Bind 8.3.0

[Mark_Andrews at isc.org]

> Recently upgraded our servers to Bind.8.3.0.
> 
> All traffic seems to be normal except for etrade.  Anyone got any ideas?
> Nslookup on etrade.com works every time, nslookup on www.etrade.com
> gives NXDOMAIN
> 
> > etrade.com 
> Server:  ns1.caro.net
> Address:  64.132.40.3
> 
> Non-authoritative answer:
> Name:    etrade.com
> Address:  167.216.172.33
> 
> > www.etrade.com
> Server:  ns1.caro.net
> Address:  64.132.40.3
> 
> *** ns1.caro.net can't find www.etrade.com: Non-existent host/domain
> 
> At the same time I try to lookup www.etrade.com I get the following log
> errors:
> Feb  6 10:31:05 ns1 named[331]: refused query on non-query socket from
> [12.153.224.159].53
> Feb  6 10:31:10 ns1 named[331]: refused query on non-query socket from
> [12.153.224.159].53
> Feb  6 10:31:39 ns1 named[331]: refused query on non-query socket from
> [167.216.172.63].53
> Feb  6 10:31:49 ns1 named[331]: refused query on non-query socket from
> [198.93.32.18].53
> Feb  6 10:31:54 ns1 named[331]: refused query on non-query socket from
> [198.93.32.18].53

	Their servers are broken.  The don't like EDNS queries which is
	OK.  What is not OK is that they don't set "qr" when sending
	formerr.  The also send six additional octets at the end of
	the message which is not correct but will be ignored.

	This is basic RFC 103[45].  When you reply you set "qr".

	Mark

08:27:37.236802 130.155.191.236.2218 > 198.93.32.18.53:  12520 [1au] A? www.etra
de.com. OPT  UDPsize=4096 (43)
                         4500 0047 9b13 0000 4011 b69b 829b bfec
                         c65d 2012 08aa 0035 0033 e717 30e8 0000
                         0001 0000 0000 0001 0377 7777 0665 7472
                         6164 6503 636f 6d00 0001 0001 0000 2910
                         0000 0000 0000 00
08:27:38.038901 198.93.32.18.53 > 130.155.191.236.2218:  12520 [b2&3=0x1] [0q] (
12)
                         4500 0028 af67 0000 ed11 f565 c65d 2012
                         829b bfec 0035 08aa 0014 9d06 30e8 0001
                         0000 0000 0000 0000 0000 0000 0000

> 
> 
> Seems like all other sites are working fine....
> 
> Morgan A. Miskell
> Carolina Internet
> 704-643-8330 x206
> ------------------------------------------------------------------------
> ----
> The information contained in this e-mail is confidential and is intended
> only for the named recipient(s). If you are not the intended recipient
> you must not copy, distribute, or take any action or reliance on it. If
> you have received this e-mail in error, please notify the sender. Any
> unauthorized disclosure of the information contained in this e-mail is
> strictly prohibited.
> ------------------------------------------------------------------------
> ----
> 
> 
> 
> 
> 
--
Mark Andrews, Internet Software Consortium
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: Mark.Andrews at isc.org