Bad Refferal

[Mark.Andrews at nominum.com]

> I am getting the following message as a security violations:
> 
> "Apr 17 06:31:44 ns1 named[142]: bad referral (174.147.192.in-addr.arpa !< 21
> 8.174.147.192.in-addr.arpa) 
> from [192.147.174.26].53"

	It looks 174.147.192.in-addr.arpa delegates the entire /24
	at the individual reverse address to ns00.exactis.com and
	ns01.exactis.com.  These servers are set up to serve the
	/24 as 1 zone not 256 zones. 

	Normally the entire /24 would be delegated by the ISP (Verio
	in this case) getting registry (ARIN in this case) to update
	its delegation records to point to the servers in question,
	not by delegating every individual address.

> 
> I will appreciate if someone help me how to stop it.

	In this case hostmaster at exactis.com and hostmaster at verio.net
	(I've Bcc them this message) should be contacted to sort
	out this mess.

	Mark
> 
> Thanks.
> 
> Abu Umair
> 
> 
> 
--
Mark Andrews, Nominum Inc.
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: Mark.Andrews at nominum.com