Sometimes users get host unknown

David Nolan vitroth+ at
Tue Jun 13 11:50:28 UTC 2006

--On Tuesday, June 13, 2006 11:23:38 +0100 Andrew Watkins 
<andrew at> wrote:

>              86400   IN      NS
>              86400   IN      NS
> ;; Received 101 bytes from in 150 ms
> dig: Couldn't find server '': Name or service not known
> Any pointers?

I recently encountered a similar situation when one of our users was 
complaining about inability to send mail to users in the domain. 
In the course of debugging the problem I discovered one small failing of 
'dig +trace ....', it doesn't display or use the glue records provided 
during the DNS traversal.  i.e. provides both the two NS 
records dig is displaying, and an A record for  You can 
verify this yourself via 'dig ns'.  Since dig 
is not using the glue records, in order to do the next hop it relies on 
your resolver library to lookup  I suspect that your 
nameserver is unable to resolve that name.

However I bet if you do the next hop lookup yourself it will work, i.e. 
'dig @'.  In my case this led to the interesting 
discovery that bind was unable to do that query but running dig from a 
shell on my nameserver, directly to the same target nameserver, worked 
fine.  I then started looking at packet traces and discovered that all of 
my nameservers which were having problems talking to name servers 
were sending packets from the same udp source port, 32768, and not getting 
any response.  Restarting bind caused it to pick a new source port and the 
queries started working.  Thus I came to the conclusion that had 
a firewall that was breaking dns queries to their servers.  I've 
temporarily configured my servers not to send from that port (via 
'avoid-v4-udp-ports {32768;};'), but thats just a hack workaround. 
Unfortunately the whois records contain no contact information, 
and I've not received any response to the message I sent to their published 
contact address.  (If anyone has a contact at, please pass this & 
my name along...)

I dont' know if your problem will be similar, but hopefully this gives you 
some ideas for debugging...

-David Nolan
 Network Software Designer
 Computing Services
 Carnegie Mellon University

More information about the bind-users mailing list