Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

got a strange selection of errors in my logwatch that lists a 'network unreachable resolving nsX.somedomain.com' error repeatedly. This is on an Ubuntu 9.04 Server install with latest updates using bind for dns.

I've seen various blog posts blaming the repeated entries on spamassasin, but I don't have that installed. The domains listed seem to be ones that are accessed within my network - but there's no reason my server should be attempting to resolve these - I have my ISP's name servers for that, and all my computers are configured to get DNS from the correct location.

Any ideas for a solution would be incredibly helpful - my logwatch results are getting longer and longer! I've given an example of these logs below.

    network unreachable resolving 'e.ns.lanechange.info/A/IN': 2001:500:49::1#53: 1 Time(s)
    network unreachable resolving 'e.ns.lanechange.info/AAAA/IN': 2001:500:49::1#53: 1 Time(s)
    network unreachable resolving 'echochamber.me/A/IN': 2001:4830:120:1::1#53: 1 Time(s)

I also have similar results for ROOT-SERVERS.NET

share|improve this question
    
Your post is quite contradictory: you say you use BIND on your Ubuntu machine and later you say you use the ISP's name servers for name resolution. Which sentence is correct? –  bortzmeyer Oct 23 '09 at 10:22
    
I use BIND to serve my own DNS records ie the results for resborand.co.uk and its subdomains. I use my ISPs nameservers to resolve requests for everything else e.g google.com yahoo.com –  Elliot Hughes Oct 24 '09 at 12:05
add comment

2 Answers 2

It seems bind by default now tries to resolve queries recursively using ipv6. The log clearly states that bind tries to resolve recursively using ipv6, so I doubt that it isn't used for that. 2001:4830:120:1 is not reachable at least.

Add -4 to the bind command line to disable this. For debian, this means to put

OPTIONS="-u bind -4"

into /etc/default/bind9, don't know if it's the same in ubuntu.

share|improve this answer
add comment

OK, with the comment you added (that the BIND on your machine is just here for serving data authoritatively), you should not see these warnings because BIND should not attempt to contact other name servers (except secondaries, to notify them of updates). Hence my question: are you sure your BIND is purely authoritative? Do you have "recursion no;" in its configuration? Does it reply to recursive queries?

Otherwise, remember that the IPv6 Internet is currently split in two, due to Cogent's refusal to peer with other operators. So, at this time, IPv6 connectivity errors, like the ones you see, are to be expected.

share|improve this answer
add comment

protected by Chris S Nov 15 '11 at 14:01

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.