<html><head></head><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div id="yui_3_16_0_ym19_1_1462280755194_2822">Hello Mark,</div><div id="yui_3_16_0_ym19_1_1462280755194_2773"><br></div><div id="yui_3_16_0_ym19_1_1462280755194_2774">Thank you for your answer. I'm not sure I've understood everything but I'll read it numerous times if necessary.</div><div dir="ltr" id="yui_3_16_0_ym19_1_1462280755194_2828">I have ACLs so I'm not surprised to see these REFUSED, I also understand the SERVFAIL meaning.</div><div id="yui_3_16_0_ym19_1_1462280755194_2956" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1462280755194_3048" dir="ltr">I'm just trying to figure out where the problem comes from.</div><div id="yui_3_16_0_ym19_1_1462280755194_3017" dir="ltr">You seem to point out a device which should be on my network and who queries a PTR (something like a mail server which want to check the domain of the user who sent the email)<br></div><div id="yui_3_16_0_ym19_1_1462280755194_2721"><br><span></span></div><div id="yui_3_16_0_ym19_1_1462280755194_3243"><span id="yui_3_16_0_ym19_1_1462280755194_3298">What I didn't understand is</span></div><div dir="ltr" id="yui_3_16_0_ym19_1_1462280755194_3271"><span id="yui_3_16_0_ym19_1_1462280755194_3294">"</span><span id="yui_3_16_0_ym19_1_1462280755194_3297">You could use whois to try to contact the administrators of these zones to correct the servers or remove the delegations."</span></div><div id="yui_3_16_0_ym19_1_1462280755194_3394" dir="ltr"><span id="yui_3_16_0_ym19_1_1462280755194_3396">You mean this one "</span><span id="yui_3_16_0_ym19_1_1462280755194_3297">x.204.99.116.in-addr.arpa" which appeared in my logs ?</span></div><div id="yui_3_16_0_ym19_1_1462280755194_3426" dir="ltr"><br><span id="yui_3_16_0_ym19_1_1462280755194_3297"></span></div><div id="yui_3_16_0_ym19_1_1462280755194_3435" dir="ltr"><span id="yui_3_16_0_ym19_1_1462280755194_3297">Regards</span></div> <div class="qtdSeparateBR"><br><br></div><div style="display: block;" class="yahoo_quoted"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div dir="ltr"><font face="Arial" size="2"> Le Mardi 3 mai 2016 13h30, Mark Andrews <marka@isc.org> a écrit :<br></font></div> <blockquote style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; margin-top: 5px; padding-left: 5px;"> <br><br> <div class="y_msg_container"><br clear="none">In message <<a shape="rect" ymailto="mailto:353379836.10168122.1462272936427.JavaMail.yahoo@mail.yahoo.com" href="mailto:353379836.10168122.1462272936427.JavaMail.yahoo@mail.yahoo.com">353379836.10168122.1462272936427.JavaMail.yahoo@mail.yahoo.com</a>>, Mi<br clear="none">k J writes:<div class="yqt6730191891" id="yqtfd50360"><br clear="none">><br clear="none">> Hello,<br clear="none">> In my named.log I can see a lot of SERVFAIL/REFUSED unexpected RCODE<br clear="none">> messages. Most of the time someone tries to resolve a PTR<br clear="none">> I can see an average of 10 messages per second like these<br clear="none">> May 3 10:46:26 dns named[7228]: REFUSED unexpected RCODE resolving<br clear="none">> 'x.204.99.116.in-addr.arpa/PTR/IN': 203.113.131.x#53<br clear="none">> May 3 10:46:26 dns named[7228]: SERVFAIL unexpected RCODE resolving<br clear="none">> 'x.16.165.88.in-addr.arpa/PTR/IN': 193.0.9.x#53<br clear="none">><br clear="none">> The PTR records don't belong to me and the remote DNS servers are located<br clear="none">> around the world.<br clear="none">> Does anyone has an understanding of why I receive these type of requests<br clear="none">> ? Why do they query my DNS servers ?<br clear="none">> Thank you</div><br clear="none"><br clear="none">Something on your network is trying to convert 116.00.204.x and<br clear="none">88.165.16.x addresses to names, presumably because they are seeing<br clear="none">traffic from those addresses. In both cases there appears to be<br clear="none">broken delegations involved.<br clear="none"><br clear="none">REFUSED usually means that the server is not configured for the<br clear="none">zone.<br clear="none"><br clear="none">SERVFAIL usually means that the server is configured for the zone<br clear="none">but doesn't have a current copy.<br clear="none"><br clear="none">You could use whois to try to contact the administrators of these<br clear="none">zones to correct the servers or remove the delegations.<br clear="none"><br clear="none">Mark<br clear="none">-- <br clear="none">Mark Andrews, ISC<br clear="none">1 Seymour St., Dundas Valley, NSW 2117, Australia<br clear="none">PHONE: +61 2 9871 4742 INTERNET: <a shape="rect" ymailto="mailto:marka@isc.org" href="mailto:marka@isc.org">marka@isc.org</a><div class="yqt6730191891" id="yqtfd27910"><br clear="none"></div><br><br></div> </blockquote> </div> </div> </div></div></body></html>