[cobalt-security] named "denied update" error

["Cobalt Users Group" <cobalt@xxxxxxxxxxxx>]

>Hello Cobalt Security Gurus --
>
>I'm getting this error message in my log
>several hundred times a day:
>
>May 3 19:31:17 www named[671]: denied update from [157.238.135.154].9594
for >"KELLER.COM"
>
>Of course the timestamp changes, and so does the PID
>(I assume that 9594 is a PID) but the rest of the message
>is the same...  dozens every hour.
>
>KELLER.COM is my domain and I run the primary
>name server for it.

I had the same problem.  I was getting the same errors from a domain that
belonged to one of my customers.  After investigating for several weeks I
determined that my customer had gotten a DSL connection and on that
connection they had a Windows 2k Advanced Server installed.  And guess
what...they named the computer their domain name.

Apparently like it or not Win 2k goes out every so often and tries to update
DNS records and will give errors to the actual domain.

I'm not sure if this is the case, but may give you another avenue to
explore...

Good luck...

Scott