基本信息：
操作系统为WIN 2000 SERVER，邮件服务器采用foxmail server2.0,目标是实现内外网都可正常使用，内网用户现在可正常收发，申请有合法域名和IP地址，dns由域名提供商来提供，假设邮件服务器本地ip为111.111.111.111,在防火墙上做NAT转换为公网ip 222.222.222.222。防火墙的数据如下：对于内部用户向外的所有端口都开发，对于外部用户只开放了25,110,80(同时作为web server应用）几个端口用来实现正常应用。
域名提供商处dns记录如下：(具体格式可能不对哦）
A记录：
www.xxx.com.cn IN A 222.222.222.222
xxx.com.cn IN A 222.222.222.222
MX记录：
mail.xxx.com.cn IN MX 10 222.222.222.222
xxx.com.cn IN MX 20 222.222.222.222
故障情况：
现在的情况是，
对于内网用户之间，无论收与发都正常，但是无法收到外网邮箱用户的邮件。在处于内网之中时，不论是用客户端还是web页面，都可以实现向外网用户发送邮件；但是处于外网中时，只能通过在web页面上登陆，客户端连接不上。通过外网邮箱无法发送邮件给内网用户，报以下错误：
This message is generated by COREMAIL email system.
I'm sorry to have to inform you that the message returned
排查记录：
在内网中通过telnet mail.xxx.com.cn 25和telnet mail.xxx.com.cn 110命令检查均正常。（注：对于foxmail server，通过这两个命令，如能出现“……service ready”，则说明foxmail server系统服务已经正常开启）而在外网中通过这两个命令测试时，却出现“不能打开到主机的连接， 在端口 25: 连接失败”以及“不能打开到主机的连接， 在端口 110: 连接失败”的提示。再加上在外网客户端根本连接不上，所以我怀疑是dns的问题。
通过
http://www.dnsreport.com/网站检查dns记录，发现有以下fail：
FAIL
MX is host name, not IP
ERROR: You have one or more MX record(s) that contain an IP address. This is not valid. A fully RFC-compliant mailserver will not be able to send you mail (although some mail servers will, due to the TCP/IP functions that they use). The problem MX records are:
222.222.222.222.
FAIL
Reverse DNS entries for MX records
ERROR: The IP of one or more of your mail server(s) have no reverse DNS (PTR) entries/* (if you see "Timeout" below, it may mean that your DNS servers did not respond fast enough)*/. RFC1912 2.1 says you should have a reverse DNS for all your mail servers. It is strongly urged that you have them, as many mailservers will not accept mail from mailservers with no reverse DNS entry. You can double-check using the 'Reverse DNS Lookup' tool at the DNSstuff site if you recently changed your reverse DNS entry (it contacts your servers in real time; the reverse DNS lookups in the DNS report use our local caching DNS server). The problem MX records are:
162.51.130.61.in-addr.arpa [No reverse DNS entry (rcode: 3 ancount: 0) (check it)]
FAIL
Connect to mail servers
ERROR: I could not complete a connection to any of your mailservers!
222.222.222.222: Timed out [Last data sent: [Did not connect]]
If this is a timeout problem, note that the DNS report only waits about 40 seconds for responses, so your mail *may* work fine in this case but you will need to use testing tools specifically designed for such situations to be certain.
我个人感觉第一条的报错比较有价值，难道是因为主机名写成了ip地址的原因？请各位确认一下，是不是mx记录里一定要写主机名？
那mx记录是不是应该这样写？
mail.xxx.com.cn IN MX 10 xxx.com.cn
xxx.com.cn IN MX 20 xxx.com.cn
但是我现在还没办法立即测试，因为ISP修改DNS记录后要12小时后才能生效，所以麻烦大家想一想还有没有其他原因？是否有防火墙数据设置的问题？请大家指教。
[
本帖最后由 princejian 于 2007-5-31 10:49 编辑 ]
