<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 2.0cm 70.85pt 2.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="FI" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal" style="margin-bottom:10.0pt;line-height:115%;text-autospace:none">
<span lang="EN-US">We have a strange problem related to DNS services, maybe someone here have a clue what could be the problem.<br>
<br>
We are running BIND 9.14.2 in several servers, ns1.qnet.fi, ns2.qnet.fi etc. Everything else works fine, but with one small operator (actually a mediahouse), we can not get any replies to DNS queries from them. First thought it is a routing problem somewhere,
but inquiring those servers with IP works, so can not be.<br>
<br>
An example, the client domain is raimoasikainenoy.fi. <br>
<br>
; <<>> DiG 9.14.2 <<>> @ns1.qnet.fi raimoasikainenoy.fi ns<br>
; (1 server found)<br>
;; global options: +cmd<br>
;; Got answer:<br>
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 15578<br>
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:10.0pt;line-height:115%;text-autospace:none">
<span lang="EN-US"><br>
;; OPT PSEUDOSECTION:<br>
; EDNS: version: 0, flags:; udp: 4096<br>
; COOKIE: 55ba199a6d905273458bc2065cfe655462f150936d882603 (good)<br>
;; QUESTION SECTION:<br>
;raimoasikainenoy.fi. IN NS<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:10.0pt;line-height:115%;text-autospace:none">
<span lang="EN-US"><br>
;; Query time: 4999 msec<br>
;; SERVER: 62.142.220.5#53(62.142.220.5)<br>
;; WHEN: Mon Jun 10 17:12:36 FLE Daylight Time 2019<br>
;; MSG SIZE rcvd: 76<br>
<br>
<br>
<b><span style="color:red">From our own providers nameservers it works however, also tested ok from a couple other operators:</span></b><br>
<br>
; <<>> DiG 9.14.2 <<>> @8.8.8.8 raimoasikainenoy.fi ns<br>
; (1 server found)<br>
;; global options: +cmd<br>
;; Got answer:<br>
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47848<br>
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:10.0pt;line-height:115%;text-autospace:none">
<span lang="EN-US"><br>
;; OPT PSEUDOSECTION:<br>
; EDNS: version: 0, flags:; udp: 512<br>
;; QUESTION SECTION:<br>
;raimoasikainenoy.fi. IN NS<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:10.0pt;line-height:115%;text-autospace:none">
<span lang="EN-US"><br>
;; ANSWER SECTION:<br>
raimoasikainenoy.fi. 3599 IN NS ns.kpk.fi.<br>
raimoasikainenoy.fi. 3599 IN NS ns.datatower.fi.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:10.0pt;line-height:115%;text-autospace:none">
<span lang="EN-US"><br>
;; Query time: 78 msec<br>
;; SERVER: 8.8.8.8#53(8.8.8.8)<br>
;; WHEN: Mon Jun 10 17:14:11 FLE Daylight Time 2019<br>
;; MSG SIZE rcvd: 96<br>
<br>
<b><span style="color:red"><br>
Then testing from our network again, inquiring from ns.kpk.fi or ns.datatower.fi not working, our server cannot resolve those names. But when inquiring with IP 193.184.54.212 (ns.datatower.fi):<br>
</span></b><br>
;; Warning: Client COOKIE mismatch<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:10.0pt;line-height:115%;text-autospace:none">
<span lang="EN-US"><br>
; <<>> DiG 9.14.2 <<>> @193.184.54.212 raimoasikainenoy.fi ns<br>
; (1 server found)<br>
;; global options: +cmd<br>
;; Got answer:<br>
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14591<br>
;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 3<br>
;; WARNING: recursion requested but not available<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:10.0pt;line-height:115%;text-autospace:none">
<span lang="EN-US"><br>
;; OPT PSEUDOSECTION:<br>
; EDNS: version: 0, flags:; udp: 4096<br>
; COOKIE: a0ff0c014f65b471e0b8b271ffffffffe7bab2718129c071 (bad)<br>
;; QUESTION SECTION:<br>
;raimoasikainenoy.fi. IN NS<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:10.0pt;line-height:115%;text-autospace:none">
<span lang="EN-US"><br>
;; ANSWER SECTION:<br>
raimoasikainenoy.fi. 3600 IN NS ns.datatower.fi.<br>
raimoasikainenoy.fi. 3600 IN NS ns.kpk.fi.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:10.0pt;line-height:115%;text-autospace:none">
<span lang="EN-US">;; ADDITIONAL SECTION:<br>
ns.kpk.fi. 600 IN A 192.130.183.74<br>
ns.datatower.fi. 3600 IN A 193.184.54.212<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:10.0pt;line-height:115%;text-autospace:none">
<span lang="EN-US"><br>
;; Query time: 15 msec<br>
;; SERVER: 193.184.54.212#53(193.184.54.212)<br>
;; WHEN: Mon Jun 10 17:17:50 FLE Daylight Time 2019<br>
;; MSG SIZE rcvd: 156<br>
<br>
<br>
So what can it be?? To every other operator/network our inquiries work fine, have been working 25 years :) But only to this "operator" not. Our servers cannot resolve the name of their servers, even it can do it when inquiring their servers directly by
servers IP addresses. Their NS records in the fi-root look little suspicious, like some of the servers lacked glue records, but not sure about that.<br>
<br>
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Jukka Pakkanen<br>
Q-Net Oy<o:p></o:p></span></p>
</div>
</body>
</html>