Caching and upper case issue with BIND 9.9.7-P3

cypher Nix ciphernix at
Fri Sep 25 19:37:36 UTC 2015

On Wednesday, September 23, 2015 at 11:18:59 AM UTC-4, cypher Nix wrote:
> After upgrading BIND from BIND 9.9.7-P2 to BIND 9.9.7-P3 on about a dozen
> authoritative + recursive servers, we noticed a strange caching issue on one of the servers.
> The server is authoritative for our main domain (let's assume
> There are multiple subdomains under that have been NS delegated to
> other servers. Whenever the DNS server would respond to a recursive "A" record query from its
> cache, the "Answers" part of the request would always be in upper case - such
> as
> More details below
> I noted the following behavior using a packet capture
> -A client requests for "" "A" record.
> -Our server then does a lookup against authoritative server for "A" record "" 
> -Our server gets a response from authoritative server:
> 10 IN    A
> -Our server responds to the clients request for and stores
> the response for 10 seconds (the TTL of the record). At this point the
> answer section is still in all lower case - the clients gets the following:
> 10 IN    A
> -The next time the client queries for, our server responds
> from the cache and changes the case from to EXAMPLE.COM. It
> continues to serve EXAMPLE.COM in upper case as part of the answer while the TTL is still valid.
> 9 IN    A
> -This behavior was observed for "A" record responses for queries under any
> subdomain of  The case was only change to upper case on the
> answer section. also appeared under the question, authority, and
> additional sections but only in the answer section was the case changed.
> We eventually restarted BIND and the issue went
> away. After restarting BIND all responses served from cache are now lower case, as expected.
> Has anyone seen this behavior before ? Is this a bug ?
> This caused issues for certain applications on our network that did string
> comparison and expected the answer section to be in lower case.

Thank you all for your help. I was able to reproduce this behavior in the lab using older versions of BIND (9.9.7 P2 and 9.9.6 P1). I setup two servers in the lab: 1. A recursive server that's also authoritative for and 2. an non recursive server that's authoritative for The zone was delegated to server number 2. I added  multiple sample records to both zones including I first started BIND on server number 2. Upon starting BIND on server number 1, the first query I looked up was All other responses served from cache had EXAMPLE and COM in upper case. 

I will use your responses along with my lab findings to convince the application owners that they must update their code in order to prevent issues in the future.

More information about the bind-users mailing list