Perhaps it is doing other DNS lookups. For example it might be doing what I call a circular DNS check.
Sending server connects to you from IP 10.55.1.1 and HELO's mail.fubar.com The spam appliance checks the A record for mail.fubar.com, and it better be 10.55.1.1 Then it checks the PTR record for 10.55.1.1 and it better be mail.fubar.com Not RFC required but very common and pretty effective. Just an example, there are other DNS lookups it could have added besides RBL's that your old unit did not do. Should it be moved out is a question for the firewall guy. If it is hurting the firewall's performance then he needs a new firewall or you need to move it. And that is the question, is the spike causing issues or just causing him worry? -----Original Message----- From: Osborne, Richard [mailto:[email protected]] Sent: Thursday, January 20, 2011 11:37 AM To: MS-Exchange Admin Issues Subject: RE: anti-spam DNS requests Our previous Windows-based anti-spam queried the same 3 RBLs, so I don't understand the increase. -----Original Message----- From: Alex Eckelberry [mailto:[email protected]] Sent: Thursday, January 20, 2011 10:31 AM To: MS-Exchange Admin Issues Subject: RE: anti-spam DNS requests Spamtitan, like many open-source based appliances, queries a bunch of RBLs, like SURBL, Spamhaus, etc. Look at what RBLs are listed, there's going to be a bunch of lookups. I am not surprised that you saw a jump. Alex Alex Eckelberry General Manager, Security Business Unit GFI Software, Inc. (formerly Sunbelt Software) 33 N. Garden Avenue, Clearwater, FL 33755 p: 919-297-1347 f: 727-562-5199 e: [email protected] MSN: [email protected] Skype: alexeckelberry oovoo: alexeck w: www.sunbeltsoftware.com b: www.sunbeltblog.com -----Original Message----- From: Paul Hutchings [mailto:[email protected]] Sent: Thursday, January 20, 2011 11:07 AM To: MS-Exchange Admin Issues Subject: RE: anti-spam DNS requests Maybe it queries more RBLs, maybe it does root hint lookups rather than forwarders, it could be a lot of things depending on how it's configured vs. the old product. Paul -----Original Message----- From: Osborne, Richard [mailto:[email protected]] Sent: 20 January 2011 16:03 To: MS-Exchange Admin Issues Subject: anti-spam DNS requests Our anti-spam solution sits behind our firewall with the necessary ports open to the Internet. We recently changed from a Windows-based (Symantec Mail Security) to a Linux-based (SpamTitan) anti-spam system. My firewall guy is concerned that the number of DNS connections on the firewall (Checkpoint Firewall-1) has more than doubled. We saw the same behavior when we demo'ed Untangle (also Linux-based). Both anti-spam solutions use RBL's, so of course there will be a lot of DNS requests. Any ideas why the number has grown so much higher and whether it should be a concern? Should we just move our anti-spam server outside the firewall? Thanks. Richard Osborne Information Systems Jackson-Madison County General Hospital NOTICE: (1) The foregoing is not intended to be a legally binding or legally effective electronic signature. (2) This message may contain legally privileged or confidential information. If you are not the intended recipient of this message, please so notify me, disregard the foregoing message, and delete the message immediately. I apologize for any inconvenience this may have caused. --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe exchangelist -- MIRA Ltd Watling Street, Nuneaton, Warwickshire, CV10 0TU, England Registered in England and Wales No. 402570 VAT Registration GB 100 1464 84 The contents of this e-mail are confidential and are solely for the use of the intended recipient. If you receive this e-mail in error, please delete it and notify us either by e-mail, telephone or fax. You should not copy, forward or otherwise disclose the content of the e-mail as this is prohibited. --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe exchangelist --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe exchangelist
