Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a lot of this entries in /var/log/syslog , 1 each 20 seconds. I see that are rejected but nevertheless I don't think is a good thing that somebody is pinging my server for DNS checks or whatever they are.

Feb  2 14:54:14 KAW001 named[2398]: client 62.213.199.236#38429: query (cache) 'schuetzen-loxstedt.de/A/IN' denied
Feb  2 14:54:34 KAW001 named[2398]: client 62.213.199.236#38429: query (cache) 'o-fx.de/A/IN' denied
Feb  2 14:54:54 KAW001 named[2398]: client 62.213.199.236#38429: query (cache) 'qsc-plus.de/A/IN' denied

Any suggestions?

share|improve this question
    
Suggestion - change your title to something like "Lots of DNS queries" or something similar. –  mfinni Feb 2 '11 at 14:23
add comment

2 Answers

up vote 10 down vote accepted

Someone is attempting to resolve those domains against your DNS server, and you clearly don't have recursion or query enabled for people outside of your network.

I wouldn't be worried.. It happens when you put a DNS server public..

share|improve this answer
    
so no suggestions? just let them ping me to the end of internet? maybe something is wrong on their part and I should tell them. –  Elzo Valugi Feb 2 '11 at 14:20
2  
@Elzo - welcome to the world of administering a service that's open to the whole internet. Don't worry about other people's systems unless you're being actively attacked. –  mfinni Feb 2 '11 at 14:24
    
thanks to all of you –  Elzo Valugi Feb 2 '11 at 14:34
add comment

You didn't specify whether this DNS server is public or private.

If it is an internal / private server, then you really need to take a look at your firewall configuration, because packets should not be hitting the DNS server in the first place. You have probably correctly configured your DNS server to disallow external queries, but your firewall should not allow these queries in the first place, in which case you should look at blocking port 53.

If this is an open, public DNS server, then it's likely that you have a problem in your config file. On the other hand, if you are only authorative for certain domains, then the logs you are seeing is the correct behaviour.

share|improve this answer
    
thx for the suggestions. this server is private and now the port is blocked by firewall –  Elzo Valugi May 4 '11 at 20:29
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.