Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am using BIND9 as a caching only name server on my machine.

BIND is only listening on localhost and only localhost is allowed to query the DNS server. I use it to cache requests to the RBL lists because the machine is the mail server.

I get a lot of warning from BIND about lame server resolving:

named[1017]: lame server resolving 'www.gadgethive.com' (in 'gadgethive.com'?): 109.73.163.116#53
named[1017]: lame server resolving 'www.gadgethive.com' (in 'gadgethive.com'?): 109.73.163.115#53
named[1017]: lame server resolving 'www.gadgethive.com' (in 'gadgethive.com'?): 109.73.163.116#53

I do understand what that means, but I can not find the culprit for this message. It is always the same domain in the logs and by examining mail server logs I can not find the email with that domain.

To make things worst there wasn't even an email being received at the time this logs are recorded in the system log.

Is there a way to find which process on the server is issuing this requests?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

BIND9 has no concept of what is asking to do a lookup. It only knows that a connection was made on a port... and it asked for some DNS records. Your best bet is to log DNS connections using iptables. From there you can find out exactly who connected & when, and cross-reference them.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.