Michael Orlitzky put forth on 9/24/2010 2:37 AM: > Ok, I see what's going on. 'unknown' gets looked up first, and so /./ > matches it before the client IP address gets looked up. Wouldn't > check_reverse_client_hostname_access suffer the same fate? I think > switching to a CIDR map probably avoids matching the 'unknown'; I'll > give that a try.
Why go to CIDR? Just use this expression: >>> # Default: check these lists. /\[([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})\]/ all_rbls It only matches on a dotted quad enclosed in []. It won't match on the rdns name, or lack thereof (unknown). -- Stan