Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

DNS resolution worked fine in late March, but now, some resolvers (my resolver on my LAN behind NAT, and my ISP RCN's resolver) have problems with hostnames it this zone, while other (eg, Google's 8.8.8.8) do not.

These DNS queries are NOT whitewashed. You can query any hostname in the ".mail.eo.outlook.com" zone.

GOOGLE CAN RESOLVE IT . . .

$ dig anything.mail.eo.outlook.com @8.8.8.8

; <<>> DiG 9.8.3-P1 <<>> anything.mail.eo.outlook.com @8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26750
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;anything.mail.eo.outlook.com.  IN  A

;; ANSWER SECTION:
anything.mail.eo.outlook.com. 10 IN A   213.199.154.87
anything.mail.eo.outlook.com. 10 IN A   213.199.154.23

;; Query time: 45 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Thu Apr  4 12:32:01 2013
;; MSG SIZE  rcvd: 78

While my resolver, and RCN's cannot:

$ dig anything.mail.eo.outlook.com @192.168.42.108

; <<>> DiG 9.8.3-P1 <<>> anything.mail.eo.outlook.com @192.168.42.108
;; global options: +cmd
;; connection timed out; no servers could be reached

$ dig anything.mail.eo.outlook.com @97.107.142.193

; <<>> DiG 9.8.3-P1 <<>> anything.mail.eo.outlook.com @97.107.142.193
;; global options: +cmd
;; connection timed out; no servers could be reached

The resolvers do function correctly on other zones:

$ dig +short www.google.com @192.168.42.108
74.125.131.105
74.125.131.106
74.125.131.147
74.125.131.99
74.125.131.103
74.125.131.104
$ dig +short www.amizon.com @192.168.42.108
rewrite.amazon.com.
72.21.210.29
$ dig +short www.google.com @97.107.142.193
74.125.228.49
74.125.228.50
74.125.228.51
74.125.228.52
74.125.228.48
$ dig +short www.amizon.com @97.107.142.193
rewrite.amazon.com.
207.171.166.22

IF I DIG STEP BY STEP . . .

Who is auth for outlook.com? Let's ask 192.35.51.30 (that's f.gtld-servers.net ).

$ dig ns outlook.com @192.35.51.30

; <<>> DiG 9.8.3-P1 <<>> ns outlook.com @192.35.51.30
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11775
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 5, ADDITIONAL: 10
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;outlook.com.           IN  NS

;; AUTHORITY SECTION:
outlook.com.        172800  IN  NS  nse1.msft.net.
outlook.com.        172800  IN  NS  nse5.msft.net.
outlook.com.        172800  IN  NS  nse2.msft.net.
outlook.com.        172800  IN  NS  nse3.msft.net.
outlook.com.        172800  IN  NS  nse4.msft.net.

;; ADDITIONAL SECTION:
nse1.msft.net.      172800  IN  AAAA    2a01:111:2005::1:1
nse1.msft.net.      172800  IN  A   65.55.37.62
nse5.msft.net.      172800  IN  AAAA    2a01:111:200f:1::1:1
nse5.msft.net.      172800  IN  A   65.55.226.140
nse2.msft.net.      172800  IN  AAAA    2a01:111:2006:6::1:1
nse2.msft.net.      172800  IN  A   64.4.59.173
nse3.msft.net.      172800  IN  A   213.199.180.53
nse3.msft.net.      172800  IN  AAAA    2a01:111:2020::1:1
nse4.msft.net.      172800  IN  A   207.46.75.254
nse4.msft.net.      172800  IN  AAAA    2404:f800:2003::1:1

;; Query time: 97 msec
;; SERVER: 192.35.51.30#53(192.35.51.30)
;; WHEN: Thu Apr  4 13:57:45 2013
;; MSG SIZE  rcvd: 352

Ask one of those nameservers for an answer...

$ dig soa anything.mail.eo.outlook.com @65.55.37.62

; <<>> DiG 9.8.3-P1 <<>> soa anything.mail.eo.outlook.com @65.55.37.62
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 19950
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 2, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;anything.mail.eo.outlook.com.  IN  SOA

;; AUTHORITY SECTION:
mail.eo.outlook.com.    7200    IN  NS  ns2-prodeodns.glbdns.o365filtering.com.
mail.eo.outlook.com.    7200    IN  NS  ns1-prodeodns.glbdns.o365filtering.com.

;; Query time: 95 msec
;; SERVER: 65.55.37.62#53(65.55.37.62)
;; WHEN: Thu Apr  4 14:36:33 2013
;; MSG SIZE  rcvd: 142

So the zone is delegated, let's lookup IP of delegated NS...

$ dig +short ns1-prodeodns.glbdns.o365filtering.com
65.55.169.42
207.46.100.42

And then ask them both...

$ dig anything.mail.eo.outlook.com @65.55.169.42

; <<>> DiG 9.8.3-P1 <<>> anything.mail.eo.outlook.com @65.55.169.42
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33481
;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;anything.mail.eo.outlook.com.  IN  A

;; ANSWER SECTION:
anything.mail.eo.outlook.com. 10 IN A   213.199.154.87
anything.mail.eo.outlook.com. 10 IN A   213.199.154.23

;; Query time: 55 msec
;; SERVER: 65.55.169.42#53(65.55.169.42)
;; WHEN: Thu Apr  4 14:38:21 2013
;; MSG SIZE  rcvd: 134

$ dig anything.mail.eo.outlook.com @207.46.100.42

; <<>> DiG 9.8.3-P1 <<>> anything.mail.eo.outlook.com @207.46.100.42
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36656
;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;anything.mail.eo.outlook.com.  IN  A

;; ANSWER SECTION:
anything.mail.eo.outlook.com. 10 IN A   213.199.154.87
anything.mail.eo.outlook.com. 10 IN A   213.199.154.23

;; Query time: 91 msec
;; SERVER: 207.46.100.42#53(207.46.100.42)
;; WHEN: Thu Apr  4 14:38:31 2013
;; MSG SIZE  rcvd: 134
share|improve this question
    

2 Answers 2

up vote 3 down vote accepted

I removed the following line from my named.conf file and the request is now working.

query-source address * port 53;

the following was forwarded to me from someone I reached out to...

As you know, DNS queries from DNS servers could come from a source port of 53. A while back, because of some security issues, BIND started allowing the randomization of course ports. However, often DNS servers are configured to use the traditional behavior of using source port 53.

eg.. query-source address * port 53 directive

This was often done because port randomization behind masqueraded connections, or some firewalls ended up using all the size of caching and translation tables..

Both methods worked equally well.. until recently.

We have noticed that ATT and Microsoft Live hosted domains are having a problem, in that if the source port of the DNS query is below port 1024, you cannot do a DNS MX record lookup (No servers could be reached)

Needless to say, that can cause email delivery interruptions..

share|improve this answer
    
THIS is most definitely an answer! It makes perfect sense, I'll see if it fixes my problem too... –  Craig Constantine Apr 6 '13 at 1:12
    
I had the same problem with *.mail.protection.outlook.com and this solved it. Thank you isaac! –  Mark Ormston May 6 '13 at 22:46

I have the same problem. Started at about the same time. I believe it has to do with something with in bind because I have another server running dnscache on the same class C and it does not have any problems resolving these domains.

share|improve this answer
1  
...but that's not an answer. :) I'm currently working on adjusting my system's nsswitch.conf and hosts files to "fill in" the hostname-to-IP address that isn't resolvable via DNS. It's a hack, but at least it's a when-dns-cannot-resolve, then use this ip hack. If MS fixes their dns servers down the road, my record in hosts file won't matter –  Craig Constantine Apr 5 '13 at 15:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.