strange dig behavior

Taylor, Gord gord.taylor at
Mon Dec 21 11:15:33 UTC 2009

Also need to ensure the allow-query-cache ACL on the recursive server allows the client. Otherwise, name resolution may work the first time (allow-recursion), but not the 2nd time (allow-query-cache) since the result is cached.

Sent from my BlackBerry

----- Original Message -----
From: at < at>
To: comp-protocols-dns-bind at <comp-protocols-dns-bind at>
Sent: Sun Dec 20 22:59:12 2009
Subject: Re: strange dig behavior

In article <mailman.18.1261358139.21153.bind-users at>,
 Pamela Rock <prock111 at> wrote:

> I've got the following three scenarios
> The client can query a domain A residing on a recursive name server.

What do you mean by a domain "residing" on a recursive nameserver?  If a 
domain resides on a server, the server should be authoritative for that 

> The client can query a domain B on an authratative name server.
> When client queries domain B through the RNS, a Status: refused results.
> I don't know what is causing the refused.  IP tables is off everywhere, and 
> there are no ACL's on routers or firewalls.  
> The only error I'm seeing is the following in the debug log
> 20-Dec-2009 19:21:09.443 query-errors: debug 3: client 
> query failed (REFUSED) for at query.c:3882
> I'm running bind 9.6.1 on RH ES 5 64 bit O/S.  Any ideas?  Thanks!!

Is that log on the recursive nameserver or the authoritative nameserver?

If it's on the recursive server, is the client in the allow-recursion 
ACL on the server?

If it's on the authoritative server, is the recursive server in the 
allow-query ACL?

Barry Margolin, barmar at
Arlington, MA
*** PLEASE don't copy me on replies, I'll read them in the group ***
bind-users mailing list
bind-users at

This e-mail may be privileged and/or confidential, and the sender does not waive
any related rights and obligations. Any distribution, use or copying of this e-mail or the information
it contains by other than an intended recipient is unauthorized.
If you received this e-mail in error, please advise me (by return e-mail or otherwise) immediately.

Ce courriel peut contenir des renseignements protégés et confidentiels.
L’expéditeur ne renonce pas aux droits et obligations qui s’y rapportent.
Toute diffusion, utilisation ou copie de ce courriel ou des renseignements qu’il contient
par une personne autre que le destinataire désigné est interdite.
Si vous recevez ce courriel par erreur, veuillez m’en aviser immédiatement, 
par retour de courriel ou par un autre moyen.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <>

More information about the bind-users mailing list