<html aria-label="message body"><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">At first, I thought these were old nameservers, with perhaps an ancient root.hints file. But not, 192.5.5.241 is definitely F (i.e. ISC). I suspect a middleware box or firewalling issue here.<div><br></div><div>If you want to do a query like:</div><div><br></div><div>dig +nsid @192.5.5.241 . NS, I'd be curious to see the results.</div><div><br></div><div>-Dan<br id="lineBreakAtBeginningOfMessage"><div><br><blockquote type="cite"><div>On Mar 17, 2026, at 9:56 AM, Doug Freed <dwfreed@isc.org> wrote:</div><br class="Apple-interchange-newline"><div><meta charset="UTF-8"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">On 3/17/26 10:49, Ted Mittelstaedt wrote:</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: auto; text-decoration-style: solid;"><blockquote type="cite" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: auto; text-decoration-style: solid;">I replaced an older nameserver with an upgrade and now I'm getting my syslog filled with:<br>2026-03-17T15:45:35.606648+00:00 clientmail named[109862]: lame server resolving 'ns3.dnsv2.net' (in '.'?): 198.97.190.53#53<br>2026-03-17T15:45:35.607940+00:00 clientmail named[109862]: lame server resolving '.' (in '.'?): 198.97.190.53#53<br>2026-03-17T15:45:35.619575+00:00 clientmail named[109862]: lame server resolving 'ns3.dnsv2.net' (in '.'?): 192.5.5.241#53<br>2026-03-17T15:45:35.623514+00:00 clientmail named[109862]: lame server resolving '.' (in '.'?): 192.5.5.241#53<br>2026-03-17T15:45:35.632650+00:00 clientmail named[109862]: lame server resolving 'ns3.dnsv2.net' (in '.'?): 192.112.36.4#53<br>2026-03-17T15:45:35.637040+00:00 clientmail named[109862]: lame server resolving '.' (in '.'?): 192.112.36.4#53<br>2026-03-17T15:45:35.646140+00:00 clientmail named[109862]: lame server resolving 'ns3.dnsv2.net' (in '.'?): 193.0.14.129#53<br>2026-03-17T15:45:35.650222+00:00 clientmail named[109862]: lame server resolving '.' (in '.'?): 193.0.14.129#53<br>2026-03-17T15:45:35.658509+00:00 clientmail named[109862]: lame server resolving 'ns3.dnsv2.net' (in '.'?): 192.203.230.10#53<br>2026-03-17T15:45:35.666644+00:00 clientmail named[109862]: lame server resolving '.' (in '.'?): 192.203.230.10#53<br>2026-03-17T15:45:35.671146+00:00 clientmail named[109862]: lame server resolving 'ns3.dnsv2.net' (in '.'?): 199.7.83.42#53<br>2026-03-17T15:45:35.681376+00:00 clientmail named[109862]: lame server resolving '.' (in '.'?): 199.7.83.42#53<br>2026-03-17T15:45:35.684777+00:00 clientmail named[109862]: lame server resolving 'ns3.dnsv2.net' (in '.'?): 192.58.128.30#53<br>2026-03-17T15:45:35.696406+00:00 clientmail named[109862]: lame server resolving '.' (in '.'?): 192.58.128.30#53<br>2026-03-17T15:45:35.698457+00:00 clientmail named[109862]: lame server resolving 'ns3.dnsv2.net' (in '.'?): 170.247.170.2#53<br>2026-03-17T15:45:35.709773+00:00 clientmail named[109862]: lame server resolving '.' (in '.'?): 170.247.170.2#53<br>2026-03-17T15:45:35.714916+00:00 clientmail named[109862]: lame server resolving 'ns3.dnsv2.net' (in '.'?): 202.12.27.33#53<br>2026-03-17T15:45:35.722599+00:00 clientmail named[109862]: lame server resolving '.' (in '.'?): 202.12.27.33#53<br>2026-03-17T15:45:35.730643+00:00 clientmail named[109862]: lame server resolving 'ns3.dnsv2.net' (in '.'?): 198.41.0.4#53<br>2026-03-17T15:45:35.735529+00:00 clientmail named[109862]: lame server resolving '.' (in '.'?): 198.41.0.4#53<br>2026-03-17T15:45:35.743723+00:00 clientmail named[109862]: lame server resolving 'ns3.dnsv2.net' (in '.'?): 199.7.91.13#53<br>2026-03-17T15:45:35.748110+00:00 clientmail named[109862]: lame server resolving '.' (in '.'?): 199.7.91.13#53<br>Since the server appears to otherwise be working am I correct in assuming this is just automated attacks from lame losers who have nothing productive to do with their CPU cycles?<br>Is there a trick to shut up these pointless warnings spamming my log? What do others do?<br>Thanks!<br>Ted<br></blockquote><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: auto; text-decoration-style: solid;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">The message indicates your server is receiving what's known as a "lame delegation", which is a delegation that does not progress resolution, in response to queries to the root nameservers. These messages are usually uncommon, and generally indicate an error in the zones or configuration of the authoritative nameserver, but are useful in troubleshooting user complaints, so generally shouldn't be disabled.</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: auto; text-decoration-style: solid;"><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: auto; text-decoration-style: solid;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">However, getting them for the root nameservers, which we can assume are correct in almost all cases, suggests that something else is going on. I would get a packet capture of the queries this server is sending and their responses to inspect what the responses contain, which may provide clues about their real origin.</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: auto; text-decoration-style: solid;"><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: auto; text-decoration-style: solid;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">-Doug</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: auto; text-decoration-style: solid;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">--<span class="Apple-converted-space"> </span></span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-decoration-thickness: auto; text-decoration-style: solid;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">Visit<span class="Apple-converted-space"> </span></span><a href="https://lists.isc.org/mailman/listinfo/bind-users" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;">https://lists.isc.org/mailman/listinfo/bind-users</a><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;"><span class="Apple-converted-space"> </span>to unsubscribe from this list.</span></div></blockquote></div><br></div></body></html>