I apologize for the multiple posts. I didn't think my post was making it to the list since I never received my own post, but have been receiving those of others. And yes, I'm configured to see my own posts.<div><br>
</div><div>A couple people have suggested I look at the trace output of bind to see what server is sending the bad response. I provide some of the trace output below. I certainly don't see anything amiss, and one of the servers that appears to provoke the FORMERR seems to have responded just fine. Here is relevant output (with some stuff deleted due to verbosity):</div>
<div><br></div><div><div>05-May-2009 10:49:14.943 dispatch 0x8144b90 response 0x81476b8 192.228.79.201#53: attached to task 0x80ed240</div><div>05-May-2009 10:49:14.945 resquery 0x8152c70 (fctx 0x812f170(<a href="http://imap.gmail.com/A)">imap.gmail.com/A)</a>): sent<br>
</div><div>05-May-2009 10:49:14.945 resquery 0x8152c70 (fctx 0x812f170(<a href="http://imap.gmail.com/A)">imap.gmail.com/A)</a>): senddone</div><div>05-May-2009 10:49:14.945 dispatch 0x8149a70: got packet: requests 0, buffers 2, recvs 1</div>
<div>05-May-2009 10:49:14.945 dispatch 0x8149a70: shutting down; detaching from sock 0x81418f0, task 0x8141a20</div><div>05-May-2009 10:49:14.965 socket 0x8141460 192.228.79.201#53: packet received correctly<br></div><div>
05-May-2009 10:49:14.966 dispatch 0x8144b90: got packet: requests 1, buffers 1, recvs 1<br></div><div>05-May-2009 10:49:14.966 dispatch 0x8144b90: got valid DNS message header, /QR 1, id 47066</div><div>05-May-2009 10:49:14.966 resquery 0x8152c70 (fctx 0x812f170(<a href="http://imap.gmail.com/A)">imap.gmail.com/A)</a>): response<br>
</div><div>05-May-2009 10:49:14.967 received packet:</div><div>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47066</div><div>;; flags: qr rd ra ; QUESTION: 1, ANSWER: 3, AUTHORITY: 4, ADDITIONAL: 4</div>
<div>;; QUESTION SECTION:</div><div>;<a href="http://imap.gmail.com">imap.gmail.com</a>.<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre"> </span>A</div>
<div><br></div><div>;; ANSWER SECTION:</div><div><a href="http://imap.gmail.com">imap.gmail.com</a>.<span class="Apple-tab-span" style="white-space:pre"> </span>241<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre"> </span>CNAME<span class="Apple-tab-span" style="white-space:pre"> </span><a href="http://gmail-imap.l.google.com">gmail-imap.l.google.com</a>.</div>
<div><a href="http://gmail-imap.l.google.com">gmail-imap.l.google.com</a>. 241<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre"> </span>A<span class="Apple-tab-span" style="white-space:pre"> </span>209.85.201.111</div>
<div><a href="http://gmail-imap.l.google.com">gmail-imap.l.google.com</a>. 241<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre"> </span>A<span class="Apple-tab-span" style="white-space:pre"> </span>209.85.201.109</div>
<div><br></div><div>;; AUTHORITY SECTION:</div><div><a href="http://gmail.com">gmail.com</a>.<span class="Apple-tab-span" style="white-space:pre"> </span>76384<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre"> </span>NS<span class="Apple-tab-span" style="white-space:pre"> </span><a href="http://ns4.google.com">ns4.google.com</a>.</div>
<div><a href="http://gmail.com">gmail.com</a>.<span class="Apple-tab-span" style="white-space:pre"> </span>76384<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre"> </span>NS<span class="Apple-tab-span" style="white-space:pre"> </span><a href="http://ns1.google.com">ns1.google.com</a>.</div>
<div><a href="http://gmail.com">gmail.com</a>.<span class="Apple-tab-span" style="white-space:pre"> </span>76384<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre"> </span>NS<span class="Apple-tab-span" style="white-space:pre"> </span><a href="http://ns2.google.com">ns2.google.com</a>.</div>
<div><a href="http://gmail.com">gmail.com</a>.<span class="Apple-tab-span" style="white-space:pre"> </span>76384<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre"> </span>NS<span class="Apple-tab-span" style="white-space:pre"> </span><a href="http://ns3.google.com">ns3.google.com</a>.</div>
<div><br></div><div>;; ADDITIONAL SECTION:</div><div><a href="http://ns4.google.com">ns4.google.com</a>.<span class="Apple-tab-span" style="white-space:pre"> </span>77136<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre"> </span>A<span class="Apple-tab-span" style="white-space:pre"> </span>216.239.38.10</div>
<div><a href="http://ns1.google.com">ns1.google.com</a>.<span class="Apple-tab-span" style="white-space:pre"> </span>77136<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre"> </span>A<span class="Apple-tab-span" style="white-space:pre"> </span>216.239.32.10</div>
<div><a href="http://ns2.google.com">ns2.google.com</a>.<span class="Apple-tab-span" style="white-space:pre"> </span>77136<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre"> </span>A<span class="Apple-tab-span" style="white-space:pre"> </span>216.239.34.10</div>
<div><a href="http://ns3.google.com">ns3.google.com</a>.<span class="Apple-tab-span" style="white-space:pre"> </span>77136<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre"> </span>A<span class="Apple-tab-span" style="white-space:pre"> </span>216.239.36.10</div>
<div><br></div><div><br></div><div>05-May-2009 10:49:14.967 fctx 0x812f170(<a href="http://imap.gmail.com/A'">imap.gmail.com/A'</a>): answer_response</div><div>05-May-2009 10:49:14.968 fctx 0x812f170(<a href="http://imap.gmail.com/A'">imap.gmail.com/A'</a>): noanswer_response</div>
<div>05-May-2009 10:49:14.968 fctx 0x812f170(<a href="http://imap.gmail.com/A'">imap.gmail.com/A'</a>): cancelquery</div><div>05-May-2009 10:49:14.968 dispatch 0x8144b90 response 0x81476b8 192.228.79.201#53: detaching from task 0x80ed240</div>
<div>05-May-2009 10:49:14.968 dispatch 0x8144b90: detach: refcount 0</div><div>05-May-2009 10:49:14.968 fctx 0x812f170(<a href="http://imap.gmail.com/A'">imap.gmail.com/A'</a>): add_bad</div><div>05-May-2009 10:49:14.969 FORMERR resolving '<a href="http://imap.gmail.com/A/IN">imap.gmail.com/A/IN</a>': 192.228.79.201#53</div>
<div><br></div><div>Does this trace output suggest what is going wrong? -- Eric</div><br><div class="gmail_quote">On Tue, May 5, 2009 at 9:53 AM, Eric Swenson <span dir="ltr"><<a href="mailto:eric@swenson.org">eric@swenson.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><span style="border-collapse:collapse">I'm seeing lots of DNS resolution failures on my router (running Utuntu 8.10, bind 9.3.4). While most succeed, I get quite a few FORMERR errors similar to:<div>
<br></div><div><div>May 4 20:25:25 localhost named[19579]: FORMERR resolving '<a href="http://imap.gmail.com/A/IN" style="color:rgb(42, 93, 176)" target="_blank">imap.gmail.com/A/IN</a>': 66.151.140.2#53</div>
<div>May 4 20:25:25 localhost named[19579]: FORMERR resolving '<a href="http://imap.gmail.com/A/IN" style="color:rgb(42, 93, 176)" target="_blank">imap.gmail.com/A/IN</a>': 192.168.3.1#53</div><div>May 4 20:25:25 localhost named[19579]: FORMERR resolving '<a href="http://imap.gmail.com/A/IN" style="color:rgb(42, 93, 176)" target="_blank">imap.gmail.com/A/IN</a>': 192.112.36.4#53</div>
<div>May 4 20:25:25 localhost named[19579]: FORMERR resolving '<a href="http://imap.gmail.com/A/IN" style="color:rgb(42, 93, 176)" target="_blank">imap.gmail.com/A/IN</a>': 128.63.2.53#53</div><div>May 4 20:25:25 localhost named[19579]: FORMERR resolving '<a href="http://imap.gmail.com/A/IN" style="color:rgb(42, 93, 176)" target="_blank">imap.gmail.com/A/IN</a>': 192.228.79.201#53</div>
<div>May 4 20:25:25 localhost named[19579]: FORMERR resolving '<a href="http://imap.gmail.com/A/IN" style="color:rgb(42, 93, 176)" target="_blank">imap.gmail.com/A/IN</a>': 192.36.148.17#53</div><div>May 4 20:25:25 localhost named[19579]: FORMERR resolving '<a href="http://imap.gmail.com/A/IN" style="color:rgb(42, 93, 176)" target="_blank">imap.gmail.com/A/IN</a>': 202.12.27.33#53</div>
<div>May 4 20:25:25 localhost named[19579]: FORMERR resolving '<a href="http://imap.gmail.com/A/IN" style="color:rgb(42, 93, 176)" target="_blank">imap.gmail.com/A/IN</a>': 192.33.4.12#53</div><div>May 4 20:25:25 localhost named[19579]: FORMERR resolving '<a href="http://imap.gmail.com/A/IN" style="color:rgb(42, 93, 176)" target="_blank">imap.gmail.com/A/IN</a>': 192.5.5.241#53</div>
<div>May 4 20:25:25 localhost named[19579]: FORMERR resolving '<a href="http://imap.gmail.com/A/IN" style="color:rgb(42, 93, 176)" target="_blank">imap.gmail.com/A/IN</a>': 192.58.128.30#53</div><div>May 4 20:25:25 localhost named[19579]: FORMERR resolving '<a href="http://imap.gmail.com/A/IN" style="color:rgb(42, 93, 176)" target="_blank">imap.gmail.com/A/IN</a>': 128.8.10.90#53</div>
<div>May 4 20:25:25 localhost named[19579]: FORMERR resolving '<a href="http://imap.gmail.com/A/IN" style="color:rgb(42, 93, 176)" target="_blank">imap.gmail.com/A/IN</a>': 198.41.0.4#53</div><div>May 4 20:25:25 localhost named[19579]: FORMERR resolving '<a href="http://imap.gmail.com/A/IN" style="color:rgb(42, 93, 176)" target="_blank">imap.gmail.com/A/IN</a>': 192.203.230.10#53</div>
<div>May 4 20:25:25 localhost named[19579]: FORMERR resolving '<a href="http://imap.gmail.com/A/IN" style="color:rgb(42, 93, 176)" target="_blank">imap.gmail.com/A/IN</a>': 193.0.14.129#53</div><div>May 4 20:25:25 localhost named[19579]: FORMERR resolving '<a href="http://imap.gmail.com/A/IN" style="color:rgb(42, 93, 176)" target="_blank">imap.gmail.com/A/IN</a>': 199.7.83.42#53</div>
<div><br></div><div>I'm running an iptables firewall on this box, which is connected to the internet via a wireless access point on my roof with a link to my ISP. As a result of the above FORMERRs, clients on my lan are unable to resolve addresses -- in the above case, <a href="http://imap.gmail.com" style="color:rgb(42, 93, 176)" target="_blank">imap.gmail.com</a>, and therefore are unable to access mail. Upon the recommendations of someone familiar with the relevant technologies, I've updated my DNS (named.conf) to set the edns-udp-size 500 option. This had no effect. </div>
<div><br></div><div>If I use dig to resolve <a href="http://imap.gmail.com" style="color:rgb(42, 93, 176)" target="_blank">imap.gmail.com</a> manually, by specifying any of the above-mentioned DNS servers, everything works fine. Also, when clients within my network fail to have <a href="http://imap.gmail.com" target="_blank">imap.gmail.com</a> resolve, I can "fix" things for a short while, by simply issuing the following:</div>
<div><br></div><div>nslookup</div><div>set querytype=ns</div><div><a href="http://gmail.com" target="_blank">gmail.com</a>.</div><div>lserver <<a href="http://whatever-the-ns-server-is-for-gmail.com" target="_blank">whatever-the-ns-server-is-for-gmail.com</a>></div>
<div>set querytype=a</div><div><a href="http://imap.gmail.com" target="_blank">imap.gmail.com</a></div><div><br></div><div>Once I've done the above, my DNS server caches the A record for <a href="http://imap.gmail.com" target="_blank">imap.gmail.com</a> and happily hands it out until the cache time is exceeded, when I'm back getting FORMERRs and failing to resolve <a href="http://imap.gmail.com" target="_blank">imap.gmail.com</a>.</div>
<div><br></div><div>There are other addresses than <a href="http://imap.gmail.com" target="_blank">imap.gmail.com</a> that cannot be resolved due to FORMERRs, but this domain name is the most prevalent, and most annoying, since it prevents users within my network from getting mail.</div>
<div><br></div><div>Since I can force my DNS to resolve these addresses by issuing the above queries, I'm wondering if the problem is due to having the following in my named.conf:</div><div><br></div><div><div> forwarders {</div>
<div> 192.168.3.1;</div><div> 66.151.140.2;</div><div> };</div><div><br></div><div>My ISP provides the above two DNS servers and I have mine delegating to theirs. Perhaps one of these two DNS servers (or any that they forward to) is having problems (perhaps no EDNS0 support?), which causes the FORMERRs to be reported by my DNS server.</div>
</div><div><br></div><div>I haven't yet tried removing the forwarders. I figured this was not the issue because the FORMERR log messages suggest (to me) that my DNS is trying to contact the root servers itself (and not relying on the downstream DNS servers to do so). </div>
<div><br></div><div>Does anyone have ideas about what is going on? <br></div><div><br></div><div>Thanks much. -- Eric</div><div><br></div></div></span>
</blockquote></div><br></div>