@Aaron Wetherhold: SERVFAIL, RCODE2 simply means "Server failure - The name server was unable to process this query due to a problem with the name server." I'm not sure why Spamhaus does not work while other DNS-based tests work fine (if I understand the issue correctly), it might be an issue on their end, or you violated the free usage terms and they blocked you (http://www.spamhaus.org/organization/dnsblusage.html).
If that does not explain the problem, you might try the following (possible) solutions:
1. EDNS is enabled by default for the first time in 2008 R2. You might try disabling EDNS probes by issuing the following command:
dnscmd /config /EnableEDNSProbes 0
http://en.wikipedia.org/wiki/Extension_mechanisms_for_DNS
http://technet.microsoft.com/en-us/l.../cc787130.aspx
2. Windows Server 2008 DNS may stop processing some TLDs when using root hints, unless the TTL is set suitably high (see http://support.microsoft.com/kb/968372). You should try setting MaxCacheTTL registry value to 2 days or greater as the article suggests to see if that solves the problem.
Please let us know if any of the above has helped.
If that does not explain the problem, you might try the following (possible) solutions:
1. EDNS is enabled by default for the first time in 2008 R2. You might try disabling EDNS probes by issuing the following command:
dnscmd /config /EnableEDNSProbes 0
http://en.wikipedia.org/wiki/Extension_mechanisms_for_DNS
http://technet.microsoft.com/en-us/l.../cc787130.aspx
2. Windows Server 2008 DNS may stop processing some TLDs when using root hints, unless the TTL is set suitably high (see http://support.microsoft.com/kb/968372). You should try setting MaxCacheTTL registry value to 2 days or greater as the article suggests to see if that solves the problem.
Please let us know if any of the above has helped.
Krisztian Fekete
(March 8, 2011)
in response to this post
in response to this post
Digging a bit more, I beleive it is because the new DNS servers are using our comcast cable modem as the default gateway to the internet. We have two gateways, and previously the DNS servers were using the other. I think spamhaus is block all queries from comcast.
Aaron Wetherhold
(March 8, 2011)
@Aaron Wetherhold: That is very easily possible, because ISP DNS servers aggregate traffic from their network, so they are likely to violate the fair use policy and thus get firewalled out.
Peter Karsai (ORF Team)
(March 9, 2011)
in response to this post
in response to this post
I was sure that was the answer, but when I contacted Spamhaus they told me I was incorrect and they specifically looked up my IP address and said it was not being blocked.
Interestly when I do an NSlookup on spamhaus.org I receive a reply but when I do it on zen.spamhaus.org it fails. I'm still not sure what is going on. I'm going to dig more and if I find an answer I'll post it.
Interestly when I do an NSlookup on spamhaus.org I receive a reply but when I do it on zen.spamhaus.org it fails. I'm still not sure what is going on. I'm going to dig more and if I find an answer I'll post it.
Aaron Wetherhold
(March 9, 2011)
@Aaron Wetherhold: Thanks Aaron, please keep us posted.
Peter Karsai (ORF Team)
(March 10, 2011)
in response to this post
in response to this post
It was the eDNS that Krisztian mentioned in his post. Turning it off fixed the problem.
Aaron Wetherhold
(March 11, 2011)
@Aaron Wetherhold: Thanks for the feedback, glad to hear it solved the problem :)
Krisztian Fekete
(March 16, 2011)
in response to this post
in response to this post
Version: 4.4 REGISTERED
Log Mode: Verbose
Server: ati-ntmail.archtest.com
Source: SMTPSVC-1
Time: 3/7/2011 11:45:30 AM
Class: System Message
Severity: Warning
Actions: (not available)
Filtering Point: Before Arrival
HELO/EHLO Domain: (not available)
Related IP Address: 74.10.7.148
Message ID: (not available)
Email Subject: (not available)
Sender:
Recipient(s):
* <removed>
Message:
DNS error. Test: "DNSBL: SPAMHAUS-ZEN", server: "100.100.100.9", domain: "148.7.10.74.zen.spamhaus.org", record type: A, protocol: UDP. Server response: DNS server or domain failure (SERVFAIL, RCODE 2).