Google public DNS has wrong MX records for my domain

[CapnKernel]

Hello,

I have the domain afork.com through enom. I am using enom's DNS
servers. For the past few weeks, a certain number of people say that
they can't send email to me: An email address of (for example)
"mi...@afork.com" gets rewritten as "mi...@www.afork.com", which
doesn't work: The email gets bounced back to them.

The MX records for my domain are set to forward my email to Google
Apps, using the MX records as advised by Google. The entries in my
eNom control panel are exactly as
Google recommends.

When I use the various online MX DNS lookup websites, they all tell me
the MX records are as they should be. But when I ask the Google
public DNS server, the MX records are wrong. That it's only Google
DNS that has the wrong answer tells me this is not an eNom problem.

I am in Melbourne Australia. The domain is registered through eNom.
This problem has persisted continually for several weeks. I use
Linux, but the problem can be seen by anyone who queries the Google
public DNS servers, regardless of platform.

Here's an example of the correct MX records retrieved from Optus,
Australia's 2nd largest ISP:

[mjd@onza ~]$ ping -c 1 ns.optus.net.au
PING ns.optus.net.au (61.88.88.88) 56(84) bytes of data.
64 bytes from ns.optus.net.au (61.88.88.88): icmp_seq=1 ttl=245
time=18.6 ms

--- ns.optus.net.au ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 24ms
rtt min/avg/max/mdev = 18.698/18.698/18.698/0.000 ms
[mjd@onza ~]$
[mjd@onza ~]$ dig @ns.optus.net.au afork.com mx

; <<>> DiG 9.6.2-P2-RedHat-9.6.2-5.P2.fc12 <<>> @ns.optus.net.au
afork.com mx
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46647
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 5, ADDITIONAL: 6

;; QUESTION SECTION:
;afork.com. IN MX

;; ANSWER SECTION:
afork.com. 1800 IN MX 30 ALT2.ASPMX.L.GOOGLE.com.
afork.com. 1800 IN MX 40 ASPMX2.GOOGLEMAIL.com.
afork.com. 1800 IN MX 50 ASPMX3.GOOGLEMAIL.com.
afork.com. 1800 IN MX 10 ASPMX.L.GOOGLE.com.
afork.com. 1800 IN MX 20 ALT1.ASPMX.L.GOOGLE.com.

;; AUTHORITY SECTION:
afork.com. 3600 IN NS dns2.name-services.com.
afork.com. 3600 IN NS dns3.name-services.com.
afork.com. 3600 IN NS dns4.name-services.com.
afork.com. 3600 IN NS dns5.name-services.com.
afork.com. 3600 IN NS dns1.name-services.com.

;; ADDITIONAL SECTION:
ASPMX.L.GOOGLE.com. 156 IN A 72.14.213.27
ALT1.ASPMX.L.GOOGLE.com. 14 IN A 74.125.157.27
ALT2.ASPMX.L.GOOGLE.com. 9 IN A 74.125.45.27
ASPMX2.GOOGLEMAIL.com. 3154 IN A 74.125.43.27
ASPMX3.GOOGLEMAIL.com. 775 IN A 72.14.213.27
dns4.name-services.com. 211 IN A 69.64.145.225

;; Query time: 379 msec
;; SERVER: 61.88.88.88#53(61.88.88.88)
;; WHEN: Thu Jul 1 22:47:09 2010
;; MSG SIZE rcvd: 362

[mjd@onza ~]$

That is exactly how I expect. Now I'll ask Google for exactly the same
information, from Google's public DNS server:

[mjd@onza ~]$ ping -c 1 google-public-dns-a.google.com
PING google-public-dns-a.google.com (8.8.8.8) 56(84) bytes of data.
64 bytes from google (8.8.8.8): icmp_seq=1 ttl=46 time=205 ms

--- google-public-dns-a.google.com ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 210ms
rtt min/avg/max/mdev = 205.599/205.599/205.599/0.000 ms
[mjd@onza ~]$ dig @google-public-dns-a.google.com afork.com mx

; <<>> DiG 9.6.2-P2-RedHat-9.6.2-5.P2.fc12 <<>>
@google-public-dns-a.google.com afork.com mx
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57089
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;afork.com. IN MX

;; ANSWER SECTION:
afork.com. 123 IN CNAME www.afork.com.

;; AUTHORITY SECTION:
afork.com. 1800 IN SOA dns1.name-services.com. info.name-services.com.
2002050701 10001 1801 604801 181

;; Query time: 505 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Thu Jul 1 22:50:59 2010
;; MSG SIZE rcvd: 105

[mjd@onza ~]$

Can you see the problem? There is no MX record in the answer! Instead,
there is a CNAME "www.afork.com", and some mail clients are rewriting
the address because of this.

As you can see from the first test, I have a small TTL value, and I've
not changed my settings in weeks. So please don't tell me that I need
to wait for changes to be pushed out to all servers.

Can you help me please? I am losing mail and this is bad.

Thank you.

Mitch.

[Paul S. R. Chisholm]

Thanks for the detailed report. Not sure what was "stuck" (and it only
happened in one data center), but it looks good from everywhere now.

Hope this helps. --PSRC

[Alex Nizhner]

Can you see the problem? There is no MX record in the answer! Instead,
there is a CNAME "www.afork.com", and some mail clients are rewriting
the address because of this.

This is why:

[ingwe]% dig @ns.optus.net.au afork.com 

; <<>> DiG 9.4.2-P2.1 <<>> @ns.optus.net.au afork.com
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1032
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 5, ADDITIONAL: 2

;; QUESTION SECTION:
;afork.com.                     IN      A

;; ANSWER SECTION:
afork.com.              1729    IN      CNAME   www.afork.com.
www.afork.com.          1729    IN      A       220.233.37.204

Anytime anyone looks up the address for afork.com, the CNAME gets cached.  Try it with any other resolver: look up the A record first, and then try the MX record.  E.g., with L3:

[ingwe]% dig @4.2.2.2 afork.com

; <<>> DiG 9.4.2-P2.1 <<>> @4.2.2.2 afork.com
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47129
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;afork.com.                     IN      A

;; ANSWER SECTION:
afork.com.              1800    IN      CNAME   www.afork.com.
www.afork.com.          1800    IN      A       220.233.37.204

;; Query time: 51 msec
;; SERVER: 4.2.2.2#53(4.2.2.2)

;; WHEN: Thu Jul  1 23:07:29 2010

;; MSG SIZE  rcvd: 61

[ingwe]% dig @4.2.2.2 afork.com mx

; <<>> DiG 9.4.2-P2.1 <<>> @4.2.2.2 afork.com mx
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17418

;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;afork.com.                     IN      MX

;; ANSWER SECTION:

afork.com.              1797    IN      CNAME   www.afork.com.

;; AUTHORITY SECTION:
afork.com.              900     IN      SOA     dns1.name-services.com. info.name-services.com. 2002050701 10001 1801 604801 181

;; Query time: 14 msec
;; SERVER: 4.2.2.2#53(4.2.2.2)
;; WHEN: Thu Jul  1 23:07:33 2010
;; MSG SIZE  rcvd: 105

Alex

As you can see from the first test, I have a small TTL value, and I've
not changed my settings in weeks. So please don't tell me that I need
to wait for changes to be pushed out to all servers.

Can you help me please?  I am losing mail and this is bad.
 

Thank you.

Mitch.

--
========================================================

You received this message because you are subscribed to the Google

Groups "public-dns-discuss" group.
To post to this group, send email to public-dn...@googlegroups.com

To unsubscribe from this group, send email to

public-dns-disc...@googlegroups.com

For more options, visit this group at

http://groups.google.com/group/public-dns-discuss?hl=en
For more information on Google Public DNS, please visit
http://code.google.com/speed/public-dns
========================================================

[CapnKernel]

Thanks for your help Paul and Adam.

Paul wrote:
>
> Thanks for the detailed report. Not sure what was "stuck" (and it only
> happened in one data center), but it looks good from everywhere now.

When I do a dig of the MX records to @8.8.8.8, I still get the CNAME.
Is that to be expected? Is this a situation that will clear itself
shortly?

On Jul 2, 1:10 pm, Alex Nizhner <nizh...@google.com> wrote:
>
> This is why

>
> Anytime anyone looks up the address for afork.com, the CNAME gets cached.
> Try it with any other resolver: look up the A record first, and then try the
> MX record.  E.g., with L3:

I see.

Can you help me understand the implications of this please? Are
people's MUAs/MTAs likely to do this? And will I keep losing mail?
If not, why not?

Thank you for your help, I appreciate it.

Mitch.

[Paul S. R. Chisholm]

Implication: A person who goes to http://afork.com/ and then tries
sending email to any...@afork.com will end up sending e-mail to
any...@www.afork.com instead. (It's a little more complicated than
that.) This is true no matter which DNS provider that person uses.
Yes, you will keep losing e-mail.

What you intended: "The canonical name for the A record for afork.com
is www.afork.com".

What you got: "The canonical name for the name afork.com, no matter
which which kind of record you're looking up, is www.afork.com"!

Solution: Do the afork.com -> www.afork.com transformation in your
exetel.com.au web server, not your eNom DNS server.

Hope this helps. --PSRC

[CapnKernel]

On Jul 2, 5:25 pm, "Paul S. R. Chisholm" <psrchish...@gmail.com>
wrote:
>
> Solution: Do the afork.com ->www.afork.comtransformation in your

> exetel.com.au web server, not your eNom DNS server.

Yes it does, thank you very much.

Mitch.