2

Not sure my question's title is explicit, so I'll try and explain it the best I can.

I have a dedicated web hosting server running Linux (Gentoo). There are a couple websites hosted on it, and therefore a couple domain names from multiple providers have their DNS zone settings set to point to my server.

There is one particular website that used to be hosted on this server, but was then removed. However, it looks like its domain name is still pointing to my server. If I cat /var/log/messages :

Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/A/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/A/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/A/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/A/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/A/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/A/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/A/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/A/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/A/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/A/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/A/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/A/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/MX/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/MX/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/MX/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/MX/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/MX/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/MX/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/MX/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/MX/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/MX/IN' denied

As you can see, I have dozens of these a second.

Can I do anything to forbid these requests (except contacting the owner and asking him to change his DNS zone settings) ? The server already denies them, but I guess it still tries and wastes a couple of microseconds for each of them, which all added up is no good to me. I thought of banning the IPs but they always seem to change (guess the requests come from multiple DNS servers around the world).

2 Answers 2

1

You are asking "Can I do anything to forbid these requests?" but it seems that you are already doing it. Isn't that exactly what 'the-goddamn-domain.com/A/IN' denied means?

If you are thinking of adding something else to do the filtering in front of the DNS server to save microseconds, then it doesn't make much sense to do it. The new filter will still waste cycles filtering the request before it lets it through to the real DNS server. What you have right now is the optimal solution.

If are worried about the disk space wasted on logging, then there might be a way to silence the error message from the logs. If nothing else, you can simply filter out the message in your syslog configuration.

Or you can simply add the zone back with only an SOA record in.

1
  • "Or you can simply add the zone back with only an SOA record in." Wouldn't that effectively blackhole the site for those DNS resolvers using neemzy's site? E.g. the domain resolves but those users will get "site not found" messages and mail will bounce. That should attrect the attention of the owners of the domain, but perhaps not in a positive way...
    – JvO
    Jan 18, 2013 at 16:26
1

Nope. It really is how you describe: the top-level DNS zone still points to your server for that-goddamn-domain.com. Computers from all over the world will contact your server to ask for its address, so you can't block them. Contact the owner first, and it that doesn't help the registrar.

5
  • Wrong. Contact the owner, who is ultimately responsible for ensuring the DNS for his/her domain is correct. Jan 18, 2013 at 5:29
  • I should have added: in my experience the owner often either: doesn't know how, doesn't care or simply cannot be reached. I'll clarify.
    – JvO
    Jan 18, 2013 at 5:45
  • @JohnGardeniers And that will achieve exactly nothing. THe question is not "what to do" but "how can I stop that by force" and contacting the owner has no technical or fast legal way.
    – TomTom
    Jan 18, 2013 at 5:51
  • Thanks. I accepted chutz's answer as he points out some ways to at least shut these messages up, but I'll still see what I can do with the owner and/or the registrar. Would have upvoted your answer but it's my first post ever on ServerFault, and I don't have enough reputation :) I would add that, by experience too, I agree with JvO about domain name owners' abilities to deal with that kind of request.
    – user154996
    Jan 18, 2013 at 8:22
  • @TomTom Please read the comments to answers in the context of the answer to which they apply. In this case contacting the registrar, who has absolutely no responsibility for the DNS, is a complete waste of time. Jan 18, 2013 at 11:45

You must log in to answer this question.