Pegasus Mail & Mercury

I have been hit fairly hard in the last few days with relay attempts to krs.yahoo.co.fr?   Something about one of the headers caught my attention and made me run nslookup on the server.  Running nslookup to "mail.krs.yahoo.com.mydomain.com" resolves back to my IP.   It's not in the A records for my domain, and it isn't in the DNS server, hosts, lmhosts or any other dns related files that I can find.

What's going on with this... any help/pointers would be appreciated.

Mags Ingval

Start by clearing your resolver-cache. (enter the dns-mmc, and clear the server cache).

Then retry nslookup - if the answer is the same, turn on full logging of your dns-server - so that you can trace what is going on with your specific query.

If your server relays the dns query off-host, and the answer is wrong, and you have set up a special forward host for all other domains, throw that hos away - since it has been hit by cache poisoning - and revert back to root hints for proper resolution.