resolver and search list question

I have a Solaris box on an internal network that would automatically resolve single label names such as "loghost". For example, if I ping loghost or do a nslookup on loghost, this hostname is automatically resolved to a FQDN loghost.com which is in Korea and would of course be bad for us to send our Intranet syslog messages to.

I initially thought that my Solaris box was trojan'ed. But tesitng on another freshly installed Solaris box shows the same result.

the /etc/resolv.conf files on both boxes contain the following lines:

domain MyInternalDomain.com
nameserver MyInternalDNS1-IP
nameserver MyInternalDNS2-IP

There is no search list defined. Why would the resolver automatically append .com to the single label name?

However, when testing on an external Solaris box that also does not have search list defined in the /etc/resolv.conf, nslookup on loghost would return unknown host message. I think this is normal and acceptable.

Both Solaris boxes are running BIND 8.2.X

Can anyone explain this weired behaviour? Thanks!