Issue not receiving some emails from hotmail (ms emails basically)

[jorge ceballos]

Server operating system version

centos 7

Plesk version and microupdate number

Plesk Obsidian 18.0.52 update 3

Hi,
Only some emails - from microsoft most of them AFAIK - are not getting to the server, not even shown in the maillog.
Most emails are getting through without problem.

One of those not delivered, shows the following info:

5/21/2023 3:11:19 PM - Server at PH0PR11MB4903.namprd11.prod.outlook.com returned '550 5.4.312 Message expired, DNS query failed(ServerFailure)'
5/21/2023 3:01:07 PM - Server at DOMAIN.COM (0.0.0.0) returned '450 4.4.312 DNS query failed [Message=ServerFailure] [LastAttemptedServerName=DOMAIN.COM] [DM6NAM11FT109.eop-nam11.prod.protection.outlook.com 2023-05-21T15:01:19.818Z 08DB5A05047CFB98](ServerFailure)'

This happens to several of our hosted domains, all of which pass all the dns tests at toolbox and nslookup.io/dns-checker/

Last week these TLS were enabled :
plesk sbin sslmng --services postfix --protocols 'TLSv1 TLSv1.1 TLSv1.2 TLSv1.3'

and to have them enable had to run:
plesk sbin pci_compliance_resolver --disable postfix

Would this have to do anything with this problem?

TIA

 

[zed2007]

I also had trouble sending mail via outlook.com yesterday. It's not exactly the same error. But something similar.

Final-Recipient: rfc822; [email protected]
> Original-Recipient: rfc822;[email protected]
> Action: failed
> Status: 5.7.1
> Remote-MTA: dns; eur.olc.protection.outlook.com
> Diagnostic-Code: smtp; 550 5.7.1 Unfortunately, messages from [89.22.107.237]
> weren't sent. Please contact your Internet service provider since part of
> their network is on our block list (S3150). You can also refer your
> provider to Troubleshooting.
> [HE1EUR01FT034.eop-EUR01.prod.protection.outlook.com
> 2023-05-22T10:33:27.546Z 08DB5A87949F837D]

Can someone suggest what could be the reason?

 

[Kaspar]

Can someone suggest what could be the reason?

The reason is clearly stated in the response/error message. I've marked it red for you in the quote bellow.

I also had trouble sending mail via outlook.com yesterday. It's not exactly the same error. But something similar.

Final-Recipient: rfc822; [email protected]
> Original-Recipient: rfc822;[email protected]
> Action: failed
> Status: 5.7.1
> Remote-MTA: dns; eur.olc.protection.outlook.com
> Diagnostic-Code: smtp; 550 5.7.1 Unfortunately, messages from [89.22.107.237]
> weren't sent. Please contact your Internet service provider since part of
> their network is on our block list (S3150). You can also refer your
> provider to Troubleshooting.
> [HE1EUR01FT034.eop-EUR01.prod.protection.outlook.com
> 2023-05-22T10:33:27.546Z 08DB5A87949F837D]

 

[Kaspar]

5/21/2023 3:11:19 PM - Server at PH0PR11MB4903.namprd11.prod.outlook.com returned '550 5.4.312 Message expired, DNS query failed(ServerFailure)'
5/21/2023 3:01:07 PM - Server at DOMAIN.COM (0.0.0.0) returned '450 4.4.312 DNS query failed [Message=ServerFailure] [LastAttemptedServerName=DOMAIN.COM] [DM6NAM11FT109.eop-nam11.prod.protection.outlook.com 2023-05-21T15:01:19.818Z 08DB5A05047CFB98](ServerFailure)'

@jorge ceballos these log entries look like they belong to an outbound message (i.e an email being send from your server to a MS server)? After Googling a bit it seems like the error seems to occur when the receiving mailserver cannot query any DNS records from the sender.

See:

ERROR: 550 5.4.312 Message expired, DNS query failed(ServerFailure)

documentation.n-able.com

Redirecting

In this topic it's suggested that the issue occurs when the MX record of a domain is pointing to an CNAME record, when it should point to an A (and/or AAAA) record.

 

[jorge ceballos]

Thanks Kaspar,

These are emails sent from hotmail to our server.
The awkward thing is that most emails from hotmail come through, but we are certain some others -from hotmail too - bounce stating "DNS query failed"
All our records have been tested and re-tested in all the DNS testing sites we could find and I have come to think that the dns resolution table from some hotmail (microsoft ) email servers is not working properly.
We dont have any problem with Gmail or any other email provider.
The MX records point to a domain and A records to IP; no CNAMES are used. (When I started in this business 2 decades ago, read that CNAMES were evil so, we have neve use them, except when its mandatory for using services like AWS' SES)
I'm lost on this.

TIA

 

[jorge ceballos]

Hi again,

Just found out during a failed Let's Encrypt renewal that the certificate keeps looking for AAAA record - which my server have never used- and coincidentally noticed that it shows DNS badge in red stating "the domain is not resolving" . This are the same domains which Hotmail wont found when trying to deliver email.
I made sure no AAAA records are in the DNS panel for these domains (in order to renew the certificate ) but it keeps looking for them.
Apart from these 5 domains, the rest show a normal DNS badge and SSL renewals are done flawlessly.

Please any idea?
How can I clear manually the DNS records for these domains and leave only A and MX?
And then restart DNS - ( is it bind ? )

TIA