I just checked all of them. None of them are TCP first.
There are about 40 tests listed and they are all listed as DNS. The box next to TCP First is unchecked.
Have you checked to see the frequency of the messages, and see if they correspond one-to-one (or two-to-one, etc.) to the number of E-mails received? If so, it may be that even though you don't have "TCP First" checked, IMail ends up using TCP because of a large response packet for one specific test. If that's the case, there may be one TCP session for each E-mail, or for each E-mail that is listed in the spam database (depending on the specifics of the test).
If you have a packet sniffer on the IMail server or the DNS server, you can capture packets on TCP port 53, which would let you see the packets in question.
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection.
Find out what you have been missing: Ask for a free 30-day evaluation.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
