newbie cache data problem

[Kevin Darcy]

Todd Flom wrote:

> Hi, all, got a problem resolving domains on my local primary, I can't
> figure out what's missing. Here's what I get from nslookup:
>
> >ns1:~ # nslookup a.root-servers.net
> >Server: ns1.flom2.com
> >Address: 209.150.221.117
> >
> >Non-authoritative answer:
> >Name:  a.root-servers.net
> >Address: 198.41.0.4
>
> >ns1:~ # nslookup 198.41.0.4
> >Server: ns1.flom2.com
> >Address: 209.150.221.117
> >
> >*** ns1.flom2.com can't find 198.41.0.4: No response from server
>
> okay, so my hint file only works one way?

Yes. As opposed to a "hosts" file, A and PTR records in DNS only work one
way, specifying only name-to-address or address-to-name mappings,
respectively.  Most if not all of the root nameservers, however, lack
PTR's, probably because they specifically want to discourage _ad_hoc_
queries from people running nslookup.

> Now I look up a domain I own ( flom.com ) that's hosted on a remote
> server:
>
> >ns1:~ # nslookup flom.com
> >Server: ns1.flom2.com
> >Address: 209.150.221.117
> >
> >Non-authoritative answer:
> >Name:  flom.com
> >Address: 206.145.13.1
>
> It must have cached this somehow, because when I lookup the domain that
> hosts it:
>
> >ns1:~ # nslookup black-hole.com
> >Server: ns1.flom2.com
> >Address: 209.150.221.117
> >
> >*** ns1.flom2.com can't find black-hole.com: Server failed
>
> Anyone have any ideas on stuff to try, I've consulted the Bat book but
> it only tells me to check the syslog, not possible problems/solutions.

(The "bat" book is _Sendmail_. I assume you mean the "grasshopper" book.)

I disagree. The book tells you about dumping the nameserver's database
(Chapter 13), or turning on debugging (Chapter 12), and interpreting the
generated output in either case.

Do you have full DNS connectivity to the Internet? If not, then you
shouldn't be using an Internet hints file; instead, you should be
forwarding to another server for all of your Internet names. This too is
explained in the book, although, somewhat non-intuitively, it's in the
DNS and Internet Firewalls section (which makes sense after some
reflection, since effectively any time you lack full Internet connectivity
you *are* behind a "firewall" of sorts).


- Kevin