4.5.1 4.4.0 DNS Query Failed

Question

We are running Exchange 2010 and lately I have noticed that some outgoing messages get stuck in the queue with the error "451 4.4.0 DNS Query Failed". On every domain that this happens on I have been able to use nslookup to find the MX record and open a connection to their server over SMTP so I am reasonably sure that this problem is on my end. My send connector isn't routing mail through a smart host nor is is set to use a different DNS server to do the lookup so I'm stumped as to why these messages aren't going out. Any ideas?

Solution 1

A 4.x.x reply code is a transient code so Exchange will keep trying until the retry interval expires. What you might try is to install a packet capture program on the Exchange server (Microsoft Network Monitor is a good one) and start a capture and let it run for a while. You might set up a capture filter to only capture SMTP and DNS traffic so as to keep the capture overhead low. Once you're running a capture either send an email to a user at one of the problem domains or wait for a currently queued email to retry (or force a retry) and see what shows up in the capture, keying on DNS traffic first to see if things are being resolved correctly or not, and then moving on to look at the SMTP traffic to look for clues as to what's happening.

Solution 2

Exchange 2010 always seems to query a mail server's IPv6 address before it queries the IPv4 address. Assume that a DNS server has an IPv4 address for a domain name but no IPv6 address. When that DNS server receives a request for the domain name's IPv6 address, it should send a success response with zero addresses. If you run nslookup on such a domain like so:

nslookup -type=aaaa mail.foo.com

you should see the response:

*** No IPv6 address (AAAA) records available for mail.foo.com

Exchange appears to treat this response as saying, "I don't have any IPv6 addresses for that domain, but can I interest you in an IPv4 address?"

In at least one case where I was getting the 451 errors you describe, I got a response like this from nslookup:

*** ns.mynameserver.com can't find mail.foo.com: Query refused

If that's what you're seeing, the only real recourse is to contact the domain admin and ask them to change the behavior of their DNS server. They might be filtering out IPv6 queries entirely, which would seem to be a bad idea.

I'd like to recommend that you just tell Exchange 2010 to stop asking for the IPv6 address of mail servers, but despite much Googling I have no idea if that's possible.

Comments

[blokberg]

Possibly a transient issue, or perhaps the Exchange servers gives up waiting for an answer before the recursive query has delivered an answer back. When you later query the same MX record it is already in your DNS server's cache so you get an answer. Does the Exchange server eventually send the mail after a retry? Or does it get permanently stuck?