Hi,
There is a mail in my queue, trying to get out to hotmail.com. This is what
I find in my logs,
every time qmail tries:
@400000003b4478201cef303c starting delivery 3170: msg 277314 to remote
[EMAIL PROTECTED]
@400000003b44783418edd024 delivery 3170: deferral:
CNAME_lookup_failed_temporarily._(#4.4.3)/
Snort log:
sensei snort: IDS212 - MISC - DNS Zone Transfer: xxx.xxx.xxx.xxx:3211 ->
yyy.yyy.yyy.yyy:53
Dump of the offending packet:
xxx.xxx.xxx.xxx:3211 -> yyy.yyy.yyy.yyy:53
TCP TTL:64 TOS:0x0 ID:16519 IpLen:20 DgmLen:71 DF
***AP*** Seq: 0xB3A4D61B Ack: 0x208246C Win: 0x7D78 TcpLen: 20
0x0000: 00 E0 18 90 75 23 00 06 29 EE 61 2E 08 00 45 00 ....u#..).a...E.
0x0010: 00 47 40 87 40 00 40 06 B6 9B C3 74 DE 53 C3 74 .G@.@[email protected]
0x0020: DE 51 0C 8B 00 35 B3 A4 D6 1B 02 08 24 6C 50 18 .Q...5......$lP.
0x0030: 7D 78 6E 93 00 00 00 1D 01 85 01 00 00 01 00 00 }xn.............
0x0040: 00 00 00 00 07 68 6F 74 6D 61 69 6C 03 63 6F 6D .....hotmail.com
0x0050: 00 00 FF 00 01 .....
xxx.xxx.xxx.xxx is the mail server, qmail-1.03, Linux. yyy.yyy.yyy.yyy is
the DNS server, NT.
Why does qmail try to download the zone file for hotmail.com from my DNS
server? I don't get it :(
Thanks,
Marek Gutkowski
