Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When using "dig A" I get SERVFAIL and no answer. But when I do a "dig ANY" I get NOERROR and it returns an A record.

Any idea as to what may be wrong with the domain in question?

Below is a sanitized example. Same thing happens when I use other @dns_servers:

user@server1:~$ dig A

; <<>> DiG 9.7.3 <<>> A
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 19887
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;         IN      A

;; Query time: 3719 msec
;; WHEN: Fri Feb 15 01:17:10 2013
;; MSG SIZE  rcvd: 39

user@server1:~$ dig ANY

; <<>> DiG 9.7.3 <<>> ANY
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24213
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;         IN      ANY

;; ANSWER SECTION:  20      IN      A

;; Query time: 88 msec
;; WHEN: Fri Feb 15 01:21:45 2013
;; MSG SIZE  rcvd: 55
share|improve this question
SERVFAIL means that the server returned an error. Check the logs on the DNS servers involved. – mgorven Feb 15 '13 at 6:22
Right, so what if I dont have access to the logs on the dns server that I query. For example, if I were to try or and it has the same result. – sij99 Feb 15 '13 at 6:25
Do you control any of the DNS servers involved? (i.e. Including those serving the zone you're querying.) – mgorven Feb 15 '13 at 6:26
No, the zone I am querying belongs to another company. I am trying to figure out what may be wrong to build a case and ask them to check on this host. For what its worth, when i query it returns the proper a record every time. – sij99 Feb 15 '13 at 6:29
These questions are much easier to answer when you say what hostname you're doing these lookups on, because it means others can replicate your results. – MadHatter Feb 15 '13 at 9:39

The SERVFAIL taking 3.7s is interesting, it's well below any normal timeout value. dig without @ will use your local resolver configuration. You need to eliminate that as a cause.

Directly check all the company's resolvers in turn, this should work generally (though not in some cases):

for ns in $(dig +short ns); do 
    dig @$ns any; 

Then check all your own resolvers in turn:

for ns in $(awk '/nameserver/{print $2}' /etc/resolv.conf); do 
    dig  @$ns any; 

Normally the observed problem is the other way around, problems receiving "ANY" because the reply is too large, or a firewall/IPS is dropping "ANY" queries.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.