<div><br></div><div>Greetings and thanks for any help -</div><div><br></div>I'm running into what seems like a strange problem. On our bind (9.7.3-P3-RedHat-9.7.3-2.el6_1.P3.3, but patched to latest), we seem to be having some domains [we aren't auth for] that aren't returning expected information from cache (although thousand of other domains resolve just fine). Digs on/from other providers (with other recursing servers outside our networks) seem to work correctly. To me, it seems like all information at least to the gTLD (and the ns of the domain?) is correct. So the problem seems to be us, but I'm not sure why. It seems that bind has the correct info in it's cache db
(see below), and yet it will not return the data. Details below, happy to provide more upon request!<div>
<br></div><div>An example is <a href="http://carsoncityschools.com" target="_blank">carsoncityschools.com</a>. A dig +trace from two of our (different) networks works fine until after retrieving NS records:</div><div><br>
</div><div><div><font face="'courier new', monospace"><a href="http://carsoncityschools.com" target="_blank">carsoncityschools.com</a>. 172800 IN NS <a href="http://ns1.carsoncityschools.com" target="_blank">ns1.carsoncityschools.com</a>.</font></div>
<div><font face="'courier new', monospace"><a href="http://carsoncityschools.com" target="_blank">carsoncityschools.com</a>. 172800 IN NS <a href="http://ns2.carsoncityschools.com" target="_blank">ns2.carsoncityschools.com</a>.</font></div>
</div><div><br></div><div>That's fine. But then [a packet sniff reveals that] the local resolver hits our server to look up (e.g.) <a href="http://ns1.carsoncityschools.com" target="_blank">ns1.carsoncityschools.com</a>, and our servers (all) respond back with SERVFAIL.</div>
<div><br></div><div>A dig @GTLD (any) of ns1 returns correct results with glue, and a dig, from one of our name servers directly to @<a href="http://50.23.15.156" target="_blank">50.23.15.156</a>, return correct results:</div>
<div>
<br></div><div><div>;; QUESTION SECTION:</div><div>;<a href="http://ns1.carsoncityschools.com" target="_blank">ns1.carsoncityschools.com</a>. IN A</div><div><br></div><div>;; AUTHORITY SECTION:</div><div><a href="http://carsoncityschools.com" target="_blank">carsoncityschools.com</a>. 172800 IN NS <a href="http://ns1.carsoncityschools.com" target="_blank">ns1.carsoncityschools.com</a>.</div>
<div><a href="http://carsoncityschools.com" target="_blank">carsoncityschools.com</a>. 172800 IN NS <a href="http://ns2.carsoncityschools.com" target="_blank">ns2.carsoncityschools.com</a>.</div><div><br></div>
<div>;; ADDITIONAL SECTION:</div>
<div><a href="http://ns1.carsoncityschools.com" target="_blank">ns1.carsoncityschools.com</a>. 172800 IN A 50.23.15.156</div><div><a href="http://ns2.carsoncityschools.com" target="_blank">ns2.carsoncityschools.com</a>. 172800 IN A 50.23.28.180</div>
</div><div><br></div><div><br></div><div>However, a dig direct to @OURDNS (tried three distinct systems/networks) for, e.g. <a href="http://ns1.carsoncityschools.com">ns1.carsoncityschools.com</a>, yields poor results:</div>
<div><div><br></div><div><div><font face="'courier new', monospace">; <<>> DiG 9.7.3-P3-RedHat-9.7.3-2.el6_1.P3.3 <<>> @OURDNS <a href="http://ns1.carsoncityschools.com" target="_blank">ns1.carsoncityschools.com</a></font></div>
<div><font face="'courier new', monospace">; (1 server found)</font></div><div><font face="'courier new', monospace">;; global options: +cmd</font></div><div><font face="'courier new', monospace">;; Got answer:</font></div>
<div><font face="'courier new', monospace">;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 32117</font></div><div><font face="'courier new', monospace">;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0</font></div>
<div><font face="'courier new', monospace"><br></font></div><div><font face="'courier new', monospace">;; QUESTION SECTION:</font></div><div><font face="'courier new', monospace">;<a href="http://ns1.carsoncityschools.com" target="_blank">ns1.carsoncityschools.com</a>. IN A</font></div>
</div><div><br></div><br></div><div>So, if I'm on the right track here, it seems like perhaps our server is not caching the information or retrieving the info, because everything else seems fine. A restart of named does not fix the problem. I then ran a rndc dumpdb, and looked at the file (after attempting a dig again). The (internal cache db) dumpdb yields this:</div>
<div><br></div><div><div><font face="'courier new', monospace"><a href="http://carsoncityschools.com">carsoncityschools.com</a>. 172791 NS <a href="http://ns1.carsoncityschools.com">ns1.carsoncityschools.com</a>.</font></div>
<div><font face="'courier new', monospace"> 172791 NS <a href="http://ns2.carsoncityschools.com">ns2.carsoncityschools.com</a>.</font></div><div><font face="'courier new', monospace">; glue</font></div>
<div><font face="'courier new', monospace"><a href="http://ns1.carsoncityschools.com">ns1.carsoncityschools.com</a>. 172791 A 50.23.15.156</font></div><div><font face="'courier new', monospace">; glue</font></div>
<div><font face="'courier new', monospace"><a href="http://ns2.carsoncityschools.com">ns2.carsoncityschools.com</a>. 172791 A 50.23.28.180</font></div></div><div><br></div><div>and in the </div><div><br></div>
<div><div><font face="'courier new', monospace">; <a href="http://ns2.carsoncityschools.com">ns2.carsoncityschools.com</a> [v4 TTL 1] [v4 success] [v6 unexpected]</font></div><div><font face="'courier new', monospace">; 50.23.28.180 [srtt 1] [flags 00000000]</font></div>
</div><div><div><font face="'courier new', monospace">; <a href="http://ns1.carsoncityschools.com">ns1.carsoncityschools.com</a> [v4 TTL 1] [v4 success] [v6 unexpected]</font></div><div><font face="'courier new', monospace">; 50.23.15.156 [srtt 14] [flags 00000000]</font></div>
</div><div><br></div><div>Not knowing the db structure in detail, I can't be sure, but doesn't it look like the cache has correct data in it. If that's the case, why does a local dig @OURDNS return a value?</div>
<div><br></div><div>Does anyone have other suggestions to try?</div><div><br></div><div>THANK YOU!<br clear="all"><div><br></div>-- <br><div><br></div><div>cheers and thanks,</div><div>Ian Veach, Systems Analyst</div><div>
System Computing Services, Nevada System of Higher Education</div>
<div><br></div><br>
</div>