RE: [cobalt-users] Maillog entries

[Mark Spieth <mspieth@xxxxxxxxxxxx>]

The first one you are getting because artsandkids.com resolves to
38.201.196.76 and not 38.203.66.36 therefore sendmail is warning you that it
may no be comming from where you think it is.

[root@ns1 mspieth]# nslookup artsandkids.com
Server:  ns1.telserve.com
Address:  206.183.25.218

Name:    artsandkids.com
Address:  38.201.196.76

The second one is because www1.psi.watermark.com does not resolve via DNS
therefore many mail systems will reject the message.

[root@ns1 mspieth]# nslookup www1.psi.watermark.com
Server:  ns1.telserve.com
Address:  206.183.25.218

*** ns1.telserve.com can't find www1.psi.watermark.com: Non-existent
host/domain


Mark

-----Original Message-----
From: Jeff S. Lucido [mailto:JSLucido@xxxxxxxxxxx]
Sent: Wednesday, March 08, 2000 12:09 PM
To: cobalt-users@xxxxxxxxxxxxxxx
Subject: [cobalt-users] Maillog entries


I have noticed a few entries in my maillog file over the past three days 
that is bothering me. Here is the entry (which appears almost every two 
minutes, 24 hours a day):

Mar  8 10:58:14 senna sendmail[26237]: KAA26237: ruleset=check_mail, 
arg1=<Poetry.com@xxxxxxxxxxxxxxxxxxxxxx>, relay=artsandkids.com 
[38.203.66.36] (may be forged), reject=451 
<Poetry.com@xxxxxxxxxxxxxxxxxxxxxx>... Sender domain must resolve

Mar  8 10:58:14 senna sendmail[26237]: KAA26237: 
from=<Poetry.com@xxxxxxxxxxxxxxxxxxxxxx>, size=0, class=0, pri=0, nrcpts=0, 
proto=E SMTP, relay=artsandkids.com [38.203.66.36] (may be forged)

Mar  8 10:59:35 senna sendmail[26278]: KAA26278: ruleset=check_mail, 
arg1=<Poetry.com@xxxxxxxxxxxxxxxxxxxxxx>, relay=artsandkids.com 
[38.203.66.36] (may be forged), reject=451 
<Poetry.com@xxxxxxxxxxxxxxxxxxxxxx>... Sender domain must resolve

Mar  8 10:59:35 senna sendmail[26278]: KAA26278: 
from=<Poetry.com@xxxxxxxxxxxxxxxxxxxxxx>, size=0, class=0, pri=0, nrcpts=0, 
proto=E SMTP, relay=artsandkids.com [38.203.66.36] (may be forged)

 From what I can tell (I wouldn't even consider myself a novice) it looks 
like someone from this domain is trying to send mail through my server. I 
do not host this domain (watermark.com) and I only have relaying turned on 
for a few select domains, none of which are listed above.

Any help or advice would be greatly appreciated.

Thanks in advance,
-JSLucido


_______________________________________________
cobalt-users mailing list
cobalt-users@xxxxxxxxxxxxxxx
To Subscribe or Unsubscribe, please go to:
http://list.cobalt.com/mailman/listinfo/cobalt-users