<html><head></head><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:13px"><div id="yui_3_16_0_ym19_1_1502918217989_31142"><span>Thanks Mark,</span></div><div id="yui_3_16_0_ym19_1_1502918217989_31067"><span><br></span></div><div id="yui_3_16_0_ym19_1_1502918217989_31069"><span id="yui_3_16_0_ym19_1_1502918217989_31068">So mysteriously the problem is now gone and I have no idea how, I know that I didn't change anything.</span></div><div id="yui_3_16_0_ym19_1_1502918217989_31070"><span><br></span></div><div id="yui_3_16_0_ym19_1_1502918217989_31072"><span id="yui_3_16_0_ym19_1_1502918217989_31071">While investigating, I tried looking but didn't get anything in packet capture on the recursive server, I think mainly because I had to grep for something otherwise there was just too much traffic. So its possible, my grep for lenovo didn't show related packets.... But I will never know now </span></div><div id="yui_3_16_0_ym19_1_1502918217989_31072"><span><br></span></div><div id="yui_3_16_0_ym19_1_1502918217989_31072"><span><br></span></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1502918217989_31023"><br><br></div><div class="yahoo_quoted" id="yui_3_16_0_ym19_1_1502918217989_30959" style="display: block;"> <div style="font-family: times new roman, new york, times, serif; font-size: 13px;" id="yui_3_16_0_ym19_1_1502918217989_30958"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;" id="yui_3_16_0_ym19_1_1502918217989_30957"> <div dir="ltr" id="yui_3_16_0_ym19_1_1502918217989_31021"> <font size="2" face="Arial" id="yui_3_16_0_ym19_1_1502918217989_31022"> <hr size="1" id="yui_3_16_0_ym19_1_1502918217989_31119"> <b><span style="font-weight:bold;">From:</span></b> Mark Andrews <marka@isc.org><br> <b><span style="font-weight: bold;">To:</span></b> U Zee <uzee001@yahoo.com> <br><b><span style="font-weight: bold;">Cc:</span></b> Grant Taylor <gtaylor@tnetconsulting.net>; "bind-users@lists.isc.org" <bind-users@isc.org><br> <b><span style="font-weight: bold;">Sent:</span></b> Monday, August 14, 2017 3:00 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: DNS not resolving for a particular domain only<br> </font> </div> <div class="y_msg_container" id="yui_3_16_0_ym19_1_1502918217989_30956"><br><div dir="ltr" id="yui_3_16_0_ym19_1_1502918217989_30955"><br clear="none">In message <<a shape="rect" ymailto="mailto:1396839156.197734.1502489970286@mail.yahoo.com" href="mailto:1396839156.197734.1502489970286@mail.yahoo.com" id="yui_3_16_0_ym19_1_1502918217989_31020">1396839156.197734.1502489970286@mail.yahoo.com</a>>, U Zee via bind-users writ<br clear="none">es:<div class="yqt5946600311" id="yqtfd27015"><br clear="none">> Thanks for the suggestion Grant.<br clear="none">> Here's what I get for the recursive server's capture: ( I queried from<br clear="none">> the recursive server itself from another ssh session so it is the client<br clear="none">> as well)<br clear="none">><br clear="none">> # tcpdump -v -v -nt -i eth0 udp port 53|grep lenovotcpdump: listening on<br clear="none">> eth0, link-type EN10MB (Ethernet), capture size 65535 bytes <br clear="none">> 86.36.AA.BB.45776 > 86.36.AA.CC.domain: [bad udp cksum 8a1b!] 34468+ A? www.lenovo.com. (32)<br clear="none">> 86.36.AA.BB.45776 > 86.36.AA.CC.domain: [bad udp cksum 8a1b!] 34468+ A? www.lenovo.com. (32)<br clear="none">> 86.36.AA.BB.36143 > 193.108.91.79.domain: [bad udp cksum c63c!] 12966 [1au] A?<br clear="none">> www.lenovo.com. ar: . OPT UDPsize=4096 OK (43)<br clear="none">> 193.108.91.79.domain > 86.36.AA.BB.36143: [udp sum ok] 12966*- q: A? www.lenovo.com. 1/0/1 www.lenovo.com. CNAME cs47.can.lnvcdn.net. ar: . OPT UDPsize=4096 OK (76) <br clear="none">> 86.36.AA.BB.45776 > 86.36.AA.CC.domain: [bad udp cksum 8a1b!] 34468+ A? www.lenovo.com. (32)<br clear="none">> 86.36.AA.BB.10224 > 86.36.DD.EE.domain: [badudp cksum 18c7!] 12721 [1au] A? www.lenovo.com.ourdomain.com. ar: . OPT UDPsize=4096 OK (57)<br clear="none">> 86.36.DD.EE.domain > 86.36.AA.BB.10224: [udp sum ok] 12721 NXDomain*- q: A? www.lenovo.com.ourdomain.com. 0/1/1 ns: ourdomain.com. SOA master.ourdomain.com. host-master.ourparentdomain.com. 138524105 900 450 3600000 60 ar: . OPT UDPsize=4096 OK (138) <br clear="none">> 86.36.AA.CC.domain > 86.36.AA.BB.45776: [udp sum ok] 34468 ServFail q: A? www.lenovo.com. 0/0/0 (32)<br clear="none">><br clear="none">> 86.36.AA.BB = localhost (our recursive server) where I ran the query and<br clear="none">> capture<br clear="none">> 86.36.AA.CC = our secondary recursive server (no idea why that was<br clear="none">> contacted)<br clear="none">> 86.36.DD.EE = our one of two anycast addresses which point to the<br clear="none">> recursive servers<br clear="none">><br clear="none">><br clear="none">> So it looks like we do get to the CNAME (4th line) but still it<br clear="none">> fails...?I also tried a capture from a regular linux client but the<br clear="none">> output was similar except that it didn't include the CNAME line.</div><br clear="none"><br clear="none">Well the next stage is to trace what happens when the recursive<br clear="none">server looks for cs47.can.lnvcdn.net, the target of the CNAME.<br clear="none"><br clear="none">Mark<br clear="none">-- <br clear="none">Mark Andrews, ISC<br clear="none">1 Seymour St., Dundas Valley, NSW 2117, Australia<br clear="none">PHONE: +61 2 9871 4742 INTERNET: <a shape="rect" ymailto="mailto:marka@isc.org" href="mailto:marka@isc.org">marka@isc.org</a><div class="yqt5946600311" id="yqtfd46240"><br clear="none"></div></div><br><br></div> </div> </div> </div></div></body></html>