<html><head></head><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:13px"><div id="yui_3_16_0_ym19_1_1502394415425_34105"><span id="yui_3_16_0_ym19_1_1502394415425_34816"><font size="3" id="yui_3_16_0_ym19_1_1502394415425_34815">Thanks for the suggestion Grant.</font></span></div><div id="yui_3_16_0_ym19_1_1502394415425_34105"><span><font size="3"><br></font></span></div><div id="yui_3_16_0_ym19_1_1502394415425_34105"><span id="yui_3_16_0_ym19_1_1502394415425_34454"><font size="3" id="yui_3_16_0_ym19_1_1502394415425_34805">Here's what I get for the recursive server's capture: ( I queried from the recursive server itself from another ssh session so it is the client as well)</font></span></div><div id="yui_3_16_0_ym19_1_1502394415425_34105"><br></div><div id="yui_3_16_0_ym19_1_1502394415425_34105"><span><br></span></div><div id="yui_3_16_0_ym19_1_1502394415425_34201"><font face="Courier New, courier, monaco, monospace, sans-serif" size="3" id="yui_3_16_0_ym19_1_1502394415425_34794"># tcpdump -v -v -nt -i eth0 udp port 53|grep lenovo</font></div><div id="yui_3_16_0_ym19_1_1502394415425_34202"><font face="Courier New, courier, monaco, monospace, sans-serif" size="3" id="yui_3_16_0_ym19_1_1502394415425_34799">tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes</font></div><div id="yui_3_16_0_ym19_1_1502394415425_34203" dir="ltr"><font face="Courier New, courier, monaco, monospace, sans-serif" size="3" id="yui_3_16_0_ym19_1_1502394415425_34798"> 86.36.AA.BB.45776 > 86.36.AA.CC.domain: [bad udp cksum 8a1b!] 34468+ A? www.lenovo.com. (32)</font></div><div id="yui_3_16_0_ym19_1_1502394415425_34204" dir="ltr"><font face="Courier New, courier, monaco, monospace, sans-serif" size="3" id="yui_3_16_0_ym19_1_1502394415425_34797"> 86.36.AA.BB.45776 > 86.36.AA.CC.domain: [bad udp cksum 8a1b!] 34468+ A? www.lenovo.com. (32)</font></div><div id="yui_3_16_0_ym19_1_1502394415425_34205" dir="ltr"><font face="Courier New, courier, monaco, monospace, sans-serif" size="3" id="yui_3_16_0_ym19_1_1502394415425_34786"> 86.36.AA.BB.36143 > 193.108.91.79.domain: [bad udp cksum c63c!] 12966 [1au] A? www.lenovo.com. ar: . OPT UDPsize=4096 OK (43)</font></div><div id="yui_3_16_0_ym19_1_1502394415425_34206"><font face="Courier New, courier, monaco, monospace, sans-serif" size="3" id="yui_3_16_0_ym19_1_1502394415425_34782"> 193.108.91.79.domain > 86.36.AA.BB.36143: [udp sum ok] 12966*- q: A? www.lenovo.com. 1/0/1 www.lenovo.com. CNAME cs47.can.lnvcdn.net. ar: . OPT UDPsize=4096 OK (76)</font></div><div id="yui_3_16_0_ym19_1_1502394415425_34207" dir="ltr"><font face="Courier New, courier, monaco, monospace, sans-serif" size="3" id="yui_3_16_0_ym19_1_1502394415425_34846"> 86.36.AA.BB.45776 > 86.36.AA.CC.domain: [bad udp cksum 8a1b!] 34468+ A? www.lenovo.com. (32)</font></div><div id="yui_3_16_0_ym19_1_1502394415425_34208" dir="ltr"><font face="Courier New, courier, monaco, monospace, sans-serif" size="3" id="yui_3_16_0_ym19_1_1502394415425_34781"> 86.36.AA.BB.10224 > 86.36.DD.EE.domain: [bad udp cksum 18c7!] 12721 [1au] A? www.lenovo.com.ourdomain.com. ar: . OPT UDPsize=4096 OK (57)</font></div><div id="yui_3_16_0_ym19_1_1502394415425_34209" dir="ltr"><font face="Courier New, courier, monaco, monospace, sans-serif" size="3" id="yui_3_16_0_ym19_1_1502394415425_34780"> 86.36.DD.EE.domain > 86.36.AA.BB.10224: [udp sum ok] 12721 NXDomain*- q: A? www.lenovo.com.ourdomain.com. 0/1/1 ns: ourdomain.com. SOA master.ourdomain.com. host-master.ourparentdomain.com. 138524105 900 450 3600000 60 ar: . OPT UDPsize=4096 OK (138)</font></div><div id="yui_3_16_0_ym19_1_1502394415425_34105"></div><div dir="ltr" id="yui_3_16_0_ym19_1_1502394415425_34210"><font face="Courier New, courier, monaco, monospace, sans-serif" size="3" id="yui_3_16_0_ym19_1_1502394415425_34796"> 86.36.AA.CC.domain > 86.36.AA.BB.45776: [udp sum ok] 34468 ServFail q: A? www.lenovo.com. 0/0/0 (32)</font></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1502394415425_34106"><br></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1502394415425_34106"><br></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1502394415425_34106" dir="ltr"><span style="font-family: 'Courier New', courier, monaco, monospace, sans-serif; font-size: medium;" id="yui_3_16_0_ym19_1_1502394415425_35461">86.36.AA.BB = localhost (our recursive server) where I ran the query and capture</span><br></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1502394415425_34106" dir="ltr"><span style="font-family: 'Courier New', courier, monaco, monospace, sans-serif; font-size: medium;" id="yui_3_16_0_ym19_1_1502394415425_35540">86.36.AA.CC = our secondary recursive server (no idea why that was contacted)</span><br></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1502394415425_34106" dir="ltr"><span style="font-family: 'Courier New', courier, monaco, monospace, sans-serif; font-size: medium;" id="yui_3_16_0_ym19_1_1502394415425_35573">86.36.DD.EE = our one of two anycast addresses which point to the recursive servers</span><span style="font-family: 'Courier New', courier, monaco, monospace, sans-serif; font-size: medium;"><br></span></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1502394415425_34106" dir="ltr"><span style="font-family: 'Courier New', courier, monaco, monospace, sans-serif; font-size: medium;"><br></span></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1502394415425_34106" dir="ltr"><span style="font-family: 'Courier New', courier, monaco, monospace, sans-serif; font-size: medium;"><br></span></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1502394415425_34106" dir="ltr"><span style="font-size: medium;" id="yui_3_16_0_ym19_1_1502394415425_35663">So it looks like we do get to the CNAME (4th line) but still it fails...?</span></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1502394415425_34106" dir="ltr"><span style="font-size: medium;" id="yui_3_16_0_ym19_1_1502394415425_35717">I also tried a capture from a regular linux client but the output was similar except that it didn't include the CNAME line.</span><br></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1502394415425_34106" dir="ltr"><span style="font-size: medium;"><br></span></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1502394415425_34106" dir="ltr"><span style="font-size: medium;" id="yui_3_16_0_ym19_1_1502394415425_35790">Frankly I have no idea if this is giving any useful info. I did see that for other queries also I saw bad udp cksum messages so not sure if thats an actual problem.</span></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1502394415425_34106" dir="ltr"><span style="font-size: medium;"><br></span></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1502394415425_34106" dir="ltr"><span style="font-size: medium;" id="yui_3_16_0_ym19_1_1502394415425_35823">Do you see anything specific that might help us diagnose further?</span></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1502394415425_34106" dir="ltr"><span style="font-size: medium;"><br></span></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1502394415425_34106" dir="ltr"><span style="font-size: medium;">Thanks</span></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1502394415425_34106" dir="ltr"><span style="font-size: medium;"><br></span></div><div class="yahoo_quoted" id="yui_3_16_0_ym19_1_1502394415425_34112" style="display: block;"> <div style="font-family: times new roman, new york, times, serif; font-size: 13px;" id="yui_3_16_0_ym19_1_1502394415425_34111"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;" id="yui_3_16_0_ym19_1_1502394415425_34110"> <div dir="ltr" id="yui_3_16_0_ym19_1_1502394415425_34109"> <font size="2" face="Arial" id="yui_3_16_0_ym19_1_1502394415425_34108"> <hr size="1" id="yui_3_16_0_ym19_1_1502394415425_34107"> <b><span style="font-weight:bold;">From:</span></b> Grant Taylor via bind-users <bind-users@lists.isc.org><br> <b><span style="font-weight: bold;">To:</span></b> bind-users@lists.isc.org <br> <b><span style="font-weight: bold;">Sent:</span></b> Friday, August 11, 2017 7:06 PM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: DNS not resolving for a particular domain only<br> </font> </div> <div class="y_msg_container" id="yui_3_16_0_ym19_1_1502394415425_34169"><br><div dir="ltr" id="yui_3_16_0_ym19_1_1502394415425_34168">On 08/11/2017 06:49 AM, U Zee via bind-users wrote:<div class="yqt8695595626" id="yqtfd30270"><br clear="none">> Any ideas please???</div><br clear="none"><br clear="none">I'm seeing different A records returned depending on where I query from.<br clear="none"><br clear="none">As such I can only speculate that something related to DNS for a CDN is <br clear="none">not working as desired.<br clear="none"><br clear="none">I'd suggest a packet capture of the client's DNS traffic and possibly <br clear="none">(if not likely) the client's recursive DNS server's traffic (related to <br clear="none">the query.)<br clear="none"><br clear="none"><br clear="none"><br clear="none">-- <br clear="none">Grant. . . .<br clear="none">unix || die<div class="yqt8695595626" id="yqtfd90386"><br clear="none"></div></div><div class="yqt8695595626" id="yqtfd13462">_______________________________________________<br clear="none">Please visit <a shape="rect" href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users </a>to unsubscribe from this list<br clear="none"><br clear="none">bind-users mailing list<br clear="none"><a shape="rect" ymailto="mailto:bind-users@lists.isc.org" href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a><br clear="none"><a shape="rect" href="https://lists.isc.org/mailman/listinfo/bind-users" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a></div><br><br></div> </div> </div> </div></div></body></html>