Fritz,

You are correct, the domain dbvi.de does indeed have a valid DNS record. If the problem occurs on and off, there may be an issue with the DNS server SpamFilter uses to perform DNS queries. As a matter of fact, we here at LogSat had the same exact issue this morning with one (just one - the other was fine) of our own DNS servers . Restarting the DNS services solved the problem.

Fritz,

Time-outs should not be an issue, as SpamFilter will not cause the DNS-based tests in case of time-outs, it will rather simply skip the test and move on with the others. If there is a timeout issue with one or more DNS servers, SpamFilter's activity logfile will contain a large number of events similar to:

03/24/09 08:48:48:163 -- (5072) DNS Error:TimedOut
03/24/09 08:48:48:163 -- (5072) DNS Server will rotate after query. New server will be 66.181.198.2
03/24/09 08:48:53:163 -- (5072) DNS Error:TimedOut
03/24/09 08:48:53:163 -- (5072) DNS Server will rotate after query. New server will be 66.181.198.4

In our own specific case on the 26th here at LogSat, where emails were being rejected due to MX record failures, the DNS server that was behaving erratically appeared to work normally, but sometimes would return "no records found" on queries for the MX record on a domain. We tested this via nslookup commands from command-line, and received the same (incorrect) response for multiple domains. We attributed this to a corrupted DNS cache, and as I mentioned restarting the DNS service and clearing the cache (we're using Microsoft DNS) solved the issue immediately.

Could you try to verify this on your own server, by issuing the following commands in bold from a DOS/Unix prompt, replacing the aa.bb.cc.dd with the IP of your DNS servers, and ensuring that for each you receive the accurate reply in italic? Please replace the domain hirschvogel.eu with one that was recently stopped incorrectly:


c:\>nslookup
> server 66.181.198.2
Default server: 66.181.198.2
Address: 66.181.198.2#53
> set type=mx
> hirschvogel.eu
Server:         66.181.198.2
Address:        66.181.198.2#53

Non-authoritative answer:
hirschvogel.eu  mail exchanger = 30 mx.odn.de.
hirschvogel.eu  mail exchanger = 20 mail.hirschvogel-online.de.

Authoritative answers can be found from:
mx.odn.de       internet address = 212.34.160.79
>


Please also ensure that the MX record lookup is performed for the exact domain in the "from" email address. For example "john@hirschvogel.eu" or "john@mail.hirschvogel.eu". In some cases administrators will "forget" to add MX records for child domains, and often the second type of email address above with the "mail.hirschvogel.eu" may not contain an MX record.

Fritz,

Yes, absolutely, please send us the zipped log for the day it happened (and please indicate which to/from email addresses are involved so we may locate the email in the log). If the file is over 7MB in size, please send the file to our FTP site, for which I'l send a PM with the login info.

Fritz,

Your DNS server is *sometimes* reporting an error when queried as follows:

03.30.09 10:19:05:992 -- (5304) - Invalid MX record - DNS Server Reports Query Server Error

SpamFilter is supposed to recognize when there is a DNS server erratic response, but was not able to do so in this case. This is thus filed as a bug.

We've created a patch that should address this - it's build 4.1.2.806 and we've just made it available in the user area on the website. Please do note that it is considered to be a beta, as it still has not gone thru more strict QA as we wanted to make it available to you as soon as possible. Please let us know if it does solve your issues should you wish to use it.

rudaf,

We verified that the patch that addressed your issue in build 806 is still present and working in build 808. It is possible that there is a different kind of issue/error being sent by the DNS server(s). Could you please zip and email us SpamFilter's logfile for a day (and the to/from of at least 2-3 emails blocked due to this so we may locate them in the logs?