BIND started replying to queries for .com with .COM

Mike Bernhardt bernhardt at
Wed Mar 30 21:21:39 UTC 2016

I think you misunderstood me. I was getting back google.COM even when I
queried the server using nslookup from a command prompt on my Windows
desktop. The probe was failing because it is case-sensitive, but that was
the symptom, not the problem.

For example:

Non-authoritative answer:
Name:    google.COM
Addresses:  2607:f8b0:4005:801::200e

Given that the problem cleared after restarting BIND on its CentOS host, I'd
say the problem was BIND.

-----Original Message-----
From: Mark Andrews [mailto:marka at] 
Sent: Tuesday, March 29, 2016 5:19 PM
To: Mike Bernhardt
Cc: bind-users at
Subject: Re: BIND started replying to queries for .com with .COM

Your monitoring probe is broken.

STD 13 says that that the DNS is case preserving.  The problem is that lots
of servers aren't case preserving instead they echo back the query case in
the owner names of records returned which named then records.

In message <030101d18a06$fa21c8d0$ee655a70$>, "Mike Bernhardt"
> I rebooted one of our BIND VMs this morning. It's running BIND 
> 9.10.3-P3. We noticed that queries for domains with were 
> answered with domain.COM with the .COM in capital letters. Other 
> high-levels like .org were not changed. It caused a monitoring probe 
> to complain because it wasn't getting back what it asked for.
> Restarting bind on this server fixed the problem. Any ideas on what 
> happened, or where to look?
> _______________________________________________
> Please visit to 
> unsubscribe from this list
> bind-users mailing list
> bind-users at
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: marka at

More information about the bind-users mailing list