LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices

Reply
 
Search this Thread
Old 01-30-2008, 08:27 AM   #1
beerfest
LQ Newbie
 
Registered: Jan 2008
Posts: 4

Rep: Reputation: 0
DNS behaviour and Postfix with relays.ordb.org


Hi folks,
Hoping someone can help me with information I'm seeing in a DNS log.
I've been trying to track down an "Unexpected RCODE (SERVFAIL)" error that I've been getting in /var/log/messages

I'm running Fedora Core 6.
I've switched BIND9 to log debug info to /var/named/chroot/var.log/named.log

I also have Postfix running on the server and all seems to be fine.
In main.cf I have the following spam control measures:-

smtpd_recipient_restrictions =
permit_mynetworks,
permit_sasl_authenticated,
reject_unauth_destination,
reject_invalid_hostname,
reject_unauth_pipelining,
reject_non_fqdn_sender,
reject_non_fqdn_recipient,
reject_unknown_recipient_domain,
reject_rhsbl_client blackhole.securitysage.com,
reject_rhsbl_sender blackhole.securitysage.com,
reject_rbl_client zen.spamhaus.org,
check_recipient_access hash:/etc/postfix/recipient_access


So I expect a chunk of Spam e-mails to be blocked.

However, I'm looking at my DNS logs and there's a lot of mentions to relays.ordb.org in there, one every few seconds. Here's some of the log:-
30-Jan-2008 14:10:21.890 resolver: debug 1: createfetch: 105.70.98.84.relays.ordb.org A
30-Jan-2008 14:10:24.599 resolver: debug 1: createfetch: 126.92.194.77.relays.ordb.org A
30-Jan-2008 14:10:27.966 resolver: debug 1: createfetch: 105.70.98.84.relays.ordb.org A
30-Jan-2008 14:10:29.619 resolver: debug 1: createfetch: 126.92.194.77.relays.ordb.org A
30-Jan-2008 14:10:34.859 resolver: debug 1: createfetch: 126.92.194.77.relays.ordb.org A
30-Jan-2008 14:10:35.668 resolver: debug 1: createfetch: 105.70.98.84.relays.ordb.org A
30-Jan-2008 14:10:39.876 resolver: debug 1: createfetch: 126.92.194.77.list.dsbl.org A
30-Jan-2008 14:10:39.914 resolver: debug 1: createfetch: 126.92.194.77.zen.spamhaus.org A
30-Jan-2008 14:10:40.684 resolver: debug 1: createfetch: 105.70.98.84.list.dsbl.org A
30-Jan-2008 14:10:40.722 resolver: debug 1: createfetch: 105.70.98.84.zen.spamhaus.org A


From what I've read relays.ordb.org went offline in Dec 06 and I have no reference to it in Postfix so why doe it appear in my DNS logs?
 
Old 01-31-2008, 09:26 AM   #2
beerfest
LQ Newbie
 
Registered: Jan 2008
Posts: 4

Original Poster
Rep: Reputation: 0
Thumbs up

Just adding to this thread.
I have resolved the problem and tracked down the info appearing in the DNS logs.

Turns out someone had configured one of our older DNS servers to point at my problem DNS server via the resolv.conf file. That coupled with the other server running sendmail which was configures to use relays.ordb.org.
So the sendmail on the other server was receiving e-mails and trying to lookup relays.ordb.org and failing and passing the lookup onto my problem DNS server.

Tracked down the problem using "ngrep port 53". What a great tool that is for monitoring and filtering network traffic.
 
  


Reply

Tags
bind9, dns, postfix


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Centos, Fetchmail, Postfix, Open Exchange = Weird Mail behaviour bugg_tb Linux - Server 1 02-13-2007 02:00 AM
"CLIENT HOST BLOCKED USING relays.ordb.org Niceman2005 Linux - General 8 05-18-2006 12:59 AM
Postfix + squirrelmail + uw-imap: strange behaviour UddUnderline Linux - Software 1 04-06-2006 10:05 AM
Postfix, Mailman + PHP - strange behaviour trees Linux - Networking 0 10-06-2005 02:56 PM
Weird DNS (?) behaviour jalonsom Linux - Networking 1 10-31-2004 06:55 AM


All times are GMT -5. The time now is 09:45 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration