Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Please clarify for me the meaning of the following BIND messages in syslog, these are from a DNS resolver. Whilst I think I understand them, I don't know what all four mean, so I think it's best if someone will clarify for me:

1.
Oct 14 18:36:34 resolver1 named[14958]: lame server resolving 'arrivatn.co.uk' (in 'arrivatn.co.uk'?): 212.103.224.56#53

2.  
Oct 14 18:36:36 resolver1 named[14958]: unexpected RCODE (SERVFAIL) resolving '148.128.183.212.in-addr.arpa/PTR/IN': 212.183.136.42#53

3.
Oct 14 18:38:49 resolver1 named[14958]: unexpected RCODE (REFUSED) resolving 'internal-server.ournetwork.com/AAAA/IN': auth.dns.server.ip#53

4.  
Oct 14 18:39:05 resolver1 named[14958]: client 89.187.127.110#42034: query (cache) 'image.sinajs.cn/A/IN' denied

Thank you.

share|improve this question

1 Answer 1

up vote 8 down vote accepted
  1. The nameserver it contacted was expected to be authoritative but isn't.
  2. The nameserver responded with a SERVFAIL error code.
  3. The nameserver responded with a REFUSED error code.
  4. The client was denied access to read the cached response for that domain.

1-3 are issues with the configuration of the nameserver for the domains/zones in question, #4 is caused by your local security configuration restricting the (probably remote, unauthorized) from reading from your local query cache. (Reading said cache remotely may allow certain kinds of attacks, so generally speaking you don't allow this unless you're providing a recursive resolver.)

All of these errors are fairly normal, however, if your resolver is just for local use, and not also providing authoritative replies for a zone, you might consider changing the nameserver to only listen on localhost, or firewalling it from remote access. (This will prevent #4, and reduce your attack surface area.)

share|improve this answer
    
Whoops, I put 3 and 4 the wrong way round. Did you write your answers against the numbers so they are still in the correct order? –  jwbensley Oct 15 '12 at 8:05
    
The answer here still matches up, I wrote based on the order, not the numbers. –  Eric Oct 15 '12 at 19:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.