Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have two BIND servers with the same version "BIND 9.3.4-P1" and the same named.ca file. When i try to dig from one server i get:

connection timed out; no servers could be reached

While from the second DNS i can. When i try to run:

dig +trace mailhost.agasoft.co.il

I get:

; <<>> DiG 9.3.4-P1 <<>> +trace mailserver1.agasoft.co.il
;; global options: printcmd
. 229 IN NS G.ROOT-SERVERS.NET.
. 229 IN NS H.ROOT-SERVERS.NET.
. 229 IN NS I.ROOT-SERVERS.NET.
. 229 IN NS J.ROOT-SERVERS.NET.
. 229 IN NS K.ROOT-SERVERS.NET.
. 229 IN NS L.ROOT-SERVERS.NET.
. 229 IN NS M.ROOT-SERVERS.NET.
. 229 IN NS A.ROOT-SERVERS.NET.
. 229 IN NS B.ROOT-SERVERS.NET.
. 229 IN NS C.ROOT-SERVERS.NET.
. 229 IN NS D.ROOT-SERVERS.NET.
. 229 IN NS E.ROOT-SERVERS.NET.
. 229 IN NS F.ROOT-SERVERS.NET.
;; Received 316 bytes from 127.0.0.1#53(127.0.0.1) in 1 ms

il. 172800 IN NS NS-EXT.ISC.ORG.
il. 172800 IN NS RIP.PSG.COM.
il. 172800 IN NS DNS8.DENIC.DE.
il. 172800 IN NS ILDNS.HUJI.AC.il.
il. 172800 IN NS NSB.NS.il.
il. 172800 IN NS LOOKUP.IUCC.AC.il.
il. 172800 IN NS NS-IL.RIPE.NET.
;; Received 394 bytes from 192.112.36.4#53(G.ROOT-SERVERS.NET) in 119 ms

agasoft.co.il. 86400 IN NS ns.agasoft.co.il.
agasoft.co.il. 86400 IN NS ns3.agasoft.co.il.
;; Received 110 bytes from 204.152.184.64#53(NS-EXT.ISC.ORG) in 284 ms

dig: couldn't get address for 'ns.agasoft.co.il': failure

From what i understand, is that one of their NS server is down, so BIND not even trying the second one.

Is there anything i can do to fix it?

share|improve this question
    
You need to provide more details, such as the complete output of dig when running on both of your machines. –  bortzmeyer Sep 10 '09 at 13:51

4 Answers 4

In your dig output, the name servers for that domain appear to be ns.agasoft.co.il and ns3.agasoft.co.il.

However, as of right now, their name servers are webserver1.agasoft.co.il and webserver2.agasoft.co.il.

It appears they changed their name servers.

In addition, mailhost.agasoft.co.il does not exist, according to those servers. Instead, their mail server (as identified by their MX record) is mailserver1.agasoft.co.il. This host does exist, and both name servers return the same address for it: 82.80.246.156.

Also note that in your dig output above, you requested a trace for mailhost.agasoft.co.il but the output shows for mailserver1.agasoft.co.il. Was that a typo in your question?


Summary: the agasoft.co.il domain appears to have recently changed their name servers and possibly also their mail server. If you are trying to find out why mail couldn’t be delivered to them, that’s why. The old name servers (according to your dig output) have a TTL of 1 day, so the problem should clear up in a day or so.

share|improve this answer

The name servers assigned to - agasoft.co.il

Seem to be - webserver1.agasoft.co.il and ns2.agasoft.co.il

Both appear to be up and available to serve DNS requests.

However neither seem to have DNS information for the host - mailhost.agasoft.co.il

Try adding an A record for mailhost.agasoft.co.il

share|improve this answer
    
Agasoft is not my server. So i can't really change anything on their side. The main question why one of BIND servers get a response while other not. I excluded network problem –  gtfx Sep 7 '09 at 16:34
    
Can you be more specific about what you are trying to do? What are your name servers? Are you trying to resolve a host that you are authoritative for? What is the host? You're not being clear so it's hard to help you. –  jchawk Sep 7 '09 at 18:12
1  
Some wild guess: Maybe the working bind gets its answer from its cache... or the other way around. –  Julien Sep 9 '09 at 10:38
    
Marking -1 because submitter has not responded to any request for follow up. –  jchawk Sep 9 '09 at 17:54

agasoft.co.il has only two name servers, and the closeness of their IP addresses indicate that they are probably in the same room, behind the same network (this is bad practice).

So, any problem is bound to affect both of them and to completely prevent name resolution. (A typical example is broken middleboxes, such as load balancers that hash the incoming packet, sending requests from one of your BINDs to a black hole.)

You can run tcpdump on both of your machines to see if packets are coming back.

share|improve this answer

Analyzing a query:

il. 172800 IN NS NS-EXT.ISC.ORG.
il. 172800 IN NS RIP.PSG.COM.
il. 172800 IN NS DNS8.DENIC.DE.
il. 172800 IN NS ILDNS.HUJI.AC.il.
il. 172800 IN NS NSB.NS.il.
il. 172800 IN NS LOOKUP.IUCC.AC.il.
il. 172800 IN NS NS-IL.RIPE.NET.
;; Received 394 bytes from 192.112.36.4#53(G.ROOT-SERVERS.NET) in 119 ms

this NS are given by root server G.ROOT

agasoft.co.il. 86400 IN NS ns.agasoft.co.il.
agasoft.co.il. 86400 IN NS ns3.agasoft.co.il.
;; Received 110 bytes from 204.152.184.64#53(NS-EXT.ISC.ORG) in 284 ms

NS-EXT.ISC.ORG tells you the domain has this two NS records. Then you fail resolving the IP of the first one.

if you

dig agasoft.co.il @ILDNS.HUJI.AC.il

it will resolve correctly, so it seems that NS servers are not all up to date.

share|improve this answer
    
There is no relationship with the root name servers. May be you referred to the ".IL" name servers? –  bortzmeyer Sep 10 '09 at 13:52
    
I'll edit to explain better. –  AlberT Sep 10 '09 at 17:01
    
The +trace option always starts from the root name servers. The fact that they are shown in his dig output does not mean anything. –  Nate Sep 10 '09 at 17:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.