Is the mail server also acting as a webserver? If so, perhaps the spam is 'originating' locally though a broken cgi script? David. -- David Goodwin http://codepoets.co.uk/