Sorry for the long and tedious post, but I've tried to be as 'complete' and thorough as I can. Just recently, I've been getting the following messages in root account mailbox . . . but no message appears in the listowner mailbox... ---------- Forwarded message ---------- From: "L-Soft list server at National Association of Colleges and Employers (1.8b)" <[log in to unmask]> To: [log in to unmask] Subject: Your message to [log in to unmask] Tue, 11 Jul 1995 10:29:29 Your message to [log in to unmask] has been forwarded to the "list owners" (the people who manage the JOBPLACE list). If you wanted to reach a human being, you used the correct procedure and you can ignore the remainder of this message. If you were trying to send a command for the computer to execute, please read on. 8< SNIP >8 -------- End of Forwarded message -------- If you want the rest of the message, I'll mail it to ya, but its 4K! I notice that I get this message when the list has a new post, so tracing what is actually going on can be difficult. Included are excerpts from my mailer logs. If I read the logs correctly, the mail seems to originate from <vtbit.cc.vt.edu [198.82.160.247]>, and there is no "from" field. Is it possible that the mail is being spoofed, or is something misconfigured (I haven't changed the config in a week) Pointers anyone? Here are excerpts from my sendmail logs, (unedited) The Message IDs of importance, I believe, are: excerpt 1: KAA20704 -> KAA20707 excerpt 2: KAA20879 -> KAA20882 -- excerpt 1 -- Jul 11 10:29:29 news sendmail[20705]: KAA20704: from=<>, size=3616, class=0, pri =33616, nrcpts=1, msgid=<[log in to unmask]>, proto=SMTP, rel ay=vtbit.cc.vt.edu [198.82.160.247] Jul 11 10:29:29 news LSV:lsv_amin[20706]: Mail for jobplace-request (from 1/510) delivered to LISTSERV. Jul 11 10:29:29 news sendmail[20705]: KAA20704: to="|/usr/local/bin/lsv_amin -t JOBPLACE-request", delay=00:00:03, mailer=prog, stat=Sent Jul 11 10:29:30 news sendmail[20708]: KAA20707: from=<[log in to unmask] .ORG>, size=3416, class=0, pri=33416, nrcpts=1, msgid=<199507111429.KAA20707@new s.jobweb.org>, proto=SMTP, relay=news.jobweb.org [199.234.255.6] Jul 11 10:29:30 news sendmail[19905]: JAA19904: to=<[log in to unmask]>, del ay=00:57:52, mailer=smtp, relay=gatekeeper.mcimail.com. [192.147.45.5], stat=Sen t (OAA31048 Message accepted for delivery) Jul 11 10:29:31 news sendmail[20711]: KAA20709: from=<[log in to unmask] ORG>, size=3616, class=0, pri=33616, nrcpts=1, msgid=<199507111429.KAA20704@news .jobweb.org>, proto=SMTP, relay=news.jobweb.org [199.234.255.6] Jul 11 10:29:31 news sendmail[20708]: KAA20707: to=root, delay=00:00:01, mailer= local, stat=Sent Jul 11 10:29:31 news LSV:lsv_amin[20712]: Mail for jobplace (from 1/510) deliver ed to LISTSERV. Jul 11 10:29:31 news sendmail[20711]: KAA20709: to="|/usr/local/bin/lsv_amin -t JOBPLACE", delay=00:00:01, mailer=prog, stat=Sent -- excerpt 2 -- Jul 11 10:41:42 news sendmail[20880]: KAA20879: from=<>, size=3616, class=0, pri =33616, nrcpts=1, msgid=<[log in to unmask]>, proto=SMTP, rel ay=vtbit.cc.vt.edu [198.82.160.247] Jul 11 10:41:42 news LSV:lsv_amin[20881]: Mail for jobplace-request (from 1/510) delivered to LISTSERV. Jul 11 10:41:42 news sendmail[20880]: KAA20879: to="|/usr/local/bin/lsv_amin -t JOBPLACE-request", delay=00:00:01, mailer=prog, stat=Sent Jul 11 10:41:44 news sendmail[20883]: KAA20882: from=<[log in to unmask] .ORG>, size=3416, class=0, pri=33416, nrcpts=1, msgid=<199507111441.KAA20882@new s.jobweb.org>, proto=SMTP, relay=news.jobweb.org [199.234.255.6] Jul 11 10:41:44 news sendmail[20886]: KAA20884: from=<[log in to unmask] ORG>, size=3616, class=0, pri=33616, nrcpts=1, msgid=<199507111441.KAA20879@news .jobweb.org>, proto=SMTP, relay=news.jobweb.org [199.234.255.6] Jul 11 10:41:44 news sendmail[20883]: KAA20882: to=root, delay=00:00:01, mailer= local, stat=Sent -- end of excerpts -- --- [the opinions expressed herein are not necessarily those of my employer] Daniel Dewey | "The purpose of education is not to Systems Administrator (Unix) | answer the questions, but rather [log in to unmask] | question the answers." -- Anon http://www.ot.com/~sidewin | The National Association of Colleges and Employers 610-868-1421, x15