Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Not sure my question's title is explicit, so I'll try and explain it the best I can.

I have a dedicated web hosting server running Linux (Gentoo). There are a couple websites hosted on it, and therefore a couple domain names from multiple providers have their DNS zone settings set to point to my server.

There is one particular website that used to be hosted on this server, but was then removed. However, it looks like its domain name is still pointing to my server. If I cat /var/log/messages :

Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/A/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/A/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/A/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/A/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/A/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/A/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/A/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/A/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/A/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/A/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/A/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/A/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/MX/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/MX/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/MX/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/MX/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/MX/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/MX/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/MX/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/MX/IN' denied
Jan 16 03:13:36 stock named[25829]: client XX.XX.XX.XX#XXXXX: query (cache) 'the-goddamn-domain.com/MX/IN' denied

As you can see, I have dozens of these a second.

Can I do anything to forbid these requests (except contacting the owner and asking him to change his DNS zone settings) ? The server already denies them, but I guess it still tries and wastes a couple of microseconds for each of them, which all added up is no good to me. I thought of banning the IPs but they always seem to change (guess the requests come from multiple DNS servers around the world).

share|improve this question
add comment

migrated from stackoverflow.com Jan 17 '13 at 16:13

This question came from our site for professional and enthusiast programmers.

2 Answers

up vote 1 down vote accepted

You are asking "Can I do anything to forbid these requests?" but it seems that you are already doing it. Isn't that exactly what 'the-goddamn-domain.com/A/IN' denied means?

If you are thinking of adding something else to do the filtering in front of the DNS server to save microseconds, then it doesn't make much sense to do it. The new filter will still waste cycles filtering the request before it lets it through to the real DNS server. What you have right now is the optimal solution.

If are worried about the disk space wasted on logging, then there might be a way to silence the error message from the logs. If nothing else, you can simply filter out the message in your syslog configuration.

Or you can simply add the zone back with only an SOA record in.

share|improve this answer
    
"Or you can simply add the zone back with only an SOA record in." Wouldn't that effectively blackhole the site for those DNS resolvers using neemzy's site? E.g. the domain resolves but those users will get "site not found" messages and mail will bounce. That should attrect the attention of the owners of the domain, but perhaps not in a positive way... –  JvO Jan 18 '13 at 16:26
add comment

Nope. It really is how you describe: the top-level DNS zone still points to your server for that-goddamn-domain.com. Computers from all over the world will contact your server to ask for its address, so you can't block them. Contact the owner first, and it that doesn't help the registrar.

share|improve this answer
    
Wrong. Contact the owner, who is ultimately responsible for ensuring the DNS for his/her domain is correct. –  John Gardeniers Jan 18 '13 at 5:29
    
I should have added: in my experience the owner often either: doesn't know how, doesn't care or simply cannot be reached. I'll clarify. –  JvO Jan 18 '13 at 5:45
    
@JohnGardeniers And that will achieve exactly nothing. THe question is not "what to do" but "how can I stop that by force" and contacting the owner has no technical or fast legal way. –  TomTom Jan 18 '13 at 5:51
    
Thanks. I accepted chutz's answer as he points out some ways to at least shut these messages up, but I'll still see what I can do with the owner and/or the registrar. Would have upvoted your answer but it's my first post ever on ServerFault, and I don't have enough reputation :) I would add that, by experience too, I agree with JvO about domain name owners' abilities to deal with that kind of request. –  neemzy Jan 18 '13 at 8:22
    
@TomTom Please read the comments to answers in the context of the answer to which they apply. In this case contacting the registrar, who has absolutely no responsibility for the DNS, is a complete waste of time. –  John Gardeniers Jan 18 '13 at 11:45
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.