We recently got a large number of repeated mail.log entries identical to
the following (except for message numbers and times). If you look below
you will see from the "whois" that the ISP 206.21.110 is resolvable though
the name of the sender domain worenet.gen.oh.us does not appear to be.
My questions are:
1.) It would be useful for us to distinguish these messages as purposeful
or unintentional incorrect domains. Is the fact that there are a
large number of log entries meaningful?
2.) Because of our configuration "Sender domain unresolvable" results. Is
there a way (without reconfiguring and restarting mail) to discern whether
they are unintentionalal- e.g. should the original message appear
somewhere in our logs, such as root mail? Should a record of these
messages also appear in daemon.log?
I will summarize.
Thanks,
Mark Schlam
<mail log record is below>
# cat mail.log |grep 22819
Mar 27 12:52:38 castle sendmail[22819]: MAA0000022819: ruleset=check_mail,
arg1= <hugob_at_worenet.gen.oh.us>, relay=nala.worcnet.gen.oh.us [206.21.110.2],
reject=451 <hugob_at_worenet.gen.oh.us>... Sender domain unresolvable
Mar 27 12:52:38 castle sendmail[22819]: MAA0000022819:
from=<hugob_at_worenet.gen.oh.us>, size=0, class=0, pri=0, nrcpts=0, proto=ESMTP,
relay=nala.worcnet.gen.oh.us [206.21.110.2]
# whois -h whois.arin.net 206.21.110 Netname: OARNET-CBLK5
Netblock: 206.21.0.0 - 206.21.255.0
Received on Fri Mar 27 1998 - 20:18:37 NZST