--- deadwood-2.9.06/src/DwMararc.h	2010-09-03 07:03:38.000000000 -0700
+++ deadwood-2.9.07/src/DwMararc.h	2010-09-05 05:08:57.000000000 -0700
@@ -63,13 +63,14 @@
 #define DWM_N_filter_rfc1918 22
 #define DWM_N_ns_glueless_type 23
 #define DWM_N_reject_aaaa 24
+#define DWM_N_reject_mx 25
 
 /* Number of string parameters in the mararc file */
 #define KEY_S_COUNT 7
 /* Number of dictionary parameters in the mararc file */
 #define KEY_D_COUNT 2
 /* Number of numeric parameters in the mararc file */
-#define KEY_N_COUNT 25
+#define KEY_N_COUNT 26
 
 #ifndef MINGW
 /* Location of files we read when we run execfile("foo") */
@@ -135,6 +136,8 @@
         "ns_glueless_type", /* Query type to find NS glue */
         "reject_aaaa", /* Whether to reply to AAAA queries with a
                         * synthetic "not there" reply */
+	"reject_mx", /* Whether to reject MX queries with no reply and
+		      * logging the query (to help find spam zombies) */
         0 };
 
 #endif /* MARARC_C */
--- deadwood-2.9.06/src/DwMararc.c	2010-09-03 07:03:38.000000000 -0700
+++ deadwood-2.9.07/src/DwMararc.c	2010-09-05 05:09:23.000000000 -0700
@@ -392,6 +392,7 @@
         key_n[DWM_N_filter_rfc1918] = 1;
         key_n[DWM_N_ns_glueless_type] = 1;
         key_n[DWM_N_reject_aaaa] = 0;
+        key_n[DWM_N_reject_mx] = 1;
 }
 
 /* Look for a Mararc parameter; -1 if not found/error; 0-n if found
--- deadwood-2.9.06/src/DwTcpSocket.c	2010-09-03 07:03:38.000000000 -0700
+++ deadwood-2.9.07/src/DwTcpSocket.c	2010-09-05 05:23:29.000000000 -0700
@@ -273,7 +273,7 @@
         orig_query = dw_copy(query);
         dwc_lower_case(query);
 
-        if(get_reply_from_cache(query,0,0,local_id,0,b,orig_query) != 1) {
+        if(get_reply_from_cache(query,0,0,local_id,0,b,orig_query,0) != 1) {
                 /* If not cached, make the buffer a UDP connection upstream */
                 forward_local_udp_packet(1,local_id,0,0,
                         (void *)tcp_pend[b].buffer,tcp_pend[b].wanted,b,
--- deadwood-2.9.06/src/DwTcpSocket.h	2010-09-03 07:03:38.000000000 -0700
+++ deadwood-2.9.07/src/DwTcpSocket.h	2010-09-05 05:23:54.000000000 -0700
@@ -66,7 +66,7 @@
  * from the cache */
 int get_reply_from_cache(dw_str *query, sockaddr_all_T *client,
                          SOCKET sock, int32_t id, int resurrect,
-                         int tcp_num, dw_str *orig_query);
+                         int tcp_num, dw_str *orig_query, ip_addr_T *from_ip);
 
 /* Given a connection we will send on, try and send the connection on.
    If we're unable to send the connection on, see if we have an
--- deadwood-2.9.06/src/DwRecurse.h	2010-09-03 07:03:38.000000000 -0700
+++ deadwood-2.9.07/src/DwRecurse.h	2010-09-05 05:25:46.000000000 -0700
@@ -39,6 +39,7 @@
 #define RR_NS 2
 #define RR_CNAME 5
 #define RR_SOA 6
+#define RR_MX 15
 #define RR_AAAA 28
 #define RR_ANY 255
 /* These are only used for the {an/ns/ar}_types, and are not real RRs */
--- deadwood-2.9.07/src/DwUdpSocket.c.orig	2010-09-05 05:10:24.000000000 -0700
+++ deadwood-2.9.07/src/DwUdpSocket.c	2010-09-05 05:33:33.000000000 -0700
@@ -503,7 +503,8 @@
  * from the cache */
 int get_reply_from_cache(dw_str *query, sockaddr_all_T *client,
                          SOCKET sock, int32_t id, int resurrect,
-                         int tcp_num, dw_str *orig_query) {
+                         int tcp_num, dw_str *orig_query,
+			 ip_addr_T *from_ip) {
         dw_str *value = 0; /* Element in cache */
         dw_str *comp = 0; /* Compressed DNS packet */
         dw_str *packet = 0;
@@ -518,6 +519,11 @@
 
         dw_log_dwstr("Sending reply for query ",query,100);
         type = dw_fetch_u16(query,-1);
+	if(type == RR_MX && key_n[DWM_N_reject_mx] != 0) {
+		dw_log_ip(
+	"Attempt to get MX record (possible spam zombie) from IP",from_ip,3);
+		return 1;
+	}	
         dwc_process(cache,query,3); /* RR rotation, TTL aging, etc. */
         value = dwh_get(cache,query,resurrect,1);
         cache_type = dw_fetch_u8(value,-1);
@@ -590,8 +596,8 @@
         /* OK, at this point it failed so we'll see if we get a
          * "resurrected" cache entry */
         if(resurrections == 1 &&
-           get_reply_from_cache(query,client,sock,local_id,1,tcp_num,
-                        orig_query) == 1) {
+           get_reply_from_cache(query, client, sock, local_id, 1, tcp_num,
+                        orig_query, from_ip) == 1) {
                 dw_log_string("Resurrected from cache",11);
                 return; /* Resurrected entry; we're done */
         }
@@ -662,8 +668,8 @@
         if(query == 0) {
                 goto catch_get_local_udp_packet;
         }
-        if(get_reply_from_cache(query,&client,sock,local_id,0,-1,orig_query)
-                == 1) {
+        if(get_reply_from_cache(query, &client, sock, local_id, 0, -1,
+			orig_query, &from_ip) == 1) {
                 goto catch_get_local_udp_packet; /* In cache; we're done */
         }
 
@@ -992,7 +998,7 @@
 
         get_reply_from_cache(query,&client,rem[b].local[l]->from_socket,
                         rem[b].local[l]->local_id, 0,-1,
-                        rem[b].local[l]->orig_query);
+                        rem[b].local[l]->orig_query, 0);
 
 catch_send_reply_from_cache:
         if(query != 0) {
--- deadwood-2.9.06/doc/Deadwood.ej	2010-09-03 07:03:38.000000000 -0700
+++ deadwood-2.9.07/doc/Deadwood.ej	2010-09-05 05:42:24.000000000 -0700
@@ -243,6 +243,30 @@
 This has a default value of 0.  In other words, AAAA queries are processed 
 normally unless this is set.
 
+<h2>reject_mx</h2>
+
+When this has the default value of 1, MX queries are silently dropped
+with their IP logged.  A MX query is a query that is only done by a
+machine if it wishes to be its own mail server sending mail to machines
+on the internet.  This is a query an average desktop machine (including
+one that uses Outlook or another mail user agent to read and send email)
+will never make.  
+<p>
+
+Most likely, if a machine is trying to make a MX query, the machine is 
+being controlled by a remote source to send out undesired "spam" email.  
+This in mind, Deadwood will not allow MX queries to be made unless
+reject_mx is explicitly set with a value of 0.
+<p>
+
+Before disabling this, please keep in mind that Deadwood is optimized
+to be used for web surfing, not as a DNS server for a mail hub.
+In particular, the IPs for MX records are removed from Deadwood's
+replies and Deadwood needs to perform additional DNS queries to get the
+IPs corresponding to MX records, and Deadwood's testing is more geared
+for web surfing (almost 100% A record lookup) and not for mail delivery
+(extensive MX record lookup).
+
 <h2>resurrections</h2>
 If this is set to 1, Deadwood will try to send an 
 expired record to the user before giving up.  If it is 0, we 
