Re: BIND 9.20.22 – Recurring SERVFAIL on Internal Recursive Resolvers

[Greg]

Hello.
Curiosity is good. But I stand by needing to upgrade, now! Do that first and see if your issue still exists. But also see below.
A few comments on your reply:
You have redacted a lot, which is generally not helpful to diagnosis.
Your tcpdump would have been better saved to disc, then the low level bits could be analysed offline in Wireshark. However...
You do say, twice, that no matching responses were observed from the Yahoo NS. I sent digs to both (see below) and received responses promptly, which I think supports my theory that you have network issues somewhere. Try manual testing from the command line of your recursive server out to various NS, not just Yahoo's (using their addresses, not names), log the results and talk to your network and firewall people.
Also check your server's hardware, interfaces, routeing table, what other process are running etc. Basic due diligence on the box itself.
Unless you have custom root hints in the file "named.root" you don't need a hint zone at all, as the Internet root hints have been built into BIND for a very long time.
Please consider disabling the stale cache, unless you really understand why you think you need it and how to use it. Here are some references:
https://bind9.readthedocs.io/en/stable/reference.html#namedconf-statement-stale-answer-enable
https://kb.isc.org/docs/changes-to-serve-stale-option-stale-answer-client-timeout-in-bind-918-and-newer
Changes to BIND's serve-stale option stale-answer-client-timeout in BIND 9.18 and newer
kb.isc.org
https://kb.isc.org/docs/serve-stale-implementation-details

My digs:
% dig @27.123.42.42 yahoo.com 

; <<>> DiG 9.20.24 <<>> @27.123.42.42 yahoo.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3646
;; flags: qr aa rd; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1272
; COOKIE: 5ff156dc3958b217010000006ae1aeaf6b65bb33e3c390f2 (good)
;; QUESTION SECTION:
;yahoo.com.			IN	A

;; ANSWER SECTION:
yahoo.com.		1800	IN	A	74.6.143.25
yahoo.com.		1800	IN	A	74.6.231.21
yahoo.com.		1800	IN	A	98.137.11.163
yahoo.com.		1800	IN	A	74.6.143.26
yahoo.com.		1800	IN	A	74.6.231.20
yahoo.com.		1800	IN	A	98.137.11.164

;; Query time: 206 msec
;; SERVER: 27.123.42.42#53(27.123.42.42) (UDP)
;; WHEN: Wed Oct 28 08:13:35 GMT 2026
;; MSG SIZE  rcvd: 162


% dig @68.142.255.16 yahoo.com

; <<>> DiG 9.20.24 <<>> @68.142.255.16 yahoo.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 60657
;; flags: qr aa rd; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1272
; COOKIE: e0e11b4aac46fc8c010000006ae1aeb3064444069e6e622f (good)
;; QUESTION SECTION:
;yahoo.com.			IN	A

;; ANSWER SECTION:
yahoo.com.		1800	IN	A	98.137.11.163
yahoo.com.		1800	IN	A	74.6.143.26
yahoo.com.		1800	IN	A	74.6.231.20
yahoo.com.		1800	IN	A	74.6.143.25
yahoo.com.		1800	IN	A	74.6.231.21
yahoo.com.		1800	IN	A	98.137.11.164

;; Query time: 16 msec
;; SERVER: 68.142.255.16#53(68.142.255.16) (UDP)
;; WHEN: Wed Oct 28 08:13:39 GMT 2026
;; MSG SIZE  rcvd: 162

Cheers, Greg
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20261028/b2d3a296/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: favicon.ico
Type: image/vnd.microsoft.icon
Size: 766 bytes
Desc: not available
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20261028/b2d3a296/attachment-0001.ico>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: ISC-logo-rgb-2048x1149.png
Type: image/png
Size: 512038 bytes
Desc: not available
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20261028/b2d3a296/attachment-0001.png>