Bill Jonas on Tue, 9 Oct 2001 15:13:08 -0400


[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

Re: [PLUG] post from NeoMail


On Tue, Oct 09, 2001 at 02:49:17PM -0400, paul@dpagin.net wrote:
> What's up with this warning?
> 
> X-Authentication-Warning: arthur.nothinbut.net: Host [157.238.46.43]
> claimed to be nghost.vosn.net

It means that the host claimed to have a certain name and that the
receiving host didn't agree or otherwise couldn't substantiate the
claim.  In this case, arthur.nothinbut.net couldn't do a reverse lookup
on 157.238.46.43.

bj@neo:~$ host nghost.vosn.net
nghost.vosn.net         A       157.238.46.43
bj@neo:~$ host 157.238.46.43
Nameserver not responding
157.238.46.43 PTR record not found, try again  

The forward DNS is set up all right, but the receiving host does a
reverse lookup.  It's also why you see the "Received: from
nghost.vosn.net ([157.238.46.43])" line.  It's also what it means when
you see "Received: from firestorm.nothinbut.net (firestorm.nothinbut.net
[207.44.32.28])" -- the IP is in parentheses and brackets, the reverse
lookup is inside the parentheses, and who the sending host claimed to be
is outside and listed first.  It's why you might see, for example, spam
with a Received: header that starts out "from localhost.localdomain
(some.spam-loving.host.and.domain.here.com [w.x.y.z])";
some.spam-loving.host claims to be localhost.localdomain.

</ramble>

-- 
Bill Jonas    *    bill@billjonas.com    *    http://www.billjonas.com/
"They that can give up  essential  liberty to obtain a little temporary
safety deserve neither liberty nor safety."        -- Benjamin Franklin
If encryption is outlawed, bayl bhgynjf jvyy unir raelcgvba.

______________________________________________________________________
Philadelphia Linux Users Group       -      http://www.phillylinux.org
Announcements-http://lists.phillylinux.org/mail/listinfo/plug-announce
General Discussion  -  http://lists.phillylinux.org/mail/listinfo/plug