SERVFAIL error during the evening

Wed Jun 19 12:17:44 UTC 2024

Hello Michael 
Thank you for your response. Here is a pcap file and some logs. Thank you in advance.

Regards Sami

-----Message d'origine-----
De : bind-users <bind-users-bounces at lists.isc.org> De la part de bind-users-request at lists.isc.org
Envoyé : vendredi 14 juin 2024 01:46
À : bind-users at lists.isc.org
Objet : bind-users Digest, Vol 4486, Issue 1

--------------------------------------------------------------------------------------------------------------
CAUTION : This email originated outside the company. Do not click on any links or open attachments unless you are expecting them from the sender.

ATTENTION : Cet e-mail provient de l'extérieur de l'entreprise. Ne cliquez pas sur les liens ou n'ouvrez pas les pièces jointes à moins de connaitre l'expéditeur.
--------------------------------------------------------------------------------------------------------------

Send bind-users mailing list submissions to
	bind-users at lists.isc.org

To subscribe or unsubscribe via the World Wide Web, visit
	https://lists.isc.org/mailman/listinfo/bind-users
or, via email, send a message with subject or body 'help' to
	bind-users-request at lists.isc.org

You can reach the person managing the list at
	bind-users-owner at lists.isc.org

When replying, please edit your Subject line so it is more specific than "Re: Contents of bind-users digest..."

Today's Topics:

   1. Question about ISC BIND COPR repositories for 9.16->9.18 ESV
      transition (Sebby, Brian A.)
   2. Re: SERVFAIL error during the evening (Mark Andrews)
   3. SERVFAIL error during the evening (Michael Batchelder)

----------------------------------------------------------------------

Message: 1
Date: Thu, 13 Jun 2024 23:32:33 +0000
From: "Sebby, Brian A." <sebby at anl.gov>
To: "bind-users at lists.isc.org" <bind-users at lists.isc.org>
Subject: Question about ISC BIND COPR repositories for 9.16->9.18 ESV
	transition
Message-ID:
	<PH0PR09MB74181E0653E330705ABFED0EA6C12 at PH0PR09MB7418.namprd09.prod.outlook.com>

Content-Type: text/plain; charset="utf-8"

We?ve been using the ISC BIND 9 COPR repositories at https://copr.fedorainfracloud.org/coprs/isc/ for a few years now, but I had a question ? is there a planned date to update the ?bind-esv? channel to provide BIND 9.18 rather than BIND 9.16?  Since 9.16 is now EOL we?ve switched to using the stable channel to get 9.18, but I just want to make sure that we switch back to the ESV channel once it provides 9.18 so we don?t accidentally switch to a new version once 9.20 becomes the new stable release.

(And I do want to say thanks to ISC for providing that repo ? I spent years having to compile BIND myself on Solaris, and it?s so much nicer to just install it from packages on Linux. ? )

Thanks,

Brian

--
Brian Sebby (he/him/his)      |  Lead Systems Engineer
Email: sebby at anl.gov<mailto:sebby at anl.gov>          |  Information Technology Infrastructure
Phone: +1 630.252.9935        |  Business Information Services
Cell:  +1 630.921.4305        |  Argonne National Laboratory
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20240613/8b877d05/attachment-0001.htm>

------------------------------

Message: 2
Date: Fri, 14 Jun 2024 09:33:03 +1000
From: Mark Andrews <marka at isc.org>
To: sami.rahal at sofrecom.com
Cc: ML BIND Users <bind-users at lists.isc.org>
Subject: Re: SERVFAIL error during the evening
Message-ID: <5FA5E823-FAE8-49E9-927E-DEA7D2D884A6 at isc.org>
Content-Type: text/plain;	charset=us-ascii

Before you do anything else change your rndc shared key as you published it.

> On 14 Jun 2024, at 01:00, sami.rahal at sofrecom.com wrote:
> 
> Hello community,
>  We are experiencing a resolution problem: 'SERVFAIL error'. Our environment is BIND 9.16.48, OS: Redhat8. I am sharing with you a part of the log that contains this error, named.conf file.
>  What I've noticed is that the resolution problem is mainly related to domain names that contain a CNAME record in the response, such as 'account.api.here.com' and 'push-rtmp-l96.douyincdn.com'
>  P.S. DNSSEC is temporarily disabled to facilitate the diagnosis of the issue.
>   Regards  Orange Restricted
>  <namedstats.txt><queryerrors.txt><named.conf>--
> Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe 
> from this list
> 
> ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.
> 
> 
> bind-users mailing list
> bind-users at lists.isc.org
> https://lists.isc.org/mailman/listinfo/bind-users

--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742              INTERNET: marka at isc.org

------------------------------

Message: 3
Date: Fri, 14 Jun 2024 00:45:51 +0000 (UTC)
From: Michael Batchelder <michael at isc.org>
To: bind-users <bind-users at lists.isc.org>
Subject: SERVFAIL error during the evening
Message-ID: <2035546438.1953209.1718325951092.JavaMail.zimbra at isc.org>
Content-Type: text/plain; charset="utf-8"

Sami, 

After you regenerate your rndc key as Mark advised, you will need to provide us with more information, as what you've sent is not sufficient to troubleshoot your symptom. As a first step, take a packet capture on the resolver that shows incoming queries from the client and the corresponding outgoing queries from the resolver to upstream servers. When you capture packets, do not filter out TCP or ICMP or ARP. A tcpdump filter such as 'icmp or arp or port 53' should be sufficient. I would capture on all interfaces of the server (-i any). 

Send that capture file along with the BIND log segment which contains the failed queries. 

Michael Batchelder 
ISC Support 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20240614/41b30a50/attachment.htm>

------------------------------

Subject: Digest Footer

_______________________________________________
ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.

bind-users mailing list
bind-users at lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users

------------------------------

End of bind-users Digest, Vol 4486, Issue 1
*******************************************
-------------- next part --------------
A non-text attachment was scrubbed...
Name: dns_traffic.zip
Type: application/x-zip-compressed
Size: 2605776 bytes
Desc: dns_traffic.zip
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20240619/6213c836/attachment-0001.bin>