Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have dns cache servers. I am using BIND 9.8.3-P1 or dnscache(djbdns cache). I see very often errors in my log "unexpected RCODE SERVFAIL". Both bind9 and dnscache have that problem. In tcpdump i see that they not even ask authoritative servers. With nslookup from the same machine i get correct answers from authoritative servers.

It seems my cache servers puts in their cache servfail answers and don't bother to ask again. I think that by RFC they shouldn't put SERVFAIL answers at all. Any ideas will be appreciated.

share|improve this question
add comment

1 Answer

I think you're right about what's happening, but RFC 2308 is pretty clear in s7.1 that caching a SERVFAIL is allowed:

In either case a resolver MAY cache a server failure response.  If it
does so it MUST NOT cache it for longer than five (5) minutes

If you're running the DNS server, you can likely tune this behaviour, or even stop it altogether, so if the name server that's caching this stuff and annoying you is outside your control, run your own DNS server.

share|improve this answer
    
I am running this cache servers. Sorry, but i can't find any options that control this behaviour. –  Vesselin Yanev Nov 21 '12 at 8:55
    
Which nameserver? BIND? djbdns? Something even more outre? –  MadHatter Nov 21 '12 at 9:12
    
I am running BIND 9.8.3-P1. I found some option lame-ttl. I will try to set it on 0 and check if this happen again. –  Vesselin Yanev Nov 21 '12 at 9:28
    
I think it works now. With tcpdump now i see that every time i ask for some servfailed query my server make query to authoritative servers. It seems my servers don't put in cache this lame queries now which was what i wanted. Thank you for your help. –  Vesselin Yanev Nov 21 '12 at 9:45
    
Vesselin, you're welcome; in case you already know, please forgive me for pointing out the local etiquette: once you're happy with an answer you accept it by clicking on the tick outline next to it, which drives the SF reputation system both for you and for the authors of the accepted answers. –  MadHatter Nov 21 '12 at 11:50
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.