I suspect my problem has to do with the fact that <a href="http://imap.gmail.com">imap.gmail.com</a> is a CNAME for <a href="http://gmail-imap.l.google.com">gmail-imap.l.google.com</a>. When queries fail (with the FORMERRs), the responses I see coming back to my DNS server include a CNAME record and two A records. When I do the little hack with a manual query, which makes the server respond successfully for a while, I note that I get a CNAME record with only one A record back from one ISP DNS servers I forward to. <div>
<br></div><div>Also, if I change my iphone/thunderbird applications to use <a href="http://gmail-imap.l.google.com">gmail-imap.l.google.com</a> rather than <a href="http://imap.gmail.com">imap.gmail.com</a>, everything works fine (no FORMERRs or resolution failures).</div>
<div><br></div><div>Does this ring any bells?<br><br><div class="gmail_quote">On Tue, May 5, 2009 at 9:11 PM, Eric Swenson <span dir="ltr"><<a href="mailto:eric@swenson.org">eric@swenson.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
I renamed the forwarders and added a "forward only;" option, and now, while I still can't resolve <a href="http://imap.gmail.com" target="_blank">imap.gmail.com</a>, I now simply get FORMERRs for the two forwarded DNS servers:<div>
<br></div><div><div>May 5 21:05:10 localhost named[12188]: FORMERR resolving '<a href="http://imap.gmail.com/A/IN" target="_blank">imap.gmail.com/A/IN</a>': 66.151.140.2#53</div><div>May 5 21:05:10 localhost named[12188]: FORMERR resolving '<a href="http://imap.gmail.com/A/IN" target="_blank">imap.gmail.com/A/IN</a>': 192.168.3.1#53</div>
<div><br></div><div>Since if I use "dig" or "nslookup" against these two servers directly, (from my router machine) the queries come back fine, what does this mean? I wouldn't think my firewall is to be suspected of causing this since I can issue these requests and get valid answers back, and that traffic would go through the firewall in the same way as requests going through my DNS server, right?</div>
<div><br></div><font color="#888888"><div>-- Eric</div><br></font><div class="gmail_quote"><div class="im">On Tue, May 5, 2009 at 4:08 PM, Kevin Darcy <span dir="ltr"><<a href="mailto:kcd@chrysler.com" target="_blank">kcd@chrysler.com</a>></span> wrote:<br>
</div><div><div></div><div class="h5"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
Eric Swenson wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div>
I apologize for the multiple posts. I didn't think my post was making it to the list since I never received my own post, but have been receiving those of others. And yes, I'm configured to see my own posts.<br>
<br>
A couple people have suggested I look at the trace output of bind to see what server is sending the bad response. I provide some of the trace output below. I certainly don't see anything amiss, and one of the servers that appears to provoke the FORMERR seems to have responded just fine. Here is relevant output (with some stuff deleted due to verbosity):<br>
<br>
05-May-2009 10:49:14.943 dispatch 0x8144b90 response 0x81476b8 192.228.79.201#53: attached to task 0x80ed240<br></div>
05-May-2009 10:49:14.945 resquery 0x8152c70 (fctx 0x812f170(<a href="http://imap.gmail.com/A" target="_blank">imap.gmail.com/A</a>) <<a href="http://imap.gmail.com/A%29" target="_blank">http://imap.gmail.com/A%29</a>>): sent<br>
05-May-2009 10:49:14.945 resquery 0x8152c70 (fctx 0x812f170(<a href="http://imap.gmail.com/A" target="_blank">imap.gmail.com/A</a>) <<a href="http://imap.gmail.com/A%29" target="_blank">http://imap.gmail.com/A%29</a>>): senddone<div>
<br>
05-May-2009 10:49:14.945 dispatch 0x8149a70: got packet: requests 0, buffers 2, recvs 1<br>
05-May-2009 10:49:14.945 dispatch 0x8149a70: shutting down; detaching from sock 0x81418f0, task 0x8141a20<br>
05-May-2009 10:49:14.965 socket 0x8141460 192.228.79.201#53: packet received correctly<br>
05-May-2009 10:49:14.966 dispatch 0x8144b90: got packet: requests 1, buffers 1, recvs 1<br>
05-May-2009 10:49:14.966 dispatch 0x8144b90: got valid DNS message header, /QR 1, id 47066<br></div>
05-May-2009 10:49:14.966 resquery 0x8152c70 (fctx 0x812f170(<a href="http://imap.gmail.com/A" target="_blank">imap.gmail.com/A</a>) <<a href="http://imap.gmail.com/A%29" target="_blank">http://imap.gmail.com/A%29</a>>): response<div>
<br>
05-May-2009 10:49:14.967 received packet:<br>
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47066<br>
;; flags: qr rd ra ; QUESTION: 1, ANSWER: 3, AUTHORITY: 4, ADDITIONAL: 4<br>
;; QUESTION SECTION:<br></div>
;<a href="http://imap.gmail.com" target="_blank">imap.gmail.com</a> <<a href="http://imap.gmail.com" target="_blank">http://imap.gmail.com</a>>. IN A<br>
<br>
;; ANSWER SECTION:<br>
<a href="http://imap.gmail.com" target="_blank">imap.gmail.com</a> <<a href="http://imap.gmail.com" target="_blank">http://imap.gmail.com</a>>. 241 IN CNAME <a href="http://gmail-imap.l.google.com" target="_blank">gmail-imap.l.google.com</a> <<a href="http://gmail-imap.l.google.com" target="_blank">http://gmail-imap.l.google.com</a>>.<br>
<a href="http://gmail-imap.l.google.com" target="_blank">gmail-imap.l.google.com</a> <<a href="http://gmail-imap.l.google.com" target="_blank">http://gmail-imap.l.google.com</a>>. 241 IN A 209.85.201.111<br>
<a href="http://gmail-imap.l.google.com" target="_blank">gmail-imap.l.google.com</a> <<a href="http://gmail-imap.l.google.com" target="_blank">http://gmail-imap.l.google.com</a>>. 241 IN A 209.85.201.109<br>
<br>
;; AUTHORITY SECTION:<br>
<a href="http://gmail.com" target="_blank">gmail.com</a> <<a href="http://gmail.com" target="_blank">http://gmail.com</a>>. 76384 IN NS <a href="http://ns4.google.com" target="_blank">ns4.google.com</a> <<a href="http://ns4.google.com" target="_blank">http://ns4.google.com</a>>.<br>
<a href="http://gmail.com" target="_blank">gmail.com</a> <<a href="http://gmail.com" target="_blank">http://gmail.com</a>>. 76384 IN NS <a href="http://ns1.google.com" target="_blank">ns1.google.com</a> <<a href="http://ns1.google.com" target="_blank">http://ns1.google.com</a>>.<br>
<a href="http://gmail.com" target="_blank">gmail.com</a> <<a href="http://gmail.com" target="_blank">http://gmail.com</a>>. 76384 IN NS <a href="http://ns2.google.com" target="_blank">ns2.google.com</a> <<a href="http://ns2.google.com" target="_blank">http://ns2.google.com</a>>.<br>
<a href="http://gmail.com" target="_blank">gmail.com</a> <<a href="http://gmail.com" target="_blank">http://gmail.com</a>>. 76384 IN NS <a href="http://ns3.google.com" target="_blank">ns3.google.com</a> <<a href="http://ns3.google.com" target="_blank">http://ns3.google.com</a>>.<br>
<br>
;; ADDITIONAL SECTION:<br>
<a href="http://ns4.google.com" target="_blank">ns4.google.com</a> <<a href="http://ns4.google.com" target="_blank">http://ns4.google.com</a>>. 77136 IN A 216.239.38.10<br>
<a href="http://ns1.google.com" target="_blank">ns1.google.com</a> <<a href="http://ns1.google.com" target="_blank">http://ns1.google.com</a>>. 77136 IN A 216.239.32.10<br>
<a href="http://ns2.google.com" target="_blank">ns2.google.com</a> <<a href="http://ns2.google.com" target="_blank">http://ns2.google.com</a>>. 77136 IN A 216.239.34.10<br>
<a href="http://ns3.google.com" target="_blank">ns3.google.com</a> <<a href="http://ns3.google.com" target="_blank">http://ns3.google.com</a>>. 77136 IN A 216.239.36.10<br>
</blockquote>
This is a little suspect. Usually when you have a CNAME and A records in the Answer Section, the Authority Section contains NS records for the zone containing the A record (in this case, <a href="http://gmail-imap.l.google.com" target="_blank">gmail-imap.l.google.com</a>). Here, however, the Authority Section contains NS records for the zone containing the CNAME itself (<a href="http://imap.gmail.com" target="_blank">imap.gmail.com</a>). Odd. When I query the name, I get the <a href="http://l.google.com" target="_blank">l.google.com</a> NS records in Authority.<br>
<br>
I'm not sure, however, that this anomaly alone is sufficient to cause problems.<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
<br>
05-May-2009 10:49:14.967 fctx 0x812f170(<a href="http://imap.gmail.com/A" target="_blank">imap.gmail.com/A</a>' <<a href="http://imap.gmail.com/A%27" target="_blank">http://imap.gmail.com/A%27</a>>): answer_response<br>
05-May-2009 10:49:14.968 fctx 0x812f170(<a href="http://imap.gmail.com/A" target="_blank">imap.gmail.com/A</a>' <<a href="http://imap.gmail.com/A%27" target="_blank">http://imap.gmail.com/A%27</a>>): noanswer_response<br>
05-May-2009 10:49:14.968 fctx 0x812f170(<a href="http://imap.gmail.com/A" target="_blank">imap.gmail.com/A</a>' <<a href="http://imap.gmail.com/A%27" target="_blank">http://imap.gmail.com/A%27</a>>): cancelquery<div>
<br>
05-May-2009 10:49:14.968 dispatch 0x8144b90 response 0x81476b8 192.228.79.201#53: detaching from task 0x80ed240<br>
05-May-2009 10:49:14.968 dispatch 0x8144b90: detach: refcount 0<br></div>
05-May-2009 10:49:14.968 fctx 0x812f170(<a href="http://imap.gmail.com/A" target="_blank">imap.gmail.com/A</a>' <<a href="http://imap.gmail.com/A%27" target="_blank">http://imap.gmail.com/A%27</a>>): add_bad<br>
05-May-2009 10:49:14.969 FORMERR resolving '<a href="http://imap.gmail.com/A/IN" target="_blank">imap.gmail.com/A/IN</a> <<a href="http://imap.gmail.com/A/IN" target="_blank">http://imap.gmail.com/A/IN</a>>': 192.228.79.201#53<div>
<br>
<br>
Does this trace output suggest what is going wrong? -- Eric<br>
<br></div><div>
On Tue, May 5, 2009 at 9:53 AM, Eric Swenson <<a href="mailto:eric@swenson.org" target="_blank">eric@swenson.org</a> <mailto:<a href="mailto:eric@swenson.org" target="_blank">eric@swenson.org</a>>> wrote:<br>
<br>
I'm seeing lots of DNS resolution failures on my router (running<br>
Utuntu 8.10, bind 9.3.4). While most succeed, I get quite a few<br>
FORMERR errors similar to:<br>
<br>
May 4 20:25:25 localhost named[19579]: FORMERR resolving<br></div>
'<a href="http://imap.gmail.com/A/IN" target="_blank">imap.gmail.com/A/IN</a> <<a href="http://imap.gmail.com/A/IN" target="_blank">http://imap.gmail.com/A/IN</a>>': 66.151.140.2#53<div><br>
May 4 20:25:25 localhost named[19579]: FORMERR resolving<br></div>
'<a href="http://imap.gmail.com/A/IN" target="_blank">imap.gmail.com/A/IN</a> <<a href="http://imap.gmail.com/A/IN" target="_blank">http://imap.gmail.com/A/IN</a>>': 192.168.3.1#53<div><br>
May 4 20:25:25 localhost named[19579]: FORMERR resolving<br></div>
'<a href="http://imap.gmail.com/A/IN" target="_blank">imap.gmail.com/A/IN</a> <<a href="http://imap.gmail.com/A/IN" target="_blank">http://imap.gmail.com/A/IN</a>>': 192.112.36.4#53<div><br>
May 4 20:25:25 localhost named[19579]: FORMERR resolving<br></div>
'<a href="http://imap.gmail.com/A/IN" target="_blank">imap.gmail.com/A/IN</a> <<a href="http://imap.gmail.com/A/IN" target="_blank">http://imap.gmail.com/A/IN</a>>': 128.63.2.53#53<div><br>
May 4 20:25:25 localhost named[19579]: FORMERR resolving<br></div>
'<a href="http://imap.gmail.com/A/IN" target="_blank">imap.gmail.com/A/IN</a> <<a href="http://imap.gmail.com/A/IN" target="_blank">http://imap.gmail.com/A/IN</a>>': 192.228.79.201#53<div><br>
May 4 20:25:25 localhost named[19579]: FORMERR resolving<br></div>
'<a href="http://imap.gmail.com/A/IN" target="_blank">imap.gmail.com/A/IN</a> <<a href="http://imap.gmail.com/A/IN" target="_blank">http://imap.gmail.com/A/IN</a>>': 192.36.148.17#53<div><br>
May 4 20:25:25 localhost named[19579]: FORMERR resolving<br></div>
'<a href="http://imap.gmail.com/A/IN" target="_blank">imap.gmail.com/A/IN</a> <<a href="http://imap.gmail.com/A/IN" target="_blank">http://imap.gmail.com/A/IN</a>>': 202.12.27.33#53<div><br>
May 4 20:25:25 localhost named[19579]: FORMERR resolving<br></div>
'<a href="http://imap.gmail.com/A/IN" target="_blank">imap.gmail.com/A/IN</a> <<a href="http://imap.gmail.com/A/IN" target="_blank">http://imap.gmail.com/A/IN</a>>': 192.33.4.12#53<div><br>
May 4 20:25:25 localhost named[19579]: FORMERR resolving<br></div>
'<a href="http://imap.gmail.com/A/IN" target="_blank">imap.gmail.com/A/IN</a> <<a href="http://imap.gmail.com/A/IN" target="_blank">http://imap.gmail.com/A/IN</a>>': 192.5.5.241#53<div><br>
May 4 20:25:25 localhost named[19579]: FORMERR resolving<br></div>
'<a href="http://imap.gmail.com/A/IN" target="_blank">imap.gmail.com/A/IN</a> <<a href="http://imap.gmail.com/A/IN" target="_blank">http://imap.gmail.com/A/IN</a>>': 192.58.128.30#53<div><br>
May 4 20:25:25 localhost named[19579]: FORMERR resolving<br></div>
'<a href="http://imap.gmail.com/A/IN" target="_blank">imap.gmail.com/A/IN</a> <<a href="http://imap.gmail.com/A/IN" target="_blank">http://imap.gmail.com/A/IN</a>>': 128.8.10.90#53<div><br>
May 4 20:25:25 localhost named[19579]: FORMERR resolving<br></div>
'<a href="http://imap.gmail.com/A/IN" target="_blank">imap.gmail.com/A/IN</a> <<a href="http://imap.gmail.com/A/IN" target="_blank">http://imap.gmail.com/A/IN</a>>': 198.41.0.4#53<div><br>
May 4 20:25:25 localhost named[19579]: FORMERR resolving<br></div>
'<a href="http://imap.gmail.com/A/IN" target="_blank">imap.gmail.com/A/IN</a> <<a href="http://imap.gmail.com/A/IN" target="_blank">http://imap.gmail.com/A/IN</a>>': 192.203.230.10#53<div><br>
May 4 20:25:25 localhost named[19579]: FORMERR resolving<br></div>
'<a href="http://imap.gmail.com/A/IN" target="_blank">imap.gmail.com/A/IN</a> <<a href="http://imap.gmail.com/A/IN" target="_blank">http://imap.gmail.com/A/IN</a>>': 193.0.14.129#53<div><br>
May 4 20:25:25 localhost named[19579]: FORMERR resolving<br></div>
'<a href="http://imap.gmail.com/A/IN" target="_blank">imap.gmail.com/A/IN</a> <<a href="http://imap.gmail.com/A/IN" target="_blank">http://imap.gmail.com/A/IN</a>>': 199.7.83.42#53<br>
<br>
</blockquote>
Most of those are root servers, I'd highly doubt that you're getting FORMERR responses directly back from them. In fact, I tried that same query myself, and didn't get a FORMERR. My guess is that something is munging the packets before they get back to you.<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div>
<br>
<br>
I'm running an iptables firewall on this box, which is connected<br>
to the internet via a wireless access point on my roof with a link<br>
to my ISP. As a result of the above FORMERRs, clients on my lan<br>
are unable to resolve addresses -- in the above<br></div>
case, <a href="http://imap.gmail.com" target="_blank">imap.gmail.com</a> <<a href="http://imap.gmail.com" target="_blank">http://imap.gmail.com</a>>, and therefore are<div><br>
unable to access mail. Upon the recommendations of someone<br>
familiar with the relevant technologies, I've updated my DNS<br>
(named.conf) to set the edns-udp-size 500 option. This had no<br>
effect. <br>
If I use dig to resolve <a href="http://imap.gmail.com" target="_blank">imap.gmail.com</a><br></div>
<<a href="http://imap.gmail.com" target="_blank">http://imap.gmail.com</a>> manually, by specifying any of the<div><br>
above-mentioned DNS servers, everything works fine. Also, when<br>
clients within my network fail to have <a href="http://imap.gmail.com" target="_blank">imap.gmail.com</a><br></div>
<<a href="http://imap.gmail.com" target="_blank">http://imap.gmail.com</a>> resolve, I can "fix" things for a short<div><br>
while, by simply issuing the following:<br>
<br>
nslookup<br>
set querytype=ns<br></div>
<a href="http://gmail.com" target="_blank">gmail.com</a> <<a href="http://gmail.com" target="_blank">http://gmail.com</a>>.<div><br>
lserver <<a href="http://whatever-the-ns-server-is-for-gmail.com" target="_blank">whatever-the-ns-server-is-for-gmail.com</a><br></div>
<<a href="http://whatever-the-ns-server-is-for-gmail.com" target="_blank">http://whatever-the-ns-server-is-for-gmail.com</a>>><br>
set querytype=a<br>
<a href="http://imap.gmail.com" target="_blank">imap.gmail.com</a> <<a href="http://imap.gmail.com" target="_blank">http://imap.gmail.com</a>><div><br>
<br>
Once I've done the above, my DNS server caches the A record for<br></div>
<a href="http://imap.gmail.com" target="_blank">imap.gmail.com</a> <<a href="http://imap.gmail.com" target="_blank">http://imap.gmail.com</a>> and happily hands it out<div><br>
until the cache time is exceeded, when I'm back getting FORMERRs<br></div>
and failing to resolve <a href="http://imap.gmail.com" target="_blank">imap.gmail.com</a> <<a href="http://imap.gmail.com" target="_blank">http://imap.gmail.com</a>>.<div><br>
<br>
There are other addresses than <a href="http://imap.gmail.com" target="_blank">imap.gmail.com</a><br></div>
<<a href="http://imap.gmail.com" target="_blank">http://imap.gmail.com</a>> that cannot be resolved due to FORMERRs,<div><br>
but this domain name is the most prevalent, and most annoying,<br>
since it prevents users within my network from getting mail.<br>
<br>
Since I can force my DNS to resolve these addresses by issuing the<br>
above queries, I'm wondering if the problem is due to having the<br>
following in my named.conf:<br>
<br>
forwarders {<br>
192.168.3.1;<br>
66.151.140.2;<br>
};<br>
<br>
My ISP provides the above two DNS servers and I have mine<br>
delegating to theirs. <br>
</div></blockquote>
Don't know what you mean by that. Delegation is from a parent *zone* to a child *zone*. It's a relationship between records in the DNS database. Did you mean "forwarding" perhaps? "Delegating" seems to be the wrong word.<br>
<br>
Note that if you don't specify "forward only", the default forwarding mode is "forward first", which means named tries the forwarders, and if that doesn't work, then it falls back to iterative resolution, starting back up at the root zone, if necessary. An absence of "forward only" would explain why you're seeing queries directly to the root servers in addition to your forwarders. I would suggest turning on "forward only" until you get this sorted out -- the root servers don't need more "junk traffic" than they're already getting, and since you're not accepting, and not caching, those allegedly-FORMERR responses that you're seeing, you'll keep going back to the roots over and over again.<div>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
Perhaps one of these two DNS servers (or any that they forward to)<br>
is having problems (perhaps no EDNS0 support?), which causes the<br>
FORMERRs to be reported by my DNS server.<br>
<br>
I haven't yet tried removing the forwarders. I figured this was<br>
not the issue because the FORMERR log messages suggest (to me)<br>
that my DNS is trying to contact the root servers itself (and not<br>
relying on the downstream DNS servers to do so). <br>
Does anyone have ideas about what is going on?<br>
<br>
</blockquote>
<br></div>
Time to break out the packet sniffer and see what's really going on.<br>
<br>
- Kevin<br>
<br>
<br>
_______________________________________________<br>
bind-users mailing list<br>
<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
</blockquote></div></div></div><br></div>
</blockquote></div><br></div>