SMTP 5.4.7 - Delivery expired - unable to reach nameserver on any valid IP

Unanswered Question
Jan 5th, 2010

We recently started having issues delivering email to,, and addresses (possibly more domains, but

haven't heard of others yet).  They return the following error (email addresses have been altered):

Diagnostic information for administrators:

Generating server:

[email protected]

#< #5.0.0 smtp; 5.4.7 - Delivery expired (message too old) 'DNS Soft Error looking up (MX) while asking recursive_nameserver1.parent. Error was: unable to reach nameserver on any valid IP' (delivery attempts: 0)> #SMTP#

Original message headers:

Received: from ([])  by with ESMTP; 29 Dec 2009 09:15:36 -0600
Received: from ([])
  by with ESMTP; 29 Dec 2009 09:15:40 -0600
Received: from ([fe80::45fe:26d:54cd:6aeb]) by ([fe80::xxxx:xxxx:xxxx:xxxx%10]) with mapi; Tue, 29
Dec 2009 09:15:19 -0600
From: Internal User <
[email protected]>
To: User <
[email protected]>
Date: Tue, 29 Dec 2009 09:15:18 -0600
Subject: Blood Drive Today
Thread-Topic: Blood Drive Today
Thread-Index: AcqImccN9I6lWOw9QuGSrMji25lA2A==
[email protected]com
Accept-Language: en-US
Content-Language: en-US
acceptlanguage: en-US
Content-Type: multipart/alternative;
MIME-Version: 1.0
X-Auto-Response-Suppress: DR, OOF, AutoReply

Any ideas as to why this is occuring?  I have the ironport appliance's (C150) DNS pointing to our internal DNS servers.  I am able to resolve all mailservers to IPs via nslookup and can ping's servers, but not's or's (possibly by their design?).  There are some MX issues with AOL and Amtrak, but not Hotmail.  Any help is appreciated.  Thanks,

Hans Schroeder | Network Specialist

City of Edmond |

[email protected]

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
steven_geerts Sun, 01/24/2010 - 14:48

/* Style Definitions */ table.MsoNormalTable {mso-style-name:"Table Normal"; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-parent:""; mso-padding-alt:0cm 5.4pt 0cm 5.4pt; mso-para-margin:0cm; mso-para-margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:10.0pt; font-family:"Times New Roman"; mso-ansi-language:#0400; mso-fareast-language:#0400; mso-bidi-language:#0400;}

Hello Hans,

It looks like your DNS server(s) are overloaded or refusing their job for some other reason.

What is the response of your DNS servers when you request the problematic domains? Please try from Ironport nslookup and from any other nslookup/dig that is using the same DNS servers.

One thing that once bothered us was that our DNS servers where allowed to perform UDP queries only, some MX targets with a lot (in this case 18) of servers in their MX records exceeded the UDP packet size and DNS tried to switch over to TCP. that traffic was dropped so the DNS server never got it's result back. I think the MX records of AOL and Amtrak are not that bid (4 and 3 mail servers) but maybe it's a start.

You can also try to enable query logging on your DNS servers and check the results of that.

Good luck,



This Discussion