What is the meaning of these BIND log messages?

Question

Please clarify for me the meaning of the following BIND messages in syslog, these are from a DNS resolver. Whilst I think I understand them, I don't know what all four mean, so I think it's best if someone will clarify for me:

1.
Oct 14 18:36:34 resolver1 named[14958]: lame server resolving 'arrivatn.co.uk' (in 'arrivatn.co.uk'?): 212.103.224.56#53

2.  
Oct 14 18:36:36 resolver1 named[14958]: unexpected RCODE (SERVFAIL) resolving '148.128.183.212.in-addr.arpa/PTR/IN': 212.183.136.42#53

3.
Oct 14 18:38:49 resolver1 named[14958]: unexpected RCODE (REFUSED) resolving 'internal-server.ournetwork.com/AAAA/IN': auth.dns.server.ip#53

4.  
Oct 14 18:39:05 resolver1 named[14958]: client 89.187.127.110#42034: query (cache) 'image.sinajs.cn/A/IN' denied

Thank you.

Answer 1

1. The nameserver it contacted was expected to be authoritative but isn't.
2. The nameserver responded with a SERVFAIL error code.
3. The nameserver responded with a REFUSED error code.
4. The client was denied access to read the cached response for that domain.

1-3 are issues with the configuration of the nameserver for the domains/zones in question, #4 is caused by your local security configuration restricting the (probably remote, unauthorized) from reading from your local query cache. (Reading said cache remotely may allow certain kinds of attacks, so generally speaking you don't allow this unless you're providing a recursive resolver.)

All of these errors are fairly normal, however, if your resolver is just for local use, and not also providing authoritative replies for a zone, you might consider changing the nameserver to only listen on localhost, or firewalling it from remote access. (This will prevent #4, and reduce your attack surface area.)