Why do I get “ignoring out-of-zone data” when restarting BIND

Question

I've been using my own DNS server but then I moved to a third part DNS provider. Yesterday I wanted to go back to using my own DNS's and cancel this third party service. I've lowered TTL in current DNS conf, changed DNS info in GoDaddy for my domain and that's when problems started.

My domain seems to be working only for some people but not for others so clearly something is wrong.

When restarting bind service named restart everything seems to be OK but later in email from Logwatch I'm getting errors like this:

mapvivo.com:30: ignoring out-of-zone data (ns1.mydns.com): 3 Time(s)
mapvivo.info:16: ignoring out-of-zone data (ns1.mydns.com): 5 Time(s)

Can anyone point me in the right direction?

My BIND configuration for those two domains below:

File: /var/named/chroot/etc/zones.external

zone "mapvivo.com" IN {
    type master;
    file "mapvivo.com";
    allow-transfer { 213.251.188.140; };
    allow-update { none; };
    notify yes;
    also-notify { 213.251.188.140; };
};
zone "mapvivo.info" IN {
    type master;
    file "mapvivo.info";
    allow-transfer { 213.251.188.140; };
    allow-update { none; };
    notify yes;
    also-notify { 213.251.188.140; };
};

File /var/named/chroot/var/named/mapvivo.com being my main domain

$TTL 3600
$ORIGIN mapvivo.com.
@       IN      SOA     ns22943.ovh.net. sdns1.ovh.net. (
        2010032101 ; Serial
        10800      ; Refresh
        3600       ; Retry
        2419200    ; Expire
        3600 )    ; NXDOMAIN TTL

        IN      NS              ns22943.ovh.net.
        IN      NS              sdns1.ovh.net.

        IN      MX      10      ASPMX.L.GOOGLE.COM.
        IN      MX      20      ALT1.ASPMX.L.GOOGLE.COM.
        IN      MX      20      ALT2.ASPMX.L.GOOGLE.COM.
        IN      MX      30      ASPMX2.GOOGLEMAIL.COM.
        IN      MX      30      ASPMX3.GOOGLEMAIL.COM.
        IN      MX      30      ASPMX4.GOOGLEMAIL.COM.
        IN      MX      30      ASPMX5.GOOGLEMAIL.COM.
        IN      A               91.121.9.21
*       IN      A               91.121.9.21
edu     IN      A               91.121.9.21
googleXXXXXXXXXXXXXXXX  IN      CNAME   google.com.
ns22943.ovh.net. IN A           91.121.9.21

File /var/named/chroot/var/named/mapvivo.info just an alias in apache for mapvivo.com

$TTL 86400
$ORIGIN mapvivo.info.
@       IN      SOA     ns22943.ovh.net. sdns1.ovh.net. (
        2009042901 ; Serial
        10800      ; Refresh
        3600       ; Retry
        2419200    ; Expire
        3600 )    ; NXDOMAIN TTL

        IN      NS              ns22943.ovh.net.
        IN      NS              sdns1.ovh.net.

        IN      A               91.121.9.21
*       IN      A               91.121.9.21
ns22943.ovh.net. IN A           91.121.9.21

Answer 1

It looks like it's this line's fault:

ns1.mydns.com. IN A 111.111.111.111

You can't have a DNS record for some other zone (mydns.com) in your mydomain.com zones. That record belongs in the zone for mydns.com.

This won't cause some kind of critical failure or explosion, BIND's just saying that it's going to ignore this line.

======

Checking your listed DNS servers for the A record of mapvivo.info seems to indicate that they don't have any data at all for your zone (both return results like this):

[jrod@selene ~]$ dig mapvivo.info @sdns1.ovh.net

; <<>> DiG 9.6.1 <<>> mapvivo.info @sdns1.ovh.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 55728
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available`

;; QUESTION SECTION:
;mapvivo.info.                  IN      A

;; Query time: 122 msec
;; SERVER: 213.251.188.140#53(213.251.188.140)
;; WHEN: Tue Mar 23 01:43:50 2010
;; MSG SIZE  rcvd: 30

Is 91.121.9.21 the authoritative nameserver for this domain? My nmap scans indicate that port 53 is closed for both TCP and UDP.

Answer 2

As you're hiding your real domain it's difficult for others to help you with causes of the problem. If you add the name of your domain then others should be able to help.

Answer 3

There are typically two reasons that your domain works for some, but not everyone:

1. One server is returning cached results. There are plenty of servers that violates the TTL in various interesting ways. do a dig +trace and you avoid the caching.

2. Incorrect serial numbers. In this case your zone transfers will break, so your own server might use the correct zone file, but all the slaves uses the old zone file.