On Thu, 2011-02-10 at 19:30:15 -0500, Michael Scheidell wrote: > host mx1.res.cisco.com > mx1.res.cisco.com has address 208.90.57.13 > $ host 208.90.57.13 > 13.57.90.208.in-addr.arpa domain name pointer mx1.res.cisco.com. > > looks fine to me, why does this look to SA like a dynamic ip? > > (TRIGGERED RDNS_DYNAMIC.)
Probably __RDNS_INDICATOR_RES, which is included in the RDNS_DYNAMIC meta rule definition. > what, because of 'res' in it? Apparently... from 20_dynrdns.cf: # this hits a little ham, not too much though header __RDNS_INDICATOR_RES X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+[\-\.](?:res|resnet|client)[\-\.]/i -- Sahil Tandon <sa...@freebsd.org>
