DNS Error: Timedout
Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6808
Printed Date: 10 February 2025 at 7:34pm
Topic: DNS Error: Timedout
Posted By: lyndonje
Subject: DNS Error: Timedout
Date Posted: 10 March 2010 at 7:01am
|
Hey, I'm seeing this a lot in my logs: 03/10/10 11:51:53:671 -- (3128) DNS Error:TimedOut 03/10/10 11:51:53:671 -- (3128) DNS Server will rotate after query. New server will be x.x.x.x I've also tried using a few different DNS servers but doing so makes no difference. Is there any reason (other that delayed DNS response times) that may cause this? What are the effects of this error on spam detection? Is there anything I could do other than maybe find more responsive DNS servers? Thanks. |
Replies:
Posted By: LogSat
Date Posted: 10 March 2010 at 11:33pm
|
That timeout error usually does indicate just that - there was a timeout when querying the DNS. If you see 2-3 failures every 200-300 DNS queries, that's an acceptable amount of timeouts. If they are higher, it likely indicates other issues, which yes, would negatively impact the spam detection rate. To see if there is an issue with the DNS servers specified in SpamFilter, you can try opening an MSDOS prompt on the server running SpamFilter, and issuing the following commands in bold, repeating the sequence 2-3 times, each time using a different DNS server, and ensuring you receive the 127.0.0.2 result and not a timeout: c:\>nslookup > server 192.168.1.1 (replace this IP with your DNS server) Default server: 192.168.1.1 Address: 192.168.1.1#53 > 247.47.246.41.bl.spamcop.net Server: 192.168.1.1 Address: 192.168.1.1#53 Non-authoritative answer: Name: 49.201.79.189.bl.spamcop.net Address: 127.0.0.2 > ------------- Roberto Franceschetti http://www.logsat.com" rel="nofollow - LogSat Software http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP |
Posted By: lyndonje
Date Posted: 11 March 2010 at 5:14am
|
Hi Rob, When I do manual DNS lookups, generally speaking they do not time out. I wonder.... could it be anything to do with the black lists I'm using? For example, if they're no longer in service, may this effect things or report timeouts?
|
Posted By: lyndonje
Date Posted: 11 March 2010 at 5:30am
Sorry, Roberto 
|
Posted By: LogSat
Date Posted: 11 March 2010 at 4:33pm
...you know what, I had never thought about that either! We're even ------------- Roberto Franceschetti http://www.logsat.com" rel="nofollow - LogSat Software http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP |
Posted By: yapadu
Date Posted: 11 March 2010 at 8:19pm
|
When spamfilter is checking a blacklist (like spamcop or something) it still processes the request through our local DNS server correct? Or does spamfilter go direct to the blacklist provider? I attempted to run an instance on Amazon Cloud, and found requests to many of the 3rd party blacklists were rejected automatically from the Amazon Cloud address space. |
Posted By: LogSat
Date Posted: 12 March 2010 at 10:06pm
|
SpamFilter will always use the DNS servers specified in its configuration for its queries. The DNS server being queried will then take care of contacting the proper DNS server(s) responsible for the lookup and will provide the reply to SpamFilter (unless your DNS server already has the response in its cache). ------------- Roberto Franceschetti http://www.logsat.com" rel="nofollow - LogSat Software http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP |
Posted By: dotme
Date Posted: 25 March 2010 at 6:17pm
|
I'm seeing the same issue. To fix another error we were seeing (557 Exceptions) I upgraded to 4.1.3.822 from 4.0.0.785
After the upgrade, getting tons of DNS timeouts. DNS servers are very responsive to NSLOOKUPS and I have even aimed monitoring at them. All is well.
The real issue for me is that these timeouts, when an incoming message (legit) is loaded with URLs (constantcontact... for example), there are some unfortunate side effects.
The SURBL checks take so long that although the message eventually passes all tests, the sending server gives up waiting and re-queues the email.
Result? Some users report receiving the same email over and over again. I have to whitelist the sender in those cases, so we bypass checks and the repeat deliveries stop. But that's not a long term solution. It does seem like either something is less tolerant of delays with the new build, or one of the blacklist servers is suddenly very slow to respond (or maybe throttling?).
Here's a logfile if it helps... as you can see, the whole "check" process exceeds 5 minutes. That's a long time. No wonder the sending server re-queues the message.
@lyndonje - Any chance you can check your logs to see if it's the same "Checking URLs in emails against MAPS" area that's creating the issue for you?
If it is, and we nail this down as the cause, what's the best next move? Thanks everyone.
03/24/10 10:42:41:539 -- (2028) Detected TCP Connection: 207.97.245.xxx
03/24/10 10:42:41:554 -- (2028) Connection from: 207.97.245.xxx - Originating country : United States 03/24/10 10:42:41:711 -- (2028) Received MAIL FROM: < mailto:jim@source.com - jim@source.com > 03/24/10 10:42:41:742 -- (2028) Received RCPT TO: mailto:srose@dest.com - srose@dest.com 03/24/10 10:42:41:757 -- (2028) Resolving 207.97.245.xxx - smtp156.iad.source.com 03/24/10 10:42:41:929 -- (2028) - SPF analysis for source.com done: - none 03/24/10 10:42:41:929 -- (2028) Mail from: mailto:jim@source.com - jim@source.com 03/24/10 10:42:49:117 -- (2028) DNS Error:TimedOut 03/24/10 10:42:49:117 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.168 03/24/10 10:43:01:101 -- (2028) - MAPS search done... 03/24/10 10:43:01:101 -- (2028) RCPT TO: mailto:srose@dest.com - srose@dest.com accepted 03/24/10 10:43:01:601 -- (2028) Checking SFDC 03/24/10 10:43:01:773 -- (2028) Hash cache - Added OK 03/24/10 10:43:01:773 -- (2028) Checking SURBL 03/24/10 10:43:11:101 -- (2028) Checking URLs in emails against MAPS 03/24/10 10:43:11:117 -- (2028) Resolving for URLsInMAPS: http://www.buffalo1.com - www.buffalo1.com 03/24/10 10:43:18:117 -- (2028) DNS Error:TimedOut 03/24/10 10:43:18:117 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.168 03/24/10 10:43:26:086 -- (2028) Resolving for URLsInMAPS: http://www.xxxxx.com - www.xxxxx.com 03/24/10 10:43:33:117 -- (2028) DNS Error:TimedOut 03/24/10 10:43:33:117 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.168 03/24/10 10:43:41:101 -- (2028) Resolving for URLsInMAPS: campaign.constantcontact.com 03/24/10 10:43:52:132 -- (2028) DNS Error:TimedOut 03/24/10 10:43:52:132 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.168 03/24/10 10:44:13:148 -- (2028) Resolving for URLsInMAPS: img.constantcontact.com 03/24/10 10:44:23:116 -- (2028) DNS Error:TimedOut 03/24/10 10:44:23:116 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.169 03/24/10 10:44:31:101 -- (2028) Resolving for URLsInMAPS: r20.rs6.net 03/24/10 10:44:40:132 -- (2028) DNS Error:TimedOut 03/24/10 10:44:40:132 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.168 03/24/10 10:44:56:101 -- (2028) Resolving for URLsInMAPS: ih.constantcontact.com 03/24/10 10:45:03:085 -- (2028) DNS Error:TimedOut 03/24/10 10:45:03:085 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.168 03/24/10 10:45:05:101 -- (2028) Resolving for URLsInMAPS: http://www.youtube.com - www.youtube.com 03/24/10 10:45:12:163 -- (2028) DNS Error:TimedOut 03/24/10 10:45:12:163 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.169 03/24/10 10:45:24:116 -- (2028) Resolving for URLsInMAPS: http://www.cartridgesareus.com - www.cartridgesareus.com 03/24/10 10:45:32:148 -- (2028) DNS Error:TimedOut 03/24/10 10:45:32:148 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.168 03/24/10 10:45:44:116 -- (2028) Resolving for URLsInMAPS: ui.constantcontact.com 03/24/10 10:45:58:148 -- (2028) DNS Error:TimedOut 03/24/10 10:45:58:148 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.169 03/24/10 10:46:19:163 -- (2028) Resolving for URLsInMAPS: visitor.constantcontact.com 03/24/10 10:46:27:148 -- (2028) DNS Error:TimedOut 03/24/10 10:46:27:148 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.169 03/24/10 10:46:41:132 -- (2028) Resolving for URLsInMAPS: franchise.constantcontact.com 03/24/10 10:46:52:116 -- (2028) DNS Error:TimedOut 03/24/10 10:46:52:116 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.168 03/24/10 10:47:08:085 -- (2028) Resolving for URLsInMAPS: http://www.w3.org - www.w3.org 03/24/10 10:47:13:101 -- (2028) DNS Error:TimedOut 03/24/10 10:47:13:101 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.168 03/24/10 10:47:15:148 -- (2028) - URLs In MAPS search done... 03/24/10 10:47:15:148 -- (2028) Start virus scan 03/24/10 10:47:15:257 -- (2028) Starting queueing procedures 03/24/10 10:47:15:273 -- (2028) EMail from mailto:jim@source.com - jim@source.com to mailto:srose@dest.com - srose@dest.com was queued. Size: 155 KB, 158720 bytes 03/24/10 10:47:15:273 -- (2028) Disconnect 03/24/10 10:47:15:273 -- (788) Sending email from mailto:jim@source.com - jim@source.com to mailto:srose@dest.com - srose@dest.com -- 03/24/10 10:47:15:444 -- (788) EMail from mailto:jim@source.com - jim@source.com to mailto:srose@dest.com - srose@dest.com -- was forwarded to 10.10.10.166:25 |
Posted By: lyndonje
Date Posted: 30 March 2010 at 6:51am
|
Sorry for the delay, I'm running version 4.1.2.812. Below are a few examples from my log: 03/30/10 02:06:49:151 -- (6720) Connection from: 91.194.249.192 - Originating country : Austria 03/30/10 02:06:49:323 -- (6720) Received MAIL FROM: <xxx> 03/30/10 02:06:49:401 -- (6720) Received RCPT TO: xxx 03/30/10 02:06:49:463 -- (6720) Resolving 91.194.249.192 - xxx 03/30/10 02:06:49:713 -- (6720) found SPF record for xxx: v=spf1 redirect=xxx 03/30/10 02:06:49:713 -- (6720) found SPF record for xxx: v=spf1 a mx ip4:91.194.248.0/23 ip4:91.211.240.0/24 ip4:91.211.242.0/24 ip4:81.223.46.0/27 ~all 03/30/10 02:06:49:729 -- (6720) SPF query result: pass 03/30/10 02:06:49:729 -- (6720) - SPF analysis for xxx done: - pass 03/30/10 02:06:49:729 -- (6720) SPF query result: pass 03/30/10 02:06:49:729 -- (6720) - SPF analysis for xxx done: - pass 03/30/10 02:06:49:729 -- (6720) Mail from: xxx 03/30/10 02:06:54:869 -- (6720) DNS Error:TimedOut 03/30/10 02:06:54:869 -- (6720) DNS Server will rotate after query. New server will be d.c.b.a 03/30/10 02:06:58:479 -- (6720) - MAPS search done... 03/30/10 02:06:58:479 -- (6720) RCPT TO: xxx accepted 03/30/10 02:06:58:807 -- (6720) Checking SFDC 03/30/10 02:06:59:041 -- (6720) Hash cache - Added OK 03/30/10 02:06:59:135 -- (6720) EMail from xxx to xxx passes Bayesian filter - 0% spam (78ms) 03/30/10 02:06:59:135 -- (6720) Checking SURBL 03/30/10 02:07:04:182 -- (6720) DNS Error:TimedOut 03/30/10 02:07:04:182 -- (6720) DNS Server will rotate after query. New server will be a.b.c.d 03/30/10 02:07:09:822 -- (6720) DNS Error:TimedOut 03/30/10 02:07:09:822 -- (6720) DNS Server will rotate after query. New server will be d.c.b.a 03/30/10 02:07:09:869 -- (6720) Checking URLs in emails against MAPS 03/30/10 02:07:09:869 -- (6720) Resolving for URLsInMAPS: rover.ebay.com 03/30/10 02:07:15:151 -- (6720) DNS Error:TimedOut 03/30/10 02:07:15:151 -- (6720) DNS Server will rotate after query. New server will be a.b.c.d 03/30/10 02:07:20:291 -- (6720) DNS Error:TimedOut 03/30/10 02:07:20:291 -- (6720) DNS Server will rotate after query. New server will be d.c.b.a 03/30/10 02:07:20:354 -- (6720) Resolving for URLsInMAPS: www.w3.org 03/30/10 02:07:25:494 -- (6720) DNS Error:TimedOut 03/30/10 02:07:25:494 -- (6720) DNS Server will rotate after query. New server will be a.b.c.d 03/30/10 02:07:30:604 -- (6720) DNS Error:TimedOut 03/30/10 02:07:30:604 -- (6720) DNS Server will rotate after query. New server will be d.c.b.a 03/30/10 02:07:30:635 -- (6720) Resolving for URLsInMAPS: mail.ebay.co.uk 03/30/10 02:07:36:088 -- (6720) DNS Error:TimedOut 03/30/10 02:07:36:088 -- (6720) DNS Server will rotate after query. New server will be a.b.c.d 03/30/10 02:07:41:197 -- (6720) DNS Error:TimedOut 03/30/10 02:07:41:197 -- (6720) DNS Server will rotate after query. New server will be d.c.b.a 03/30/10 02:07:41:275 -- (6720) Resolving for URLsInMAPS: pics.ebaystatic.com 03/30/10 02:07:46:603 -- (6720) DNS Error:TimedOut 03/30/10 02:07:46:603 -- (6720) DNS Server will rotate after query. New server will be a.b.c.d 03/30/10 02:07:51:713 -- (6720) DNS Error:TimedOut 03/30/10 02:07:51:713 -- (6720) DNS Server will rotate after query. New server will be d.c.b.a 03/30/10 02:07:51:775 -- (6720) Resolving for URLsInMAPS: pics.ebaystatic..com 03/30/10 02:07:51:822 -- (6720) Error occurred during URLsInMAPS: DNS Server Reports Query Not Implemented Error 03/30/10 02:07:51:822 -- (6720) - URLs In MAPS search done... 03/30/10 02:07:51:822 -- (6720) Start virus scan 03/30/10 02:07:51:916 -- (6720) Starting queueing procedures 03/30/10 02:07:51:932 -- (6720) EMail from xxx to xxx was queued. Size: 34 KB, 34816 bytes 03/30/10 02:07:51:932 -- (6720) Starting bayesian procedures 03/30/10 02:07:52:041 -- (6720) Disconnect 03/30/10 02:09:26:431 -- (8236) Connection from: 78.129.153.65 - Originating country : United Kingdom 03/30/10 02:09:26:525 -- (8236) Received MAIL FROM: <xxx> SIZE=34487 03/30/10 02:09:26:556 -- (8236) Received RCPT TO: xxx 03/30/10 02:09:26:572 -- (8236) Resolving 78.129.153.65 - xxx 03/30/10 02:09:26:806 -- (8236) - SPF analysis for xxx done: - none 03/30/10 02:09:26:806 -- (8236) Mail from: xxx 03/30/10 02:09:31:915 -- (8236) DNS Error:TimedOut 03/30/10 02:09:31:915 -- (8236) DNS Server will rotate after query. New server will be d.c.b.a 03/30/10 02:09:35:540 -- (8236) - MAPS search done... 03/30/10 02:09:35:540 -- (8236) RCPT TO: xxx accepted 03/30/10 02:09:35:540 -- (8236) Bypassed all rules for: xxx from xxx ( AutoWhiteList Force Delivery) 03/30/10 02:09:35:743 -- (8236) Bypassed all rules for: xxx from xxx 03/30/10 02:09:35:822 -- (8236) Start virus scan 03/30/10 02:09:35:978 -- (8236) Starting queueing procedures 03/30/10 02:09:35:978 -- (8236) EMail from xxx to xxx was queued. Size: 31 KB, 31744 bytes 03/30/10 02:09:35:993 -- (8236) Starting bayesian procedures 03/30/10 02:09:36:072 -- (8236) Disconnect 03/30/10 02:10:04:431 -- (9812) Connection from: 91.186.15.206 - Originating country : United Kingdom 03/30/10 02:10:04:728 -- (9812) Received MAIL FROM: <xxx> SIZE=1349 03/30/10 02:10:04:759 -- (9812) Received RCPT TO: xxx 03/30/10 02:10:04:946 -- (9812) Resolving 91.186.15.206 - xxx 03/30/10 02:10:05:290 -- (9812) - SPF analysis for xxx done: - none 03/30/10 02:10:05:290 -- (9812) Mail from: xxx 03/30/10 02:10:10:431 -- (9812) DNS Error:TimedOut 03/30/10 02:10:10:431 -- (9812) DNS Server will rotate after query. New server will be a.b.c.d 03/30/10 02:10:15:524 -- (9812) DNS Error:TimedOut 03/30/10 02:10:15:524 -- (9812) DNS Server will rotate after query. New server will be d.c.b.a 03/30/10 02:10:15:587 -- (9812) - MAPS search done... 03/30/10 02:10:15:587 -- (9812) RCPT TO: xxx accepted 03/30/10 02:10:15:884 -- (9812) Checking SFDC 03/30/10 02:10:16:259 -- (9812) Hash cache - Added OK 03/30/10 02:10:16:259 -- (9812) EMail from xxx to xxx passes Bayesian filter - 0% spam (0ms) 03/30/10 02:10:16:259 -- (9812) Checking SURBL 03/30/10 02:10:16:259 -- (9812) Checking URLs in emails against MAPS 03/30/10 02:10:16:259 -- (9812) - URLs In MAPS search done... 03/30/10 02:10:16:259 -- (9812) Start virus scan 03/30/10 02:10:16:274 -- (9812) Starting queueing procedures 03/30/10 02:10:16:274 -- (9812) EMail from xxx to xxx was queued. Size: 1 KB, 1024 bytes 03/30/10 02:10:16:274 -- (9812) Starting bayesian procedures 03/30/10 02:10:16:368 -- (9812) Disconnect |
Posted By: LogSat
Date Posted: 30 March 2010 at 10:04pm
|
lyndonje, Can you please try, *from the server running spamfilter*, to issue the set of DNS lookups I mentioned above: c:\>nslookup > server 192.168.1.1 (replace this IP with your DNS server) Default server: 192.168.1.1 Address: 192.168.1.1#53 > 247.47.246.41.bl.spamcop.net Server: 192.168.1.1 Address: 192.168.1.1#53 Non-authoritative answer: Name: 49.201.79.189.bl.spamcop.net Address: 127.0.0.2 > and re-running the query each time replacing the MAPS server name with all of the MAPS servers you have in your list? For exmaple: 247.47.246.41.bl.spamcop.net 247.47.246.41.cbl.abuseat.org etc etc? It's possible that one of those MAPS server is timing out (we see for example an issue with "xbl.spamhaus.org"), which would cause those errors to be logged. ------------- Roberto Franceschetti http://www.logsat.com" rel="nofollow - LogSat Software http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP |