Tim wrote: > I know that. As I said, named. What the logs don't show is what > application is involved with named. But the process of elimination, > points the finger squarely at evolution (as I said). Leading back to my > Nov 12 18:14:07 mongrel named[1415]: FORMERR resolving 'education-russia.com/AAAA/IN': 68.105.15.143#53 Maybe it's an idea to bust out tcpdump tcpdump -s0 -X port 53 and see what is happening when it attempts the lookup. Perhaps these guys are sending HTML mails with IMG tags or IFRAMEs with URLs involving education-russia, hence the attempt to resolve? Or IIRC evolution uses spamd/spamassassin? It may well be doing 'research' on its own to assess the spamfulness of the email. -Andy
Attachment:
smime.p7s
Description: S/MIME Cryptographic Signature
