Re: named bogus loopback

[Bill Wohler <wohler@newt.com>]

Bill Wohler <wohler@newt.com> writes:
>   My log file has started filling up with the following messages:
> 
>     Sep 19 14:03:42 gbr named[333]: ns_resp: query(clay-courts.bzam.com) Bogus LOOPBACK A RR (localhost:127.0.0.1) learnt (A=localhost:NS=65.201.216.121)
>     Sep 19 14:03:42 gbr named[333]: sysquery: findns error (NXDOMAIN) on localhost?
> 
>   What are they? Should I be concerned? What should I do about them?

  A little more info.

    [wohler@gbr:511]$ dig clay-courts.bzam.com 
    clay-courts.bzam.com.   3663    IN      A       198.157.30.5
    bzam.com.               3663    IN      NS      localhost.
    localhost.              604800  IN      A       127.0.0.1

  Ah, a bogus nameserver:

    [root@gbr:501]# mailq
                    /var/spool/mqueue (4 requests)
    -----Q-ID----- --Size-- -----Q-Time----- ------------Sender/Recipient-------
    f8JIgmWX026621     1624 Wed Sep 19 11:42 <wohler@gbr.newt.com>
                     (host map: lookup (clay-courts.bzam.com): deferred)
                                             <gail@clay-courts.bzam.com>
    ...

  Ah, bounced spam in my mail queue.

  I suppose if this were a legitimate outfit, the thing to do is
  report the error to the technical contact for the domain (which is
  what I did). I imagine that this is the "fix" for this problem,
  although it probably won't get very far in this situation.

  Question: 65.201.216.121 is mentioned in the error message above,
  but doesn't seem to be connected to bzam.com in any way. How is it?

-- 
Bill Wohler <wohler@newt.com>  http://www.newt.com/wohler/  GnuPG ID:610BD9AD
Maintainer of comp.mail.mh FAQ and mh-e. Vote Libertarian!
If you're passed on the right, you're in the wrong lane.