named logs denied messages related to external view

Question

I have around 200k same entries in my /var/log/messages received from named, like:

Oct 29 15:48:34 server named[878]: client 75.100.*.*#56448: view external: query (cache) 'example.com.co/A/IN' denied

Where example.com.co is an external domain not related to my site and being blocked for some reasons. External view is configured as below:

view    "external" {
    recursion no;

    zone "." IN {
        type hint;
        file "/var/named/named.ca";
    };

zone "example2.com" {
        type master;
        file "/var/named/example2.db";
};
};

Where example2.com is my own domain. Could you please explain what actually does the log entry mean and what should I do to prevent it from being logged?

Thanks.

Configuration: CentOS 6, BIND 9.7

Answer 1

It seems you have users querying your server for names that aren't yours. If the 200k log events are all from the same client IP address, I'd block that IP in my firewall for 24-48 hours to see if they stop and report them to their ISP. If they're from many different addresses (especially from different ISPs and different parts of the world), I'd spend some time to figure out why they're querying your server.

dig example.com.co. NS

Does the above command mistakenly list your name server as an authoritative one for their domain? If so, contact them using their whois contact information.