0

I have a web server, port 53 is open for DNS. I am getting thousands of lines in my /var/log/messages that look like:

Jan 27 08:34:21 server named[14051]: client 77.88.26.1#5335: query (cache) 'www.bpharma.in/A/IN' denied

Jan 27 08:34:23 server named[14051]: client 77.88.16.112#52035: query (cache) 'www.bpharma.in/A/IN' denied

Jan 27 08:34:24 server named[14051]: client 77.88.16.112#63885: query (cache) 'bpharma.in/A/IN' denied

Jan 27 08:59:17 server named[14051]: client 66.249.71.24#52367: query (cache) 'maheshwar.in/A/IN' denied

Jan 27 08:59:25 server named[14051]: client 66.249.71.27#47186: query (cache) 'maheshwar.in/A/IN' denied

I am just wondering if this is normal, and if not what should I do about it?

2
  • I don't think this is default for Red Hat/CentOS RPM. Did you install from other source? It's normal in the sense that you shouldn't be concerned but it is very noisy. I submitted an answer below that will help you move queries to their own file. Jan 27, 2012 at 22:20
  • Is your "server" the authoritative nameserver for a domain you own? If not, you can deny port 53 from the internet.
    – dmourati
    Jan 27, 2012 at 22:27

2 Answers 2

3

You can customize how BIND logs. I send all queries to their own file.

From named.conf:

logging {  
    channel query_logging {  
        file "/var/log/query.log";  
        severity debug 3;  
        print-time yes;  
    };  
    category queries { query_logging; };  
};

Make sure to setup log rotation for your new query log in /etc/logrotate.d/named.

0

No need to worry. The lines tell you that someone is trying to query your nameservers for domains you are not authoritative for.

Also, you deny recursive lookups. Unless you really want to serve as a recursive name server to the world, it looks as it should

The last thing that could be the case is, that the person who owns those domains somehow pointed them towards your name server. Maybe it's an IP address that has been owned by someone else with name servers earlier?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .