2

I have two BIND servers with the same version "BIND 9.3.4-P1" and the same named.ca file. When i try to dig from one server i get:

connection timed out; no servers could be reached

While from the second DNS i can. When i try to run:

dig +trace mailhost.agasoft.co.il

I get:

; <<>> DiG 9.3.4-P1 <<>> +trace mailserver1.agasoft.co.il
;; global options: printcmd
. 229 IN NS G.ROOT-SERVERS.NET.
. 229 IN NS H.ROOT-SERVERS.NET.
. 229 IN NS I.ROOT-SERVERS.NET.
. 229 IN NS J.ROOT-SERVERS.NET.
. 229 IN NS K.ROOT-SERVERS.NET.
. 229 IN NS L.ROOT-SERVERS.NET.
. 229 IN NS M.ROOT-SERVERS.NET.
. 229 IN NS A.ROOT-SERVERS.NET.
. 229 IN NS B.ROOT-SERVERS.NET.
. 229 IN NS C.ROOT-SERVERS.NET.
. 229 IN NS D.ROOT-SERVERS.NET.
. 229 IN NS E.ROOT-SERVERS.NET.
. 229 IN NS F.ROOT-SERVERS.NET.
;; Received 316 bytes from 127.0.0.1#53(127.0.0.1) in 1 ms

il. 172800 IN NS NS-EXT.ISC.ORG.
il. 172800 IN NS RIP.PSG.COM.
il. 172800 IN NS DNS8.DENIC.DE.
il. 172800 IN NS ILDNS.HUJI.AC.il.
il. 172800 IN NS NSB.NS.il.
il. 172800 IN NS LOOKUP.IUCC.AC.il.
il. 172800 IN NS NS-IL.RIPE.NET.
;; Received 394 bytes from 192.112.36.4#53(G.ROOT-SERVERS.NET) in 119 ms

agasoft.co.il. 86400 IN NS ns.agasoft.co.il.
agasoft.co.il. 86400 IN NS ns3.agasoft.co.il.
;; Received 110 bytes from 204.152.184.64#53(NS-EXT.ISC.ORG) in 284 ms

dig: couldn't get address for 'ns.agasoft.co.il': failure

From what i understand, is that one of their NS server is down, so BIND not even trying the second one.

Is there anything i can do to fix it?

1
  • You need to provide more details, such as the complete output of dig when running on both of your machines.
    – bortzmeyer
    Sep 10, 2009 at 13:51

4 Answers 4

2

In your dig output, the name servers for that domain appear to be ns.agasoft.co.il and ns3.agasoft.co.il.

However, as of right now, their name servers are webserver1.agasoft.co.il and webserver2.agasoft.co.il.

It appears they changed their name servers.

In addition, mailhost.agasoft.co.il does not exist, according to those servers. Instead, their mail server (as identified by their MX record) is mailserver1.agasoft.co.il. This host does exist, and both name servers return the same address for it: 82.80.246.156.

Also note that in your dig output above, you requested a trace for mailhost.agasoft.co.il but the output shows for mailserver1.agasoft.co.il. Was that a typo in your question?


Summary: the agasoft.co.il domain appears to have recently changed their name servers and possibly also their mail server. If you are trying to find out why mail couldn’t be delivered to them, that’s why. The old name servers (according to your dig output) have a TTL of 1 day, so the problem should clear up in a day or so.

0

The name servers assigned to - agasoft.co.il

Seem to be - webserver1.agasoft.co.il and ns2.agasoft.co.il

Both appear to be up and available to serve DNS requests.

However neither seem to have DNS information for the host - mailhost.agasoft.co.il

Try adding an A record for mailhost.agasoft.co.il

4
  • Agasoft is not my server. So i can't really change anything on their side. The main question why one of BIND servers get a response while other not. I excluded network problem
    – gtfx
    Sep 7, 2009 at 16:34
  • Can you be more specific about what you are trying to do? What are your name servers? Are you trying to resolve a host that you are authoritative for? What is the host? You're not being clear so it's hard to help you.
    – jchawk
    Sep 7, 2009 at 18:12
  • 1
    Some wild guess: Maybe the working bind gets its answer from its cache... or the other way around.
    – Julien
    Sep 9, 2009 at 10:38
  • Marking -1 because submitter has not responded to any request for follow up.
    – jchawk
    Sep 9, 2009 at 17:54
0

agasoft.co.il has only two name servers, and the closeness of their IP addresses indicate that they are probably in the same room, behind the same network (this is bad practice).

So, any problem is bound to affect both of them and to completely prevent name resolution. (A typical example is broken middleboxes, such as load balancers that hash the incoming packet, sending requests from one of your BINDs to a black hole.)

You can run tcpdump on both of your machines to see if packets are coming back.

0

Analyzing a query:

il. 172800 IN NS NS-EXT.ISC.ORG.
il. 172800 IN NS RIP.PSG.COM.
il. 172800 IN NS DNS8.DENIC.DE.
il. 172800 IN NS ILDNS.HUJI.AC.il.
il. 172800 IN NS NSB.NS.il.
il. 172800 IN NS LOOKUP.IUCC.AC.il.
il. 172800 IN NS NS-IL.RIPE.NET.
;; Received 394 bytes from 192.112.36.4#53(G.ROOT-SERVERS.NET) in 119 ms

this NS are given by root server G.ROOT

agasoft.co.il. 86400 IN NS ns.agasoft.co.il.
agasoft.co.il. 86400 IN NS ns3.agasoft.co.il.
;; Received 110 bytes from 204.152.184.64#53(NS-EXT.ISC.ORG) in 284 ms

NS-EXT.ISC.ORG tells you the domain has this two NS records. Then you fail resolving the IP of the first one.

if you

dig agasoft.co.il @ILDNS.HUJI.AC.il

it will resolve correctly, so it seems that NS servers are not all up to date.

3
  • There is no relationship with the root name servers. May be you referred to the ".IL" name servers?
    – bortzmeyer
    Sep 10, 2009 at 13:52
  • I'll edit to explain better.
    – drAlberT
    Sep 10, 2009 at 17:01
  • The +trace option always starts from the root name servers. The fact that they are shown in his dig output does not mean anything.
    – Nate
    Sep 10, 2009 at 17:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .