up vote 2 down vote favorite
share [g+] share [fb]

I have a lot of this entries in /var/log/syslog , 1 each 20 seconds. I see that are rejected but nevertheless I don't think is a good thing that somebody is pinging my server for DNS checks or whatever they are.

Feb  2 14:54:14 KAW001 named[2398]: client 62.213.199.236#38429: query (cache) 'schuetzen-loxstedt.de/A/IN' denied
Feb  2 14:54:34 KAW001 named[2398]: client 62.213.199.236#38429: query (cache) 'o-fx.de/A/IN' denied
Feb  2 14:54:54 KAW001 named[2398]: client 62.213.199.236#38429: query (cache) 'qsc-plus.de/A/IN' denied

Any suggestions?

link|improve this question
100% accept rate
Suggestion - change your title to something like "Lots of DNS queries" or something similar. – mfinni Feb 2 '11 at 14:23
feedback

2 Answers

up vote 10 down vote accepted

Someone is attempting to resolve those domains against your DNS server, and you clearly don't have recursion or query enabled for people outside of your network.

I wouldn't be worried.. It happens when you put a DNS server public..

link|improve this answer
so no suggestions? just let them ping me to the end of internet? maybe something is wrong on their part and I should tell them. – Elzo Valugi Feb 2 '11 at 14:20
2  
@Elzo - welcome to the world of administering a service that's open to the whole internet. Don't worry about other people's systems unless you're being actively attacked. – mfinni Feb 2 '11 at 14:24
thanks to all of you – Elzo Valugi Feb 2 '11 at 14:34
feedback
up vote 1 down vote

You didn't specify whether this DNS server is public or private.

If it is an internal / private server, then you really need to take a look at your firewall configuration, because packets should not be hitting the DNS server in the first place. You have probably correctly configured your DNS server to disallow external queries, but your firewall should not allow these queries in the first place, in which case you should look at blocking port 53.

If this is an open, public DNS server, then it's likely that you have a problem in your config file. On the other hand, if you are only authorative for certain domains, then the logs you are seeing is the correct behaviour.

link|improve this answer
thx for the suggestions. this server is private and now the port is blocked by firewall – Elzo Valugi May 4 '11 at 20:29
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.