mostly come from: PTR lookups on IP addresses with no hostname, mostly from sendmail doing the gethostbyaddr() lookup on spam connections. DNSBL lookups on incoming mail IP addresses (most of which are spam). Windows bogosities (such as looking up netbios names).