<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Thanks for your response. I didn't know about the +trace option in dig. After some more searching, I believe you are correct about the long responses being related. The responses that fail all seem to exceed 512-bytes. Why this would happen in multiple locations is a mystery but perhaps our firewalls are configured similarly. I'll look into the firewall settings on my end, but since there may be other devices out there configured similarly I'll need to try and reduce my CNAMES to find into a 512-byte response or switch them to A records.<div><br></div><div> -seren<br><div><br><div><div>On Jan 20, 2010, at 1:48 AM, Niall O'Reilly wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div>seren wrote:<br><blockquote type="cite">Hi, I've run into some strange issues with BIND and CNAMES.<br></blockquote><br><span class="Apple-tab-span" style="white-space:pre"> </span>The examples you show indicate strange issues only with<br><span class="Apple-tab-span" style="white-space:pre"> </span>whatever name server code is running on your localhost.<br><span class="Apple-tab-span" style="white-space:pre"> </span>Nothing in your examples actually identify this as BIND.<br><br><blockquote type="cite">We're using BIND9 (on Ubuntu)<br></blockquote><blockquote type="cite">internally and have our external DNS hosted by NetworkSolutions. Occasionally I'll be able<br></blockquote><blockquote type="cite">to create a CNAME in NetworkSolutions that BIND is unable to resolve.<br></blockquote><blockquote type="cite">Using dig I notice it's doing a query for an A record,<br></blockquote><br><span class="Apple-tab-span" style="white-space:pre"> </span>This is the record type use by dig in default of a specific<br><span class="Apple-tab-span" style="white-space:pre"> </span>type on the command line.<br><br><blockquote type="cite">and in most cases this works even<br></blockquote><blockquote type="cite">if the entry is a CNAME. In the cases where it fails, I see either a timeout error or a<br></blockquote><blockquote type="cite">SERVFAIL.<br></blockquote><br><span class="Apple-tab-span" style="white-space:pre"> </span>Your local instance of named is respectively either not<br><span class="Apple-tab-span" style="white-space:pre"> </span>responding, or reporting an error.<br><br><span class="Apple-tab-span" style="white-space:pre"> </span>Have you looked in your logs for more information?<br><span class="Apple-tab-span" style="white-space:pre"> </span>Have you tried 'dig +trace'?<br><br><blockquote type="cite">If I then do a dig query specifying a CNAME, I get a quick successful result<br></blockquote><blockquote type="cite">and subsequent queries to BIND succeed, until the record expires from the cache.<br></blockquote><blockquote type="cite">The records that fail don't seem to have anything in common besides them all being<br></blockquote><blockquote type="cite">CNAMES and longer names seeming to fail more. Both BIND9 and two windows-based DNS<br></blockquote><blockquote type="cite">servers fail with the exact same records, however Google (8.8.8.8) and several other<br></blockquote><blockquote type="cite">public DNS services resolve them fine.<br></blockquote><br><span class="Apple-tab-span" style="white-space:pre"> </span>I think you need to ask what's different between (on the one<br><span class="Apple-tab-span" style="white-space:pre"> </span>hand) your "BIND9" and windows-based name servers and (on the<br><span class="Apple-tab-span" style="white-space:pre"> </span>other) name servers which you tell us work: if not in the<br><span class="Apple-tab-span" style="white-space:pre"> </span>configuration, then in the environment.<br><br><span class="Apple-tab-span" style="white-space:pre"> </span>Are all of your "failing" name servers behind the same firewall?<br><span class="Apple-tab-span" style="white-space:pre"> </span>If so, does the firewall allow DNS queries and responses over<br><span class="Apple-tab-span" style="white-space:pre"> </span>TCP as well as UDP? Does the firewall perhaps break "long"<br><span class="Apple-tab-span" style="white-space:pre"> </span>responses? I ask because I've noticed some truncation<br><span class="Apple-tab-span" style="white-space:pre"> </span>and fallback to TCP when I use 'dig +trace' to query for one of<br><span class="Apple-tab-span" style="white-space:pre"> </span>the names you've mentioned as failing.<br><br><br><span class="Apple-tab-span" style="white-space:pre"> </span>Best regards,<br><br><span class="Apple-tab-span" style="white-space:pre"> </span>Niall O'Reilly<br><span class="Apple-tab-span" style="white-space:pre"> </span>University College Dublin IT Services<br><br></div></blockquote></div><br><div>
<span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0; "><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div><span class="Apple-style-span" style="font-size: medium;"><font class="Apple-style-span" face="Arial"><br></font></span></div></span></div></span></span></div></div></div></body></html>