Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 6 replies
  • Subscribers 2 subscribers
  • Views 985 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Dns errors - multi.uribl.com

Goldy_01
Hi to all.

Recently, my DNS log has ALOT of this kind of errors:
2010:11:22-20:03:15 mhgate named [29810]: unexpected RCODE (SERVFAIL) resolving 'pompa.co.il.multi.uribl.com/A/IN': "my ISP DNS" #53

All of them have the " multi.uribl.com" .

Any idea how to find out the source of those queries, and how to block it?
Packet filter and Web Security don't seem to work...
[:S]


This thread was automatically locked due to age.
Parents
  • 0
    Do you see anything at about the same time in the SMTP log?  This just feels like an anti-spam engine using the blacklist at multi.uribl.com - are you sure you don't that in your RBL list in the SMTP Proxy?

    For internal users, we have DCHP aim DNS requests first at the internal name server, then Astaro, then OpenDNS.  The inernal name server forwards to Astaro, then OpenDNS.  Astaro forwards only to DNS.  Request routes give Astaro access to the Internal name server.

    Cheers - Bob
Reply
  • 0
    Do you see anything at about the same time in the SMTP log?  This just feels like an anti-spam engine using the blacklist at multi.uribl.com - are you sure you don't that in your RBL list in the SMTP Proxy?

    For internal users, we have DCHP aim DNS requests first at the internal name server, then Astaro, then OpenDNS.  The inernal name server forwards to Astaro, then OpenDNS.  Astaro forwards only to DNS.  Request routes give Astaro access to the Internal name server.

    Cheers - Bob
Children
No Data