Odd log entries ?

[Barry Margolin]

In article <199912211239.HAA20090 at advdata.net>,  <wwebb at adni.net> wrote:
>What is the meaning of log entries like these:
>
>Dec 21 07:02:28 glr named[7922]: bad referral (com !< penguin.com)
>Dec 21 07:02:28 glr last message repeated 11 times
>
>Dec 20 14:19:27 glr named[7922]: bad referral (com !< dtindustries.com)
>Dec 20 14:19:27 glr last message repeated 11 times

This is related to lame delegations.  Your server was trying to look
something up in the penguin.com domain.  When it queried one of the servers
that the domain is delegated to, instead of getting a response or a
referral to a subdomain server, it received a referral back to the .COM
servers.  It looks to me like the lame servers are ns1.one.net and
ns2.one.net.

In the case of dtindustries.com, the lame server is ns4.cw.net:

; <<>> DiG 2.2 <<>> dtindustries.com soa @ns4.cw.net +norecurse 
; (1 server found)
;; res options: init defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10
;; flags: qr ra; Ques: 1, Ans: 0, Auth: 12, Addit: 12
;; QUESTIONS:
;;	dtindustries.com, type = SOA, class = IN

;; AUTHORITY RECORDS:
com.	518124	NS	A.ROOT-SERVERS.NET.
com.	518124	NS	H.ROOT-SERVERS.NET.
com.	518124	NS	C.ROOT-SERVERS.NET.
com.	518124	NS	G.ROOT-SERVERS.NET.
com.	518124	NS	F.GTLD-SERVERS.NET.
com.	518124	NS	F.ROOT-SERVERS.NET.
com.	518124	NS	B.ROOT-SERVERS.NET.
com.	518124	NS	I.ROOT-SERVERS.NET.
com.	518124	NS	E.ROOT-SERVERS.NET.
com.	518124	NS	D.ROOT-SERVERS.NET.
com.	518124	NS	J.GTLD-SERVERS.NET.
com.	518124	NS	K.GTLD-SERVERS.NET.

-- 
Barry Margolin, barmar at bbnplanet.com
GTE Internetworking, Powered by BBN, Burlington, MA
*** DON'T SEND TECHNICAL QUESTIONS DIRECTLY TO ME, post them to newsgroups.
Please DON'T copy followups to me -- I'll assume it wasn't posted to the group.