SMG 10.9.2-6 "domain does not resolve" error occured when send message

[almir0n]

I have a problem with new version of SMG 10.9.2-6.
Sometimes, SMG cannot resolve domain name for recipients domain,on the first or second attempt.
When we try to send a message, the message is not delivered on the first or second try.
In message queue I see error "421 4.4.4 [internal] Domain Does Not Resolve".
On SMG on troubleshooting page, I check dns resolve for affected domains and dns resolving works fine.
On 3rd or next try message delivered successfully.
Sometimes, SMG deliver message on a first attempt for affected domains.
DNS servers which SMG queries is on Windows Server 2025.
Does anyone have the same probem?

-------------------------------------------

[alexander smg]

Unclassified | Non classifi?

Is the 3rd dns server listed, the one that works. Or does the first dns listed also resolve correctly? Try this: only use the 3rd dns listed right now, as the ONLY dns for the smg. Test again.

[almir0n]

All listed dns servers resolve correctly. I have first two fields populated with dns servers.Third field was blank.

Now, when I try to do this you wrote, I setup only third dns field, but after save dns server is on first field again.

I left only one dns server now to check dns resolving today. 

-------------------------------------------

[alexander smg]

Unclassified | Non classifi?

Only use the 2nd dns u had before as the first in the list. That way you are only using one dns server at a time. Not multiple

[almir0n]

Same problem this morning. I used the 2nd dns I had used before as the first in the list. I have only one dns server in the list.

I'll try to change dns server but I expect the problem to recur. I plan to avoid mx lookup by creating an optional route for the affected domains,

but I'm afraid I'll have a larger list of domains.

This is such a strange problem, I don't know if it is related to the new dns servers that are on ws2025 version or to the new version of smg. 

There are no any logs related to this problem.

-------------------------------------------

[alexander smg]

Unclassified | Non classifi?

Are these dns servers windows?

[almir0n]

yes, windows server 2025.

-------------------------------------------

[alexander smg]

Unclassified | Non classifi?

And all domains effected?

[almir0n]

not all domains are affected, but only some, but even those affected domains have regular dns records, and mail messages are delivered sometimes on the first try, but sometimes only from the second or third attempt.

-------------------------------------------

[alexander smg]

Unclassified | Non classifié

Then open a support ticket as you have found a new issue with the new version. That should NOT be happening.

[Kevin Foster]

I am seeing the same issue. I already have an open ticket related to the delivery queue and will reference this thread.

-------------------------------------------

[almir0n]

I'm glad I'm not alone :)

I hope Broadcom will release a patch or workaround for this issue, soon.

-------------------------------------------

[ace1]

Hi have you had a response from Broadcom?

I'm using root internet DNS for security and reliability, wasn't happening before this release.

I've even got complains about delay toward "dhl.com" domain , just to say, not some rare MX.

DNS client components of SMG should be improved for reliability, this isn't a real time strict system, a DNS failure should be treated differently then a soft remote MTA failure, the retry delta time should be different (i.e. retry DNS faster and relaxing timeouts).

In any case, not happening before. 

-------------------------------------------

[alexander smg]

Unclassified | Non classifié

Make a support ticket

[ace1]

Same. On 10.9.2-6. Never happened before. Mail gets delayed then retried successfully.

Using same infrastructure as in the past.

And I Use Internet Root servers DNS resolution directly for outbound internet email delivery, not other internal host.

Something changed in the SMG internals regarding DNS, too flimsy timeouts etc.?

-------------------------------------------

[ace1]

As additional info, I picked some example email in the delivery queue for a target domain with that issue.

I'm able to nslookup mx it on the local same SMG. Despite that, the message, once forced flush, still get the same dns error, despite having resolved successfully with the included nslookup.

I tired with other machine dig / drill tool , I noticed that the resolution on this particular domain, using the correct resolution sequence from say the root, is not fast. Little slower than usual.

Could that in this new versions they introduced a regression with too strict timeout not allowing the DNS answer to get back? Is it possible to set the timeout (I repeat, using the local nslookup it's ok, still the message in the queue gets the error).

I even try to restart the dns-control.

-------------------------------------------

[ace1]

At the end this is due to the internal MTA DNS client resolution tolerance and resilience regarding internet errors and problems.

On the internet sometimes there are DNS servers in the chain (that answer with the authoritative MX etc.) with measured big packet loss and high latency (I measured some partners from EU contacting China in the order of 15% measured packet loss and RTT even reaching 800ms at the DNS level not the SMTP MTA).

But that's the internet, and that's expected, especially in email delivery, and SMG is also a perimeter MTA,  so I think that Broadcom to improve the product should do :

• SMG should improve its robustness during DNS MX resolution, more retries, and more generous timeout
• Treat DNS lookup failures not as MTA failure (ie retry DNS query some times before looping in exponential backoff)
• Incorporate (maybe it is already there...) some mainstream caching technology (like "unbound" as a caching resolved, already used in freebsd locally for example) to neatly handle dns resolution with the robustness required by wordwide internet

-------------------------------------------

[alexander smg]

Unclassified | Non classifié

Maybe so. But if you can have your own dns server, then you could increase the cached ttl that your smg could then pull against. I have done and “pow” infinitely better

[ace1]

Sure, I use "unbound" for caching some appliances, really lightweight and functional if you don't need to host an authoritative zone (just recursive forwarders), very optimized.

But, for some internet domains I've seen (especially in far east), this doesn't automatically solve the problem, the external resolver still have to resolve the address (recursively) if not in cache, it can take some time (even 800ms + 800ms and maybe more for a full blown transaction), before handing to i.e. SMG

Would be nice to know the internal DNS resolution process by SMG (number of retries, timeouts, protocol etc.).

[alexander smg]

Solves all my issues. Woohoo

[ace1]

Apparently a patch will be released to fix the problem

https://knowledge.broadcom.com/external/article?articleNumber=423122

pls subscribe to the article above.

-------------------------------------------

[alexander smg]

Of course. This has happened before.

[Andrey Fyodorov]

So has there been more development on this?  I am Not updating to 10.9.2-6 until this gets fixed.

-------------------------------------------

[alexander smg]

Unclassified | Non classifi?

It seems fixed to me