Sorry for not including this question in my previous post...,

I also see a lot:

 of 10/12/03 04:48:29:250 -- (1044) Resolving 218.155.10.108 - Error resolving IP address (TimedOut)

Does this come from my side (dns configuration or who knows what)?

Since some IPs are resolved, and some are not...

Thanks, Eran.

Eran,

This is "Normal".  It does not mean that you have a DNS configuration problem but that for some reason or another, your specified DNS server could not get an answer from the authoritative DNS server.  If it happens always, then you do have a problem but it can happen quite often.  If you only have one server specifird, you can add another as follows in the dns settings:

xxx.xxx.xxx.xxx,xxx.xxx.xxx.xxx

Dan S.

this topic, and the spamhaus one indicates that someone,

or your isp`s nameserver might have been spoofed.

i saw this once earlier when they ddos`ed osurisoft.

i hope that is not the case.

always ttl to 24 hours on the nameserver which spamfilter uses,

and no second more, gives the best results

Hi,

I've had a problem here until I found what seems to me some strange behaviour from Spamfilter - and managed to work around it.

I had expected it to use

1) The Hosts file on the server and if not in there,

2) The DNS server from Spamfilter settings, then if no luck

3) The 2nd DNS server from settings etc, then if no luck.

3) The first DNS server as registered in TCP/IP properties of the server. If not found there either then go on to

4) The DNS server no 2 etc

I have SpamFilter behind a NAT firewall. The address of the SpamFilter machine is 192.168.0.4. Our main DNS is on this server but for external use only, it gives the "outside" IP for itself if anyone asks. I have not included a reverse lookup zone for 192....

So, anyone (on the inside) who wants to do a reverse lookup on 192.168.0.4 following the steps above, will find it in the Hosts file and never get to the DNS server (where it can't be found).

If for some reason it doesn't find it in the Hosts file (just in case I forget....), it will follow the procedure down the list of  DNS servers and eventually find a reverse lookup. Spamfilter doesn't seem to care about this though, it seems to only look in the first DNS server specified in its own settings. If reverse lookup fails in the first server (if more than one specified), it doesn't seem to go on to the next but generates an error.

Why isn't SpamFilter doing a Hosts file lookup first? Why not continue to query DNS servers as listed for failed reverse lookups?

Best from Carl Giljam

Carl,

SpamFilter expects a properly formatted PTR DNS record when performing reverse DNS searches - thus a simple entry in the host file will not work.

When making queries against the DNS server(s) listed within SpamFilter, if the currently selected DNS server is unreacheable or times out, the DNS query will be skipped, and the next DNS server in the list will be used for the subsequent queries. When that second server will fail/timeout, the DNS servers will be rotated again. But the initial query that resulted in a timeout will not be repeated. We have done that by design, to avoid stressing the DNS server too much. Please note that each incoming mail requires a reverse DNS query, along with an additional query for each MAPS server listed. This can cause quite a load on the DNS, and we try to keep it lower by not repeating queries that resulted in DNS timeouts or failures.

Issues with missing reverse entries will need to be resolved by configuring the DNS servers as needed, and may require adding a reverse zone on internal servers.

Roberto F.
LogSat Software