I'm not sure what Ironport would do, however from my understanding, it would only use the first MX record that is could contact, and only use the 2nd record as a backup connection should it not be able to contact the lower priority record. Looking at what you posted for that domain. I would say that their MX records are not right, as the 2nd record would need another number apart from 10, as this is the same priority as the first record. When I did an nslookup on that domain it only had one MX record in the list. Non-authoritative answer: cardig.com MX preference = 10, mail exchanger = mail.cardig.com
cardig.com nameserver = ns1.dutaint.com cardig.com nameserver = ns2.dutaint.com mail.cardig.com internet address = 18.104.22.168 ns1.dutaint.com internet address = 22.214.171.124 ns2.dutaint.com internet address = 126.96.36.199 So I am not sure if you miss-typed or was just using it as an example.
I think that the problem is not related to MX records existence or priority. The error you found occurs when a DNS server does not provide an answer to the query your appliance send when checking the sender. Suppose that a remote SMTP server connect to your appliance and send a "MAIL FROM: user @ domain.com" SMTP command; at this point your appliance checks whether "domain.com" exists or not and therefore asks for a MX record for "domain.com" to the DNS you configured. The DNS in turn searches for an authoritative DNS for "domain.com" and then sends it a query for the MX records of "domain.com"; if it doesn't get an answer your appliance cannot validate the sender domain and rejects the connection with the error you reported. In your example this means that the appliance didn't even know that the MX for cardig.com were "mail.cardig.com" and "mail1.cardig.com", but rather that the DNS server didn't get that information from the authoritative DNS server of "cardig.com".
DocumentationCode download linksGoalRequirementLimitationsSupported ISR
and UCS-E ModelSupported ISRG2 and UCS-E Blades:Supported ISR4K and
UCS-E Blades:Step by Step ConfigurationConfigure one of the connectivity
options to access the Cisco IMC from the n...
Firepower Threat Defense (NGFWv) on UCS E-series - Transparent Mode in
HA DocumentationCode download linksGoalRequirementLimitationsSupported
ISR and UCS-E ModelSupported ISRG2 and UCS-E Blades:Supported ISR4K and
UCS-E Blades:Step by Step ConfigurationCo...
Question I am currently unable to specify "crypto keyring" command when
configuring VPN connection on my cisco 2901 router. The following
licenses have been activated on my router :