<div dir="ltr">Hi Nath.<div>What have you got on SrvB for <a href="http://biopyrenees.net">biopyrenees.net</a>, or net?</div><div>On SrvB, please do "dig @<a href="http://127.0.0.1">127.0.0.1</a> <a href="http://sri.biopyrenees.net">sri.biopyrenees.net</a>" (please use the actual address rather than "localhost") and paste the full result here. I am interested in flags and the query time right now.</div><div><br></div><div>Cheers, Greg</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, 22 Mar 2023 at 11:52, BONIN Nathanael <<a href="mailto:BONIN.N@mipih.fr">BONIN.N@mipih.fr</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg7038524042564366839">
<div lang="FR">
<div class="m_7038524042564366839WordSection1">
<p class="MsoNormal">Hi there,<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">We are using RPZ zone for some times now, but recently we found a weird behavior from some domains. Let me explain !<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">We have 2 NS server : Recursive one (let’s call him SrvA) and one bebind (let’s call him SrvB, with global forwarder : SrvA ). My RPZ zone is on SrvA.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">If we took a little diagram, we have :<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">User ===== > SrvB ===== > SrvA ===== > Internet<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">If we create an A record <a href="http://tatata.google.com" target="_blank">tatata.google.com</a> / 2.3.4.5 (that doesn’t exist at <a href="http://google.com" target="_blank">google.com</a>) on RPZ zone :<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<ul style="margin-top:0cm" type="disc">
<li class="m_7038524042564366839MsoListParagraph" style="margin-left:0cm">On SrvA with : dig @localhost <a href="http://tatata.google.com" target="_blank">tatata.google.com</a> we got IP : 2.3.4.5 => GREAT !<u></u><u></u></li><li class="m_7038524042564366839MsoListParagraph" style="margin-left:0cm">On SrvB with : dig @localhost <a href="http://tatata.google.com" target="_blank">tatata.google.com</a> (that point on SrvA), we got IP : 2.3.4.5 => WONDERFUL !
<u></u><u></u></li></ul>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">BUT<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">If we create another A record <a href="http://sri.biopyrenees.net" target="_blank">sri.biopyrenees.net</a> / 3.4.5.6 (that doesn’t exist at <a href="http://biopyrenees.net" target="_blank">biopyrenees.net</a>) on RPZ zone :<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<ul style="margin-top:0cm" type="disc">
<li class="m_7038524042564366839MsoListParagraph" style="margin-left:0cm">On SrvA with : dig @localhost <a href="http://sri.biopyrenees.net" target="_blank">sri.biopyrenees.net</a>, we got IP : 3.4.5.6 => YOUPI !<u></u><u></u></li><li class="m_7038524042564366839MsoListParagraph" style="margin-left:0cm">On SrvB with : dig @localhost <a href="http://sri.biopyrenees.net" target="_blank">sri.biopyrenees.net</a>, we got : NXDOMAIN => WHATTTT ?<u></u><u></u></li></ul>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Why for some domain, the RPZ isn’t working ?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">An exemple of what I wrote on my RPZ zone :<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><a href="http://tatata.google.com" target="_blank">tatata.google.com</a> A 2.3.4.5<u></u><u></u></p>
<p class="MsoNormal"><a href="http://sri.biopyrenees.net" target="_blank">sri.biopyrenees.net</a> A 3.4.5.6<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Is it normal ? Is there a way to have the good answer on my SrvB ?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">With tcpdump, I see the same behavior with a record that works and with the record that doesn’t work…<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Thanks for your help.<u></u><u></u></p>
<p class="MsoNormal"><span><u></u> <u></u></span></p>
<p class="MsoNormal"><span>Nath. </span><u></u><u></u></p>
<p class="MsoNormal"><span> <u></u><u></u></span></p>
<p class="MsoNormal"><span> <u></u><u></u></span></p>
<p class="MsoNormal"><span> <u></u><u></u></span></p>
<p class="MsoNormal"><span> <u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
-- <br>
Visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br>
<br>
ISC funds the development of this software with paid support subscriptions. Contact us at <a href="https://www.isc.org/contact/" rel="noreferrer" target="_blank">https://www.isc.org/contact/</a> for more information.<br>
<br>
<br>
bind-users mailing list<br>
<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
</div></blockquote></div>