[OT] Bonehead DNS question

Bill Hacker wbh at conducive.org
Thu Oct 19 06:00:35 PDT 2006


JB wrote:

This got a bit long.  My apologies to those not interested.

In <4536e79f$0$788$415eb37d at xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>,
walt  <wa1ter at xxxxxxxxxxxxx> shouted to everyone in earshot,
Using a packet sniffer, I can see that my server fetches the
names of at least four backup servers at BBC -- but then my
server insists on resolving those names by using the primary
server which is *down*, and so the whole effort fails.


What's your nameserver software and version?  Care to post (or e-mail
to me) your named.conf if it's BIND?  (Just the global settings and
such probably don't need any zones you have configured, unless one of
them is bbc.co.uk or bbc.net.uk. =) )  Is your nameserver reachable
from the Internet?  If so, do I have your permission to run some
queries against it?  You can e-mail me its IP address if you'd rather
not post it.
I have a virtually identical problem, no doubt for the same reason, almost eery 
day, as I relay on 'news.bbc.co.uk'.

Likewise I can help (from HKG or Zurich) if it is MaraDNS (which, AFAIK uses the 
same record-types as the perhaps more common djbdns).

I'm seeing some sort of weird stuff, too.  I used to consider myself
quite knowledgable in DNS matters, but the dwindling of my youthful
conceit combined with my decreasing effort to keep up with more than
basic DNS practises has me wondering if what I'm seeing is truly odd
or sort of normal.  So I'll post it here in case anyone more clueful
than me can see what's going on.
Try the '-v' flag

(FreeBSD 4.11, Zurich)

su-2.05b# host -v www.bbc.co.uk
Trying null domain
rcode = 0 (Success), ancount=2
The following answer is not authoritative:
The following answer is not verified as authentic by the server:
www.bbc.co.uk   900 IN  CNAME   www.bbc.net.uk
www.bbc.net.uk  300 IN  A       212.58.224.36
rcode = 0 (Success), ancount=1
The following answer is not authoritative:
The following answer is not verified as authentic by the server:
www.bbc.net.uk  300 IN  A       212.58.224.36
(newer - FreeBSD 6.2 Hong Kong)

triligon# host -v www.bbc.co.uk
Trying "www.bbc.co.uk"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32519
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 2
;; QUESTION SECTION:
;www.bbc.co.uk.                 IN      A
;; ANSWER SECTION:
www.bbc.co.uk.          257     IN      CNAME   www.bbc.net.uk.
www.bbc.net.uk.         300     IN      A       212.58.227.74
;; AUTHORITY SECTION:
bbc.net.uk.             161127  IN      NS      ns0.thny.bbc.co.uk.
bbc.net.uk.             161127  IN      NS      ns0.thdo.bbc.co.uk.
;; ADDITIONAL SECTION:
ns0.thdo.bbc.co.uk.     74727   IN      A       212.58.224.20
ns0.thny.bbc.co.uk.     74729   IN      A       212.58.240.20
Received 151 bytes from 203.194.239.32#53 in 234 ms
Trying "www.bbc.co.uk"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6150
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;www.bbc.co.uk.                 IN      AAAA
;; ANSWER SECTION:
www.bbc.co.uk.          257     IN      CNAME   www.bbc.net.uk.
Received 57 bytes from 203.194.239.32#53 in 235 ms
Trying "www.bbc.co.uk"
Host www.bbc.co.uk not found: 2(SERVFAIL)
Received 31 bytes from 203.194.239.32#53 in 547 ms
-------
triligon# host -v news.bbc.co.uk
Trying "news.bbc.co.uk"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1616
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 2
;; QUESTION SECTION:
;news.bbc.co.uk.                        IN      A
;; ANSWER SECTION:
news.bbc.co.uk.         900     IN      CNAME   newswww.bbc.net.uk.
newswww.bbc.net.uk.     300     IN      A       212.58.226.33
;; AUTHORITY SECTION:
bbc.net.uk.             161862  IN      NS      ns0.thny.bbc.co.uk.
bbc.net.uk.             161862  IN      NS      ns0.thdo.bbc.co.uk.
;; ADDITIONAL SECTION:
ns0.thdo.bbc.co.uk.     75462   IN      A       212.58.224.20
ns0.thny.bbc.co.uk.     75464   IN      A       212.58.240.20
Received 156 bytes from 203.194.239.32#53 in 462 ms
Trying "news.bbc.co.uk"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22344
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;news.bbc.co.uk.                        IN      AAAA
;; ANSWER SECTION:
news.bbc.co.uk.         899     IN      CNAME   newswww.bbc.net.uk.
Received 62 bytes from 203.194.239.32#53 in 229 ms
Trying "news.bbc.co.uk"
Host news.bbc.co.uk not found: 2(SERVFAIL)
Received 32 bytes from 203.194.239.32#53 in 545 ms
------
triligon# host -v bbc.net.uk
Trying "bbc.net.uk"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50727
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2
;; QUESTION SECTION:
;bbc.net.uk.                    IN      A
;; ANSWER SECTION:
bbc.net.uk.             300     IN      A       212.58.226.232
;; AUTHORITY SECTION:
bbc.net.uk.             160971  IN      NS      ns0.thdo.bbc.co.uk.
bbc.net.uk.             160971  IN      NS      ns0.thny.bbc.co.uk.
;; ADDITIONAL SECTION:
ns0.thdo.bbc.co.uk.     74571   IN      A       212.58.224.20
ns0.thny.bbc.co.uk.     74573   IN      A       212.58.240.20
Received 129 bytes from 203.194.239.32#53 in 235 ms
Trying "bbc.net.uk"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29543
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;bbc.net.uk.                    IN      AAAA
Received 28 bytes from 203.194.239.32#53 in 229 ms
Trying "bbc.net.uk"
Host bbc.net.uk not found: 2(SERVFAIL)
Received 28 bytes from 203.194.239.32#53 in 554 ms

$ host www.bbc.co.uk
www.bbc.co.uk is an alias for www.bbc.net.uk.
www.bbc.net.uk has address 212.58.224.87
www.bbc.co.uk is an alias for www.bbc.net.uk.
Host www.bbc.co.uk not found: 2(SERVFAIL)
Output is identical every time I run that command.  I'm guessing
'host' is sending out four queries and hitting the down nameserver for
one of them.
$ host www.bbc.net.uk
www.bbc.net.uk has address 212.58.224.124
Host www.bbc.net.uk not found: 2(SERVFAIL)
That seems a little stranger, because I clearly *do* get an answer.
Using 'dig', I get an answer and no error.  This is 'host' from BIND
9.3.2-p1, built as part of recent FreeBSD 6-STABLE (6.2-PRERELEASE).
named is running under OpenBSD 3.4, BIND 9.2.2.  Same general
behaviour from BIND 9.3.1 host/named under FreeBSD 5.4-RELEASE.
$ dig in ns bbc.co.uk
[...]
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;bbc.net.uk.                    IN      NS
If I try that a few times, I eventually get an answer, which is then
cached by my nameserver.
$ dig in ns bbc.net.uk
[...]
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;bbc.net.uk.                    IN      NS
Haven't gotten an answer for this one yet.  I assume both of these are
also related to the down nameserver.
$ dig in a www.bbc.net.uk
[...]
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2
;; QUESTION SECTION:
;www.bbc.net.uk.                        IN      A
;; ANSWER SECTION:
www.bbc.net.uk.         296     IN      A       212.58.224.125
;; AUTHORITY SECTION:
bbc.net.uk.             172796  IN      NS      ns0.thdo.bbc.co.uk.
bbc.net.uk.             172796  IN      NS      ns0.thny.bbc.co.uk.
;; ADDITIONAL SECTION:
ns0.thdo.bbc.co.uk.     84601   IN      A       212.58.224.20
ns0.thny.bbc.co.uk.     84601   IN      A       212.58.240.20
...Despite the fact that I can't dig my local nameserver for the
bbc.net.uk nameservers, I still get the list as glue.  And that
situation is reproducible with any combination of nameserver and unix
tools on machines I operate.
Ex HKG:

triligon# host -v bbc.net.uk
Trying "bbc.net.uk"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50727
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2
;; QUESTION SECTION:
;bbc.net.uk.                    IN      A
;; ANSWER SECTION:
bbc.net.uk.             300     IN      A       212.58.226.232
;; AUTHORITY SECTION:
bbc.net.uk.             160971  IN      NS      ns0.thdo.bbc.co.uk.
bbc.net.uk.             160971  IN      NS      ns0.thny.bbc.co.uk.
;; ADDITIONAL SECTION:
ns0.thdo.bbc.co.uk.     74571   IN      A       212.58.224.20
ns0.thny.bbc.co.uk.     74573   IN      A       212.58.240.20
Received 129 bytes from 203.194.239.32#53 in 235 ms
Trying "bbc.net.uk"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29543
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;bbc.net.uk.                    IN      AAAA
Received 28 bytes from 203.194.239.32#53 in 229 ms
Trying "bbc.net.uk"
Host bbc.net.uk not found: 2(SERVFAIL)
Received 28 bytes from 203.194.239.32#53 in 554 ms
'SERVFAIL'

Of course, digging at the nameservers in the NS records for both those
domains results in an immediate answer unless it's the one down
nameserver, ns1.bbc.co.uk.  bbc.net.uk's two nameservers are also two
of the operational nameservers for bbc.co.uk.
Anyway, I have no clear idea of your problem, but if you're not
running BIND named, perhaps what you're running has a quirk or bug of
some sort.  I would think that most nameservers' caching behaviour is
sane out-of-the-box, but I have little experience outside of BIND.  I
can load up the web site in question as well, even though ns1 is
apparently down.
I hope this at least sheds some light on the problem for someone here
who knows more about this sort of thing.
Jeff





More information about the Users mailing list