Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - DNS Error: Timedout
  FAQ FAQ  Forum Search   Register Register  Login Login

DNS Error: Timedout

 Post Reply Post Reply
Author
lyndonje View Drop Down
Senior Member
Senior Member
Avatar

Joined: 31 January 2006
Location: United Kingdom
Status: Offline
Points: 192
Post Options Post Options   Thanks (0) Thanks(0)   Quote lyndonje Quote  Post ReplyReply Direct Link To This Post Topic: DNS Error: Timedout
    Posted: 10 March 2010 at 7:01am
Hey,

I'm seeing this a lot in my logs:

03/10/10 11:51:53:671 -- (3128) DNS Error:TimedOut
03/10/10 11:51:53:671 -- (3128) DNS Server will rotate after query. New server will be x.x.x.x

I've also tried using a few different DNS servers but doing so makes no difference. 

Is there any reason (other that delayed DNS response times) that may cause this?

What are the effects of this error on spam detection? 

Is there anything I could do other than maybe find more responsive DNS servers?

Thanks.
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4068
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 10 March 2010 at 11:33pm
That timeout error usually does indicate just that - there was a timeout when querying the DNS. If you see 2-3 failures every 200-300 DNS queries, that's an acceptable amount of timeouts. If they are higher, it likely indicates other issues, which yes, would negatively impact the spam detection rate.

To see if there is an issue with the DNS servers specified in SpamFilter, you can try opening an MSDOS prompt on the server running SpamFilter, and issuing the following commands in bold, repeating the sequence 2-3 times, each time using a different DNS server, and ensuring you receive the 127.0.0.2 result and not a timeout:

c:\>nslookup
server 192.168.1.1  (replace this IP with your DNS server)
Default server: 192.168.1.1
Address: 192.168.1.1#53
247.47.246.41.bl.spamcop.net
Server:         192.168.1.1
Address:        192.168.1.1#53

Non-authoritative answer:
Name:   49.201.79.189.bl.spamcop.net
Address: 127.0.0.2

Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
lyndonje View Drop Down
Senior Member
Senior Member
Avatar

Joined: 31 January 2006
Location: United Kingdom
Status: Offline
Points: 192
Post Options Post Options   Thanks (0) Thanks(0)   Quote lyndonje Quote  Post ReplyReply Direct Link To This Post Posted: 11 March 2010 at 5:14am
Hi Rob,

When I do manual DNS lookups, generally speaking they do not time out.

I wonder.... could it be anything to do with the black lists I'm using? For example, if they're no longer in service, may this effect things or report timeouts?
Back to Top
lyndonje View Drop Down
Senior Member
Senior Member
Avatar

Joined: 31 January 2006
Location: United Kingdom
Status: Offline
Points: 192
Post Options Post Options   Thanks (0) Thanks(0)   Quote lyndonje Quote  Post ReplyReply Direct Link To This Post Posted: 11 March 2010 at 5:30am
Sorry, Roberto Wink
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4068
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 11 March 2010 at 4:33pm
...you know what, I had never thought about that either! We're evenSmile
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
yapadu View Drop Down
Senior Member
Senior Member


Joined: 12 May 2005
Status: Offline
Points: 272
Post Options Post Options   Thanks (0) Thanks(0)   Quote yapadu Quote  Post ReplyReply Direct Link To This Post Posted: 11 March 2010 at 8:19pm
When spamfilter is checking a blacklist (like spamcop or something) it still processes the request through our local DNS server correct?  Or does spamfilter go direct to the blacklist provider?

I attempted to run an instance on Amazon Cloud, and found requests to many of the 3rd party blacklists were rejected automatically from the Amazon Cloud address space.
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4068
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 12 March 2010 at 10:06pm
SpamFilter will always use the DNS servers specified in its configuration for its queries. The DNS server being queried will then take care of contacting the proper DNS server(s) responsible for the lookup and will provide the reply to SpamFilter (unless your DNS server already has the response in its cache).
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
dotme View Drop Down
Newbie
Newbie


Joined: 27 October 2008
Status: Offline
Points: 20
Post Options Post Options   Thanks (0) Thanks(0)   Quote dotme Quote  Post ReplyReply Direct Link To This Post Posted: 25 March 2010 at 6:17pm
I'm seeing the same issue. To fix another error we were seeing (557 Exceptions) I upgraded to 4.1.3.822 from 4.0.0.785
 
After the upgrade, getting tons of DNS timeouts. DNS servers are very responsive to NSLOOKUPS and I have even aimed monitoring at them. All is well.
 
The real issue for me is that these timeouts, when an incoming message (legit) is loaded with URLs (constantcontact... for example), there are some unfortunate side effects.
 
The SURBL checks take so long that although the message eventually passes all tests, the sending server gives up waiting and re-queues the email.
 
Result? Some users report receiving the same email over and over again. I have to whitelist the sender in those cases, so we bypass checks and the repeat deliveries stop. But that's not a long term solution. It does seem like either something is less tolerant of delays with the new build, or one of the blacklist servers is suddenly very slow to respond (or maybe throttling?).
 
Here's a logfile if it helps... as you can see, the whole "check" process exceeds 5 minutes. That's a long time. No wonder the sending server re-queues the message.
 
@lyndonje - Any chance you can check your logs to see if it's the same "Checking URLs in emails against MAPS" area that's creating the issue for you?
 
If it is, and we nail this down as the cause, what's the best next move? Thanks everyone.
 
03/24/10 10:42:41:539 -- (2028) Detected TCP Connection: 207.97.245.xxx
03/24/10 10:42:41:554 -- (2028) Connection from: 207.97.245.xxx  -  Originating country : United States
03/24/10 10:42:41:711 -- (2028) Received MAIL FROM: <
jim@source.com>
03/24/10 10:42:41:742 -- (2028) Received RCPT TO:
srose@dest.com
03/24/10 10:42:41:757 -- (2028) Resolving 207.97.245.xxx - smtp156.iad.source.com
03/24/10 10:42:41:929 -- (2028) - SPF analysis for source.com done: - none
03/24/10 10:42:41:929 -- (2028) Mail from: jim@source.com

03/24/10 10:42:49:117 -- (2028) DNS Error:TimedOut
03/24/10 10:42:49:117 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.168
03/24/10 10:43:01:101 -- (2028) - MAPS search done...
03/24/10 10:43:01:101 -- (2028) RCPT TO: srose@dest.com accepted

03/24/10 10:43:01:601 -- (2028) Checking SFDC
03/24/10 10:43:01:773 -- (2028) Hash cache - Added OK
03/24/10 10:43:01:773 -- (2028) Checking SURBL
03/24/10 10:43:11:101 -- (2028) Checking URLs in emails against MAPS
03/24/10 10:43:11:117 -- (2028) Resolving for URLsInMAPS:
www.buffalo1.com
03/24/10 10:43:18:117 -- (2028) DNS Error:TimedOut
03/24/10 10:43:18:117 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.168
03/24/10 10:43:26:086 -- (2028) Resolving for URLsInMAPS:
www.xxxxx.com 03/24/10 10:43:33:117 -- (2028) DNS Error:TimedOut
03/24/10 10:43:33:117 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.168
03/24/10 10:43:41:101 -- (2028) Resolving for URLsInMAPS: campaign.constantcontact.com
03/24/10 10:43:52:132 -- (2028) DNS Error:TimedOut
03/24/10 10:43:52:132 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.168
03/24/10 10:44:13:148 -- (2028) Resolving for URLsInMAPS: img.constantcontact.com
03/24/10 10:44:23:116 -- (2028) DNS Error:TimedOut
03/24/10 10:44:23:116 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.169
03/24/10 10:44:31:101 -- (2028) Resolving for URLsInMAPS: r20.rs6.net
03/24/10 10:44:40:132 -- (2028) DNS Error:TimedOut
03/24/10 10:44:40:132 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.168
03/24/10 10:44:56:101 -- (2028) Resolving for URLsInMAPS: ih.constantcontact.com
03/24/10 10:45:03:085 -- (2028) DNS Error:TimedOut
03/24/10 10:45:03:085 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.168
03/24/10 10:45:05:101 -- (2028) Resolving for URLsInMAPS:
www.youtube.com
03/24/10 10:45:12:163 -- (2028) DNS Error:TimedOut
03/24/10 10:45:12:163 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.169
03/24/10 10:45:24:116 -- (2028) Resolving for URLsInMAPS:
www.cartridgesareus.com
03/24/10 10:45:32:148 -- (2028) DNS Error:TimedOut
03/24/10 10:45:32:148 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.168
03/24/10 10:45:44:116 -- (2028) Resolving for URLsInMAPS: ui.constantcontact.com
03/24/10 10:45:58:148 -- (2028) DNS Error:TimedOut
03/24/10 10:45:58:148 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.169
03/24/10 10:46:19:163 -- (2028) Resolving for URLsInMAPS: visitor.constantcontact.com
03/24/10 10:46:27:148 -- (2028) DNS Error:TimedOut
03/24/10 10:46:27:148 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.169
03/24/10 10:46:41:132 -- (2028) Resolving for URLsInMAPS: franchise.constantcontact.com
03/24/10 10:46:52:116 -- (2028) DNS Error:TimedOut
03/24/10 10:46:52:116 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.168
03/24/10 10:47:08:085 -- (2028) Resolving for URLsInMAPS:
www.w3.org
03/24/10 10:47:13:101 -- (2028) DNS Error:TimedOut
03/24/10 10:47:13:101 -- (2028) DNS Server will rotate after query. New server will be 10.10.10.168
03/24/10 10:47:15:148 -- (2028) - URLs In MAPS search done...
03/24/10 10:47:15:148 -- (2028) Start virus scan
03/24/10 10:47:15:257 -- (2028) Starting queueing procedures
03/24/10 10:47:15:273 -- (2028) EMail from
jim@source.com to srose@dest.com was queued. Size: 155 KB, 158720 bytes
03/24/10 10:47:15:273 -- (2028) Disconnect
03/24/10 10:47:15:273 -- (788) Sending email from
jim@source.com to srose@dest.com --
03/24/10 10:47:15:444 -- (788) EMail from
jim@source.com to srose@dest.com --  was forwarded to 10.10.10.166:25


Edited by dotme - 25 March 2010 at 6:25pm
Back to Top
lyndonje View Drop Down
Senior Member
Senior Member
Avatar

Joined: 31 January 2006
Location: United Kingdom
Status: Offline
Points: 192
Post Options Post Options   Thanks (0) Thanks(0)   Quote lyndonje Quote  Post ReplyReply Direct Link To This Post Posted: 30 March 2010 at 6:51am
Sorry for the delay, I'm running version 4.1.2.812. Below are a few examples from my log:

03/30/10 02:06:49:151 -- (6720) Connection from: 91.194.249.192  -  Originating country : Austria
03/30/10 02:06:49:323 -- (6720) Received MAIL FROM: <xxx>
03/30/10 02:06:49:401 -- (6720) Received RCPT TO: xxx
03/30/10 02:06:49:463 -- (6720) Resolving 91.194.249.192 - xxx
03/30/10 02:06:49:713 -- (6720) found SPF record for xxx: v=spf1 redirect=xxx
03/30/10 02:06:49:713 -- (6720) found SPF record for xxx: v=spf1 a mx ip4:91.194.248.0/23 ip4:91.211.240.0/24 ip4:91.211.242.0/24 ip4:81.223.46.0/27 ~all
03/30/10 02:06:49:729 -- (6720) SPF query result: pass
03/30/10 02:06:49:729 -- (6720) - SPF analysis for xxx done: - pass
03/30/10 02:06:49:729 -- (6720) SPF query result: pass
03/30/10 02:06:49:729 -- (6720) - SPF analysis for xxx done: - pass
03/30/10 02:06:49:729 -- (6720) Mail from: xxx
03/30/10 02:06:54:869 -- (6720) DNS Error:TimedOut
03/30/10 02:06:54:869 -- (6720) DNS Server will rotate after query. New server will be d.c.b.a
03/30/10 02:06:58:479 -- (6720) - MAPS search done... 
03/30/10 02:06:58:479 -- (6720) RCPT TO: xxx accepted
03/30/10 02:06:58:807 -- (6720) Checking SFDC
03/30/10 02:06:59:041 -- (6720) Hash cache - Added OK
03/30/10 02:06:59:135 -- (6720) EMail from xxx to xxx passes Bayesian filter - 0% spam  (78ms)
03/30/10 02:06:59:135 -- (6720) Checking SURBL
03/30/10 02:07:04:182 -- (6720) DNS Error:TimedOut
03/30/10 02:07:04:182 -- (6720) DNS Server will rotate after query. New server will be a.b.c.d
03/30/10 02:07:09:822 -- (6720) DNS Error:TimedOut
03/30/10 02:07:09:822 -- (6720) DNS Server will rotate after query. New server will be d.c.b.a
03/30/10 02:07:09:869 -- (6720) Checking URLs in emails against MAPS
03/30/10 02:07:09:869 -- (6720) Resolving for URLsInMAPS: rover.ebay.com
03/30/10 02:07:15:151 -- (6720) DNS Error:TimedOut
03/30/10 02:07:15:151 -- (6720) DNS Server will rotate after query. New server will be a.b.c.d
03/30/10 02:07:20:291 -- (6720) DNS Error:TimedOut
03/30/10 02:07:20:291 -- (6720) DNS Server will rotate after query. New server will be d.c.b.a
03/30/10 02:07:20:354 -- (6720) Resolving for URLsInMAPS: www.w3.org
03/30/10 02:07:25:494 -- (6720) DNS Error:TimedOut
03/30/10 02:07:25:494 -- (6720) DNS Server will rotate after query. New server will be a.b.c.d
03/30/10 02:07:30:604 -- (6720) DNS Error:TimedOut
03/30/10 02:07:30:604 -- (6720) DNS Server will rotate after query. New server will be d.c.b.a
03/30/10 02:07:30:635 -- (6720) Resolving for URLsInMAPS: mail.ebay.co.uk
03/30/10 02:07:36:088 -- (6720) DNS Error:TimedOut
03/30/10 02:07:36:088 -- (6720) DNS Server will rotate after query. New server will be a.b.c.d
03/30/10 02:07:41:197 -- (6720) DNS Error:TimedOut
03/30/10 02:07:41:197 -- (6720) DNS Server will rotate after query. New server will be d.c.b.a
03/30/10 02:07:41:275 -- (6720) Resolving for URLsInMAPS: pics.ebaystatic.com
03/30/10 02:07:46:603 -- (6720) DNS Error:TimedOut
03/30/10 02:07:46:603 -- (6720) DNS Server will rotate after query. New server will be a.b.c.d
03/30/10 02:07:51:713 -- (6720) DNS Error:TimedOut
03/30/10 02:07:51:713 -- (6720) DNS Server will rotate after query. New server will be d.c.b.a
03/30/10 02:07:51:775 -- (6720) Resolving for URLsInMAPS: pics.ebaystatic..com
03/30/10 02:07:51:822 -- (6720) Error occurred during URLsInMAPS: DNS Server Reports Query Not Implemented Error
03/30/10 02:07:51:822 -- (6720) - URLs In MAPS search done... 
03/30/10 02:07:51:822 -- (6720) Start virus scan
03/30/10 02:07:51:916 -- (6720) Starting queueing procedures
03/30/10 02:07:51:932 -- (6720) EMail from xxx to xxx was queued. Size: 34 KB, 34816 bytes
03/30/10 02:07:51:932 -- (6720) Starting bayesian procedures
03/30/10 02:07:52:041 -- (6720) Disconnect

03/30/10 02:09:26:431 -- (8236) Connection from: 78.129.153.65  -  Originating country : United Kingdom
03/30/10 02:09:26:525 -- (8236) Received MAIL FROM: <xxx> SIZE=34487
03/30/10 02:09:26:556 -- (8236) Received RCPT TO: xxx
03/30/10 02:09:26:572 -- (8236) Resolving 78.129.153.65 - xxx
03/30/10 02:09:26:806 -- (8236) - SPF analysis for xxx done: - none
03/30/10 02:09:26:806 -- (8236) Mail from: xxx
03/30/10 02:09:31:915 -- (8236) DNS Error:TimedOut
03/30/10 02:09:31:915 -- (8236) DNS Server will rotate after query. New server will be d.c.b.a
03/30/10 02:09:35:540 -- (8236) - MAPS search done... 
03/30/10 02:09:35:540 -- (8236) RCPT TO: xxx accepted
03/30/10 02:09:35:540 -- (8236) Bypassed all rules for: xxx from xxx ( AutoWhiteList Force Delivery)
03/30/10 02:09:35:743 -- (8236) Bypassed all rules for: xxx from xxx
03/30/10 02:09:35:822 -- (8236) Start virus scan
03/30/10 02:09:35:978 -- (8236) Starting queueing procedures
03/30/10 02:09:35:978 -- (8236) EMail from xxx to xxx was queued. Size: 31 KB, 31744 bytes
03/30/10 02:09:35:993 -- (8236) Starting bayesian procedures
03/30/10 02:09:36:072 -- (8236) Disconnect

03/30/10 02:10:04:431 -- (9812) Connection from: 91.186.15.206  -  Originating country : United Kingdom
03/30/10 02:10:04:728 -- (9812) Received MAIL FROM: <xxx> SIZE=1349
03/30/10 02:10:04:759 -- (9812) Received RCPT TO: xxx
03/30/10 02:10:04:946 -- (9812) Resolving 91.186.15.206 - xxx
03/30/10 02:10:05:290 -- (9812) - SPF analysis for xxx done: - none
03/30/10 02:10:05:290 -- (9812) Mail from: xxx
03/30/10 02:10:10:431 -- (9812) DNS Error:TimedOut
03/30/10 02:10:10:431 -- (9812) DNS Server will rotate after query. New server will be a.b.c.d
03/30/10 02:10:15:524 -- (9812) DNS Error:TimedOut
03/30/10 02:10:15:524 -- (9812) DNS Server will rotate after query. New server will be d.c.b.a
03/30/10 02:10:15:587 -- (9812) - MAPS search done... 
03/30/10 02:10:15:587 -- (9812) RCPT TO: xxx accepted
03/30/10 02:10:15:884 -- (9812) Checking SFDC
03/30/10 02:10:16:259 -- (9812) Hash cache - Added OK
03/30/10 02:10:16:259 -- (9812) EMail from xxx to xxx passes Bayesian filter - 0% spam  (0ms)
03/30/10 02:10:16:259 -- (9812) Checking SURBL
03/30/10 02:10:16:259 -- (9812) Checking URLs in emails against MAPS
03/30/10 02:10:16:259 -- (9812) - URLs In MAPS search done... 
03/30/10 02:10:16:259 -- (9812) Start virus scan
03/30/10 02:10:16:274 -- (9812) Starting queueing procedures
03/30/10 02:10:16:274 -- (9812) EMail from xxx to xxx was queued. Size: 1 KB, 1024 bytes
03/30/10 02:10:16:274 -- (9812) Starting bayesian procedures
03/30/10 02:10:16:368 -- (9812) Disconnect

Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4068
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 30 March 2010 at 10:04pm
lyndonje,

Can you please try, *from the server running spamfilter*, to issue the set of DNS lookups I mentioned above:

c:\>nslookup
server 192.168.1.1  (replace this IP with your DNS server)
Default server: 192.168.1.1
Address: 192.168.1.1#53
247.47.246.41.bl.spamcop.net
Server:         192.168.1.1
Address:        192.168.1.1#53

Non-authoritative answer:
Name:   49.201.79.189.bl.spamcop.net
Address: 127.0.0.2

and re-running the query each time replacing the MAPS server name with all of the MAPS servers you have in your list? For exmaple:
247.47.246.41.bl.spamcop.net
247.47.246.41.cbl.abuseat.org

etc etc?
It's possible that one of those MAPS server is timing out (we see for example an issue with "xbl.spamhaus.org"), which would cause those errors to be logged.

Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.080 seconds.