That sounds like a veiled admission their outbound mail servers occasionally can't handle the load...
-sc -----Original Message----- From: John Hornbuckle [mailto:[email protected]] Sent: Monday, June 08, 2009 12:11 PM To: MS-Exchange Admin Issues Subject: RE: Exchange 2007 & Postini Okay, we got it fixed. The DNS traffic was, indeed, going out the NAT'd address, and that address wasn't allowed to resolve hosts on Postini's server. Once I fixed that, I was able to point Exchange at Postini and mail was flowing. If this message makes it to the list, it must be working. :-) As to private DNS vs. smart host, here's what the Postini docs say: "Private Outbound DNS Service provides a simple, reliable way to route outbound mail to the message security service. It is an alternative to using a smarthost to route outbound mail. Using a smarthost can cause queued messages and mail delays for many mail servers, especially Microsoft Exchange mail servers. Private Outbound DNS Service is designed to ease setup and prevent queueing delays, and is recommended for any administrator using a supported mail server." I'm not an expert on this kind of thing, so I went with their judgment on this. Using a smarthost *sounded* easier to me, but I figured I must've been missing something. -----Original Message----- From: Ben Scott [mailto:[email protected]] Sent: Monday, June 08, 2009 11:41 AM To: MS-Exchange Admin Issues Subject: Re: Exchange 2007 & Postini On Mon, Jun 8, 2009 at 10:09 AM, John Hornbuckle<[email protected]> wrote: > Well, they give you both options--smart host and private DNS--and then give you > several reasons why they believe private DNS is better. I can't think of any reason why that would be a good thing (other than "Postini assumes all mail server admins are idiots and can't figure out how to use a smarthost"), and I can think of a few reasons why it's not a good idea: * Configuration headaches like the one you're in the middle of. * Should your mail server get configured with the "wrong" DNS server, or otherwise "see" the "real" DNS namespace, mail will go the wrong way. * It means your mail server is now seeing different DNS answers than the rest of universe. Who knows what that might complicate down the road? Diagnostics. * You're dependent on Postini's DNS servers. If they glitch, it's your problem. Maybe they know something I don't. > So now I'm wondering... I know which NIC/IP is used for sending mail, > but I can't say for sure which NIC/IP Exchange uses for DNS resolution > when looking to a private DNS server... I would guess it's going to use whatever the routing tables say to use, and yours say to prefer the inside network. You could reconfigure your mail server's routing tables, with a single default route via whatever is next-hop from your "public" NIC. If you have multiple IP networks on the "private" side, you'll need specific static routes for those, via next-hop gateways on the "private" NIC. (This would now be one more reason not to use Postini's DNS servers -- your network connectivity is more complicated/fragile.) -- Ben ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja ~ ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja ~ ~ Ninja Email Security with Cloudmark Spam Engine Gets Image Spam ~ ~ http://www.sunbeltsoftware.com/Ninja ~
