I've an interesting bug in my master name server. I'm running Fedora Linux, with bind 9.3.4. The server is planned to be replaced, as it's quite old, but I have to make it work in the meantime. The problem is that my name server cannot resolve digbypines.ca. The authoritative name servers for digbypines.ca are 220.127.116.11 and 18.104.22.168. My name server is at 22.214.171.124.
A firewall bug (where outgoing DNS connections were SNATted to port 53) made it impossible to contact the nameservers for digbypines.ca. So if I were to ssh into my name server at 126.96.36.199 and run
dig @188.8.131.52 digbypines.ca
I would get
;; connection timed out; no servers could be reached
If I tried to telnet to 184.108.40.206 on port 53, I'd also get a timeout. That being the case, I removed the SNAT firewall rule, and now the above commands work as expected. But here's the interesting part.
For some reason, I can't convince bind to talk to digbypine's name servers! Even after fixing the SNATting, it won't work.
Running 'dig +trace digbypines.ca' shows that I'll get the NS records, but it refuses to resolve them:
dig +trace digbypines.ca
; <<>> DiG 9.3.4-P1 <<>> +trace digbypines.ca ;; global options: printcmd . 516709 IN NS
i.root-servers.net. . 516709 IN NS
j.root-servers.net. . 516709 IN NS
k.root-servers.net. . 516709 IN NS
l.root-servers.net. . 516709 IN NS
m.root-servers.net. . 516709 IN NS
a.root-servers.net. . 516709 IN NS
b.root-servers.net. . 516709 IN NS
c.root-servers.net. . 516709 IN NS
d.root-servers.net. . 516709 IN NS
e.root-servers.net. . 516709 IN NS
f.root-servers.net. . 516709 IN NS
g.root-servers.net. . 516709 IN NS
h.root-servers.net. ;; Received 408 bytes from 192.168.0.12#53(192.168.0.12) in 1 ms
ca. 172800 IN NS l.ca-servers.ca. ca.
172800 IN NS sns-pb.isc.org. ca. 172800 IN NS m.ca-servers.ca. ca. 172800 IN
NS c.ca-servers.ca. ca. 172800 IN NS
a.ca-servers.ca. ca. 172800 IN NS
j.ca-servers.ca. ca. 172800 IN NS
f.ca-servers.ca. ca. 172800 IN NS
k.ca-servers.ca. ca. 172800 IN NS
z.ca-servers.ca. ca. 172800 IN NS
e.ca-servers.ca. ;; Received 430 bytes from 220.127.116.11#53(i.root-servers.net) in 120 ms
digbypines.ca. 86400 IN NS ns2.extremehosting.ca. digbypines.ca. 86400 IN NS ns1.extremehosting.ca. ;; Received 114 bytes from 18.104.22.168#53(l.ca-servers.ca) in 31 ms
dig: couldn't get address for 'ns2.extremehosting.ca': failure
I'm a little stuck. I called their support group, and they've assured me that my IPs aren't blocked. I'm really not sure how I can dig on their name servers on the command line, yet cannot conduct the same operation through bind.
I've also tried restarting bind, networking, and running 'rndc flush'. No love.
I can resolve digbypines.ca and indeed ns2.extremehosting.ca and ns1.extremehosting.ca from home, so I'm not sure what's going on.
I can also run
dig @22.214.171.124 ns2.extremehosting.ca successfully from my name server's command line.