topic Re: SMTP mail and "unreachable" node in Operating System - OpenVMS

SMTP mail and "unreachable" node

Bill Pedersen — Tue, 22 Dec 2009 17:29:47 GMT

I have an issue with mail to some nodes. I get a failure that they are "unreachable", for instance:

%TCPIP-E-SMTP_UNREACHABL, cannot connect to remote host, ingres.com -SYSTEM-F-UNREACHABLE, remote node is not currently reachable

I can ping the node.

But when I traceroute the node it goes for 15 hops and then times out:

traceroute to ingres.com (98.129.177.130): 1-30 hops, 38 byte packets
1 213.173.170.9 (213.173.170.9) 0.0 ms 0.0 ms 0.0 ms
2 atm6-0-1115.ar3.gva.ch.colt.net (212.23.238.121) 10.0 ms 10.0 ms 0.0 ms
3 ge3-0-0-pr2.FRA.router.colt.net (212.74.76.191) 20.0 ms (ttl=248!) 20.0 ms
(ttl=248!) 10.0 ms (ttl=248!)
4 xe-1-2-0.mpr1.fra4.de.above.net (80.81.194.26) 10.0 ms (ttl=246!) 20.0 ms
(ttl=246!) 10.0 ms (ttl=246!)
5 xe-1-1-0.mpr1.cdg12.fr.above.net (64.125.24.6) 50.0 ms (ttl=246!) 30.0 ms
(ttl=246!) 30.0 ms (ttl=246!)
6 * xe-0-0-0.mpr1.cdg11.fr.above.net (64.125.31.225) 20.0 ms (ttl=245!) 30.0
ms (ttl=245!)
7 xe-3-1-0.mpr1.lhr2.uk.above.net (64.125.24.1) 30.0 ms 40.0 ms 30.0 ms
8 so-0-1-0.mpr1.dca2.us.above.net (64.125.27.57) 110 ms (ttl=249!) 120 ms (t
tl=249!) 110 ms (ttl=249!)
9 ge-2-0-0.mpr3.iah1.us.above.net (64.125.25.114) 130 ms (ttl=249!) 160 ms (
ttl=249!) 130 ms (ttl=249!)
10 xe-0-3-0.cr1.iah1.us.above.net (64.125.30.101) 130 ms (ttl=249!) 130 ms (t
tl=249!) 130 ms (ttl=249!)
11 xe-0-1-0.er1.iah1.us.above.net (64.125.28.5) 140 ms (ttl=246!) 140 ms (ttl
=246!) 150 ms (ttl=246!)
12 xe-7-0-0.er1.dfw2.us.above.net (64.125.30.58) 150 ms (ttl=243!) 150 ms (tt
l=243!) 150 ms (ttl=243!)
13 main1.above.net (209.133.126.42) 140 ms 150 ms 150 ms
14 vlan905.core5.dfw1.rackspace.com (67.192.56.229) 150 ms 150 ms 140 ms
15 67.192.56.31 (67.192.56.31) 150 ms 160 ms 150 ms
16 * * *
17 * * *
18 * * *
19 * * *
20 * * *
21 * * *
22 * * *
23 * * *
24 * * *
25 * * *
26 * * *
27 * * *
28 * * *
29 * * *
30 * * *
TCPIP>

SHOW HOST (nslookup) works fine:

TCPIP> show host ingres.com

BIND database

Server: 81.23.73.120

Host address Host name

98.129.177.130 INGRES.COM
TCPIP>

This is on the following configuration:

HP TCP/IP Services for OpenVMS Alpha Version V5.6
on an AlphaServer ES40 running OpenVMS V8.3

Thoughts?

I get this for more than one site. And have gotten it off and on for some time. Is there a logical that needs to be set regarding name translation or something for SMTP?

Thanks,

Bill.

Re: SMTP mail and "unreachable" node

Jim_McKinney — Tue, 22 Dec 2009 18:49:20 GMT

> Thoughts?

If HP's SMTP is well behaved it would not be attempting to communicate with the address associated with ingres.com. ingres.com has DNS MX records registered and any SMTP mail should be directed to them. You might want to see if they are reachable. (You may also discover that other SMTP targets that you are having issues with also have MX registration.)

A$ mu nsl/typ=mx ingres.com
Server: LOCALHOST
Address: 127.0.0.1

Non-authoritative answer:
INGRES.COM preference = 10, mail exchanger = proofpoint1.invision.net
INGRES.COM preference = 10, mail exchanger = proofpoint2.invision.net

Authoritative answers can be found from:
INGRES.COM nameserver = pdns4.ultradns.org
INGRES.COM nameserver = pdns1.ultradns.net
INGRES.COM nameserver = pdns5.ultradns.info
INGRES.COM nameserver = pdns3.ultradns.org
INGRES.COM nameserver = pdns6.ultradns.co.uk
INGRES.COM nameserver = pdns2.ultradns.net
pdns4.ultradns.org internet address = 199.7.69.1
pdns4.ultradns.org IPv6 address = 2001:0502:4612::0001
pdns5.ultradns.info internet address = 204.74.114.1
pdns6.ultradns.co.uk internet address = 204.74.115.1
pdns1.ultradns.net internet address = 204.74.108.1
pdns1.ultradns.net IPv6 address = 2001:0502:f3ff::0001
pdns2.ultradns.net internet address = 204.74.109.1
pdns3.ultradns.org internet address = 199.7.68.1
A$ mu nsl proofpoint1.invision.net
Server: LOCALHOST
Address: 127.0.0.1

Non-authoritative answer:
Name: PROOFPOINT1.INVISION.NET
Address: 69.18.136.194

A$ mu nsl proofpoint2.invision.net
Server: LOCALHOST
Address: 127.0.0.1

Non-authoritative answer:
Name: PROOFPOINT2.INVISION.NET
Address: 69.18.136.195

A$

Re: SMTP mail and "unreachable" node

Robert Gezelter — Tue, 22 Dec 2009 21:15:14 GMT

Bill,

Please also note that there is no guarantee that ICMP (PING) and SMTP (mail) go to the same actual machine. Many traffic management devices to differential routing based on port number in addition to IP address.

One good step is to use a telnet session to see what comes back when you connect to the SMTP port.

- Bob Gezelter, http://www.rlgsc.com

Re: SMTP mail and "unreachable" node

Hoff — Tue, 22 Dec 2009 22:43:58 GMT

If you are working from an OpenVMS host or cluster at 213.173.170.9, then your local DNS looks to be misconfigured, and that'll definitely get your SMTP flagged either for graylisting or blocked as spam.

Re: SMTP mail and "unreachable" node

Bill Pedersen — Wed, 23 Dec 2009 00:25:00 GMT

Ok, yes, A and MX records can be different the issue I see though is that the traceroute works from my laptop, located on an entirely different network and location while it does not from the OpenVMS system which I keep having issues with.

Hoff: You bring up the issue of mis-configuration.

Here is the config information:

TCPIP> sho name

BIND Resolver Parameters

Local domain: stromasys.com

System

State: Started, Enabled

Transport: UDP
Domain: stromasys.com
Retry: 2
Timeout: 5
Servers: 81.23.73.120, 81.23.73.90
Path: No values defined

Process

State: Enabled

Transport:
Domain:
Retry:
Timeout:
Servers:
Path:
TCPIP>

Other than servers am not sure what can be done here...

Enter configuration option: 4

BIND RESOLVER Configuration

A BIND resolver has already been configured.

BIND Resolver Configuration

Transport: UDP
Domain: stromasys.com
Retry: 2
Timeout: 5
Servers: ns1.Cybernetwork.CH, ns2.Cybernetwork.CH
Path: No values defined

* Do you want to reconfigure BIND [NO]:

The SHOW MX_RECORD gives:

TCPIP> sho mx ingres.com

BIND MX database

Server: 81.23.73.120

Gate address Preference Gate name

69.18.136.194 10 proofpoint1.invision.net
69.18.136.195 10 proofpoint2.invision.net

BIND database

Server: 81.23.73.120

Host address Host name

98.129.177.130 INGRES.COM

So, now where?

Bill.

Re: SMTP mail and "unreachable" node

Bill Pedersen — Wed, 23 Dec 2009 00:30:05 GMT

On the issue of MX records... I really do not see where this is taking us since my own domain is defined by MX records and I have no issue sending mail to myself from this remote system.

The MX information for my domain is below:

TCPIP> sho mx ccsscorp.com

BIND MX database

Server: 81.23.73.120

Gate address Preference Gate name

207.111.237.9 5 mx2005.mx2.got.net
207.111.237.8 5 mx2004.mx2.got.net
209.66.101.141 5 mx2003.mx2.got.net
209.66.101.140 5 mx2002.mx2.got.net
209.66.101.139 5 mx2001.mx2.got.net
207.111.237.10 5 mx2006.mx2.got.net

BIND database

Server: 81.23.73.120

Host address Host name

207.111.217.162 CCSSCORP.COM

This is in contrast to the MX information for ingres.com...

Now, if there is an issue of graylisting then I need to understand how to get around that...

The number of sites which do not get email from this site is probably 5% or less of the total number I send to as people sign up but I would like to think it should be near zero if they provide valid mail addresses.

Thanks,

Bill.

Thanks,

Bill.

Re: SMTP mail and "unreachable" node

Jim_McKinney — Wed, 23 Dec 2009 00:42:59 GMT

If a DNS MX record for a particular host name exists, then any mail for that host name should be delivered to the host specified by the associated MX record(s)(and not the host specified by the A(ddress) resource record). In the absence of MX records SMTP mail will be directed to the host specified by the A record. SMTP mail from your host to ingres.com will be sent to one of the hosts specified by the associated MX records (and not that address you were PINGing) presuming that HP's SMTP client software plays by the rules. In practice many clients ignore the MX records and always target the A records. For this reason most enterprises have assigned an IP address to their domain name rather than risk losing mail from braindead clients. I would expect that HP's SMTP client is doing the correct thing and targeting the MX records (you could verify this by using TCPDUMP).

Re: SMTP mail and "unreachable" node

Bill Pedersen — Wed, 23 Dec 2009 00:48:03 GMT

Hoff:

The 213.173.170.9 address is the gateway. I believe it is a router but I do not have the details, since I did not install the net.

The OpenVMS system is at 213.173.170.13.

Bill.

Re: SMTP mail and "unreachable" node

Hoff — Wed, 23 Dec 2009 02:27:09 GMT

213.173.170.13 within your DNS environment looks to be misconfigured. No valid rDNS response to dig.

Some of the more permissive SMTP servers around will accept that, but many of the servers will detect this and the message will get grey-listed, or will be flagged as spam and dropped.

The MX entry is the routing path from the client to the server.

The rDNS setting and associated detection is the reverse; the view from the SMTP server back to the originating mail server.

Re: SMTP mail and "unreachable" node

Bill Pedersen — Wed, 23 Dec 2009 03:50:47 GMT

Yes, I expect the SMTP is in fact looking at the MX records.

Ok, rDNS. So how does one set this? What settings are necessary or capable withing TCPIP, or do we need a DNS entry someplace which gives this information.

When I do nslookup for 213.173.170.13 and charon.stromasys.com I get:

C:\Documents and Settings\wpederse>nslookup 213.173.170.13
*** Can't find server name for address 192.168.1.1: Query refused
*** Default servers are not available
Server: UnKnown
Address: 192.168.1.1

Name: charon.stromasys.com
Address: 213.173.170.13

C:\Documents and Settings\wpederse>nslookup charon.stromasys.com
*** Can't find server name for address 192.168.1.1: Query refused
*** Default servers are not available
Server: UnKnown
Address: 192.168.1.1

Non-authoritative answer:
Name: charon.stromasys.com
Address: 213.173.170.13

So what more do we need to do?

Thanks,

Bill.

Re: SMTP mail and "unreachable" node

Bill Pedersen — Wed, 23 Dec 2009 04:28:11 GMT

Ok, given my investigation of rDNS then using nslookup and PTR records I get:

$ multi nslookup charon.stromasys.com/type=ptr
Server: LOCALHOST
Address: 127.0.0.1

Authoritative answers can be found from:
STROMASYS.COM
origin = ns1.register.eu
mail addr = info.register.eu
serial = 2009102202
refresh = 7200 (2H)
retry = 3600 (1H)
expire = 86400 (1D)
minimum ttl = 3600 (1H)
$ multi nslookup ccsscorp.com/type=ptr
Server: LOCALHOST
Address: 127.0.0.1

Authoritative answers can be found from:
CCSSCORP.COM
origin = ns1.got.net
mail addr = dns-admin.got.net
serial = 2009030601
refresh = 10800 (3H)
retry = 3600 (1H)
expire = 604800 (1W)
minimum ttl = 86400 (1D)
$ multi nslookup charon.stromasys.com info.register.eu
*** Can't find server address for 'INFO.REGISTER.EU':
Unknown host
Server: LOCALHOST
Address: 127.0.0.1

Non-authoritative answer:
Name: CHARON.STROMASYS.COM
Address: 213.173.170.13

So to my untrained eye this looks "ok".

So, now the question is "What is ingres.com seeing when the SMTP connection is established?" Or at least that is what I would suspect might be the consideration.

Bill.

Re: SMTP mail and "unreachable" node

Bill Pedersen — Wed, 23 Dec 2009 04:31:46 GMT

I was so quick since it gave the number I was expecting I missed the error message that it could not find info.register.eu...

So I guess my untrained eye is still lost.

Insight please.

Thanks,

Bill.

Re: SMTP mail and "unreachable" node

Jim_McKinney — Wed, 23 Dec 2009 13:07:02 GMT

> So, now the question is "What is ingres.com seeing when the SMTP connection is established?"

ingres.com shouldn't be receiving a direct connection from your system. Any mail that you send to them should go to one of the hosts defined by the DNS MX records associated with ingres.com (69.18.136.194 -proofpoint1.invision.net or 69.18.136.195 - proofpoint2.invision.net). Your system would send mail to one of them and then they would later relay it on to the system with the addressee's mailbox (perhaps after performing some virus checking or what-have-you). You might try simulating an SMTP session to one or both of these hosts using telnet on port 25 and see what happens. The recipe for that is similar to what follows (your telnet command line might differ slightly - the following presumes MultiNet's telnet CLD)

$ TELNET/PORT=25 proofpoint1.invision.net
helo
mail from:
rcpt to:
data
put all of your
message text here
.
quit

Re: SMTP mail and "unreachable" node

Bill Pedersen — Wed, 23 Dec 2009 13:29:22 GMT

ok, yes, I understand that proofpoint... is doing the email processing for ingres.com. The issue being as far as I can concerned it is ingres.com - in the long run. The same as a normal email recipient at ingres.com would think.

Yes, ok so when I find the time I will test the telnet operation to see what is happening there.

Re: SMTP mail and "unreachable" node

Hoff — Wed, 23 Dec 2009 14:55:30 GMT

SMTP traffic from an SMTP server with invalid rDNS will not be accepted by most modern mail servers.

Re: SMTP mail and "unreachable" node

Jim_McKinney — Wed, 23 Dec 2009 15:06:57 GMT

> SMTP traffic from an SMTP server with invalid rDNS will not be accepted by most modern mail servers.

Yes, this is true for many servers - and if they terminate your connection for this reason they usually say so during the SMTP dialogue - simulate an SMTP conversation or use TCPDUMP to watch one and you'll likely learn if this is the case here. This case is certainly distinct from the "unreachable node" scenario that began this thread.

Re: SMTP mail and "unreachable" node

Bill Pedersen — Wed, 23 Dec 2009 21:03:04 GMT

Using TCPDUMP I end up with an interesting message:

0x0000: 4500 0063 c89f 4000 3006 3465 4512 88c3 E..c..@.0.4eE...
0x0010: d5ad aa0d 0019 c05b ec26 6be1 4661 421e .......[.&k.FaB.
0x0020: 5018 05b4 a38a 0000 3535 3420 7072 6f6f P.......554.proo
0x0030: 6670 6f69 6e74 322e 696e 7669 7369 6f6e fpoint2.invision
0x0040: 2e6e 6574 2045 534d 5450 206e 6f74 2061 .net.ESMTP.not.a
0x0050: 6363 cc

ESMTP not accepting...

I can not believe that HP SMTP would not talk to an Extended SMTP but...

In using telent to port 25...

$ telnet proofpoint1.invision.net 25
%TELNET-I-TRYING, Trying ... 69.18.136.194
%TELNET-I-SESSION, Session 01, host proofpoint1.invision.net, port 25
554 proofpoint1.invision.net ESMTP not accepting messages
HELO charon.stromasys.com
250 proofpoint1.invision.net Hello [213.173.170.13], pleased to meet you

There is a fair pause between when the "...port 25" is printed and then the "554 ..." error message.

It would appear that OpenVMS SMTP does not support, ie does not email, the necessary information to be recognized by the remote system.

And in getting the 554 message then goes and places the message back in the queue when in fact it should continue.

Thoughts?

Thanks,

Bill.

Re: SMTP mail and "unreachable" node

Bill Pedersen — Wed, 23 Dec 2009 21:45:08 GMT

Here is a sample between two different servers:

$ telnet mx2001.mx2.got.net 25
%TELNET-I-TRYING, Trying ... 209.66.101.139
%TELNET-I-SESSION, Session 01, host mx2001.mx2.got.net, port 25
HELO stromasys.comEscape character is ^]
220 mx2001.mx2.got.net ESMTP Wed, 23 Dec 2009 13:13:38 -0800
250 mx2001.mx2.got.net Hello [213.173.170.13], pleased to meet you
TELNET> exit
%TELNET-S-LCLCLOSED, Local connection closed
-TELNET-I-SESSION, Session 01, host mx2001.mx2.got.net, port 25
$ telnet proofpoint1.invision.net 25
%TELNET-I-TRYING, Trying ... 69.18.136.194
%TELNET-I-SESSION, Session 01, host proofpoint1.invision.net, port 25
HELO stromasys.comEscape character is ^]
554 proofpoint1.invision.net ESMTP not accepting messages
250 proofpoint1.invision.net Hello [213.173.170.13], pleased to meet you

Mail through got.net eventually ends up at ccsscorp.com.

In using telnet from my laptop to proofpoint1.invision.net I get a similar 554 message...

If I then go ahead and try to send a message it accepts the HELO but then rejects any following messages.

I suspect that there is more that needs to be passed between the two systems so as to be happy with the connection before proceeding. The what is the big issue now.

Bill.

Re: SMTP mail and "unreachable" node

Hoff — Wed, 23 Dec 2009 22:33:44 GMT

>Yes, this is true for many servers ...

Yes, true, and it's likely also true that if the DNS isn't corrected, then the whole process of resolving the connectivity will be for naught. (OpenVMS with TCP/IP Services is one of the few boxes that doesn't look at this stuff.)

> I can not believe that HP SMTP would not talk to an Extended SMTP but...

Google: "Your search - site:h71000.www7.hp.com esmtp - did not match any documents."

http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=1101097

Re: SMTP mail and "unreachable" node

Bill Pedersen — Thu, 24 Dec 2009 01:32:57 GMT

Ok, Hoff, so what needs to be changed in the DNS. As far as I can tell it is ok at least from my prospective of looking at the records.

If can can provide a pointer as to what needs to be changed I would be happy to make sure the changes are implemented.

Thanks,

Bill.