05:30:28 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6808&PID=13479&title=dns-error-timedout#13479 <![CDATA[DNS Error: Timedout : Hi Rob,When I do manual DNS lookups,...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6808&PID=13478&title=dns-error-timedout#13478 Author: lyndonje
Subject: 6808
Posted: 11 March 2010 at 5:14am

Hi Rob,

When I do manual DNS lookups, generally speaking they do not time out.

I wonder.... could it be anything to do with the black lists I'm using? For example, if they're no longer in service, may this effect things or report timeouts?
]]> Thu, 11 Mar 2010 05:14:02 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6808&PID=13478&title=dns-error-timedout#13478 <![CDATA[DNS Error: Timedout : That timeout error usually does...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6808&PID=13477&title=dns-error-timedout#13477 Author: LogSat
Subject: 6808
Posted: 10 March 2010 at 11:33pm

That timeout error usually does indicate just that - there was a timeout when querying the DNS. If you see 2-3 failures every 200-300 DNS queries, that's an acceptable amount of timeouts. If they are higher, it likely indicates other issues, which yes, would negatively impact the spam detection rate.

To see if there is an issue with the DNS servers specified in SpamFilter, you can try opening an MSDOS prompt on the server running SpamFilter, and issuing the following commands in bold, repeating the sequence 2-3 times, each time using a different DNS server, and ensuring you receive the 127.0.0.2 result and not a timeout:

c:\>nslookup
> server 192.168.1.1  (replace this IP with your DNS server)
Default server: 192.168.1.1
Address: 192.168.1.1#53
> 247.47.246.41.bl.spamcop.net
Server:         192.168.1.1
Address:        192.168.1.1#53

Non-authoritative answer:
Name:   49.201.79.189.bl.spamcop.net
Address: 127.0.0.2
> 

]]> Wed, 10 Mar 2010 23:33:55 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6808&PID=13477&title=dns-error-timedout#13477 <![CDATA[DNS Error: Timedout : Hey,I&#039;m seeing this a lot...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6808&PID=13476&title=dns-error-timedout#13476 Author: lyndonje
Subject: 6808
Posted: 10 March 2010 at 7:01am

Hey,

I'm seeing this a lot in my logs:

03/10/10 11:51:53:671 -- (3128) DNS Error:TimedOut
03/10/10 11:51:53:671 -- (3128) DNS Server will rotate after query. New server will be x.x.x.x

I've also tried using a few different DNS servers but doing so makes no difference. 

Is there any reason (other that delayed DNS response times) that may cause this?

What are the effects of this error on spam detection? 

Is there anything I could do other than maybe find more responsive DNS servers?

Thanks.
]]> Wed, 10 Mar 2010 07:01:50 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6808&PID=13476&title=dns-error-timedout#13476