Hi Scott: I just revisited the server. The DNS errors show the following in the window for Packets causing problem. These look anything but meaningful to me. I just recognize portions of the test names.
0000: 00 01 00 01 00 00 00 00 ........ 0008: 00 00 78 02 6f 03 63 6f ..x.o.co 0010: 6d 0c 73 70 61 6d 2d 73 m.spam-s 0018: 75 70 70 6f 72 74 0a 62 upport.b 0020: 6c 61 63 6b 68 6f 6c 65 lackhole 0028: 73 0b 66 69 76 65 2d 74 s.five-t 0030: 65 6e 2d 73 67 03 63 6f en-sg.co 0038: 6d 00 00 ff 00 01 00 01 m..�.... 0040: c0 0c 00 01 00 01 00 01 �....... 0048: 0d e5 00 04 7f 00 00 07 .�..... 0050: c0 0c 00 10 00 01 00 01 �....... 0058: 0d e5 00 45 44 61 64 64 .�.EDadd 0060: 65 64 20 32 30 30 33 2d ed 2003- 0068: 30 33 2d 32 32 3b 20 73 03-22; s 0070: 70 61 6d 20 73 75 70 70 pam supp 0078: 6f 72 74 20 2d 20 68 6f ort - ho 0000: 00 01 00 01 00 00 00 00 ........ 0008: 00 00 76 05 65 72 69 6f ..v.erio 0010: 03 6e 65 74 0c 73 70 61 .net.spa 0018: 6d 2d 73 75 70 70 6f 72 m-suppor 0020: 74 0a 62 6c 61 63 6b 68 t.blackh 0028: 6f 6c 65 73 0b 66 69 76 oles.fiv 0030: 65 2d 74 65 6e 2d 73 67 e-ten-sg 0038: 03 63 6f 6d 00 00 ff 00 .com..�. 0040: 01 00 01 c0 0c 00 01 00 ...�.... 0048: 01 00 01 07 df 00 04 7f ....�.. 0050: 00 00 07 c0 0c 00 10 00 ...�.... 0058: 01 00 01 07 df 00 55 54 ....�.UT 0060: 61 64 64 65 64 20 32 30 added 20 0068: 30 33 2d 30 33 2d 32 30 03-03-20 0070: 3b 20 73 70 61 6d 20 73 ; spam s 0078: 75 70 70 6f 72 74 20 2d upport - There are over 50 of these starting at midnight. Regards, Kami -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of R. Scott Perry Sent: Tuesday, June 17, 2003 4:25 PM To: [EMAIL PROTECTED] Subject: RE: [IMail Forum] DNS Messages >I just checked all of them. None of them are TCP first. > >There are about 40 tests listed and they are all listed as DNS. The >box next to TCP First is unchecked. Have you checked to see the frequency of the messages, and see if they correspond one-to-one (or two-to-one, etc.) to the number of E-mails received? If so, it may be that even though you don't have "TCP First" checked, IMail ends up using TCP because of a large response packet for one specific test. If that's the case, there may be one TCP session for each E-mail, or for each E-mail that is listed in the spam database (depending on the specifics of the test). If you have a packet sniffer on the IMail server or the DNS server, you can capture packets on TCP port 53, which would let you see the packets in question. To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
