1

I am using BIND9 as a caching only name server on my machine.

BIND is only listening on localhost and only localhost is allowed to query the DNS server. I use it to cache requests to the RBL lists because the machine is the mail server.

I get a lot of warning from BIND about lame server resolving:

named[1017]: lame server resolving 'www.gadgethive.com' (in 'gadgethive.com'?): 109.73.163.116#53
named[1017]: lame server resolving 'www.gadgethive.com' (in 'gadgethive.com'?): 109.73.163.115#53
named[1017]: lame server resolving 'www.gadgethive.com' (in 'gadgethive.com'?): 109.73.163.116#53

I do understand what that means, but I can not find the culprit for this message. It is always the same domain in the logs and by examining mail server logs I can not find the email with that domain.

To make things worst there wasn't even an email being received at the time this logs are recorded in the system log.

Is there a way to find which process on the server is issuing this requests?

1

BIND9 has no concept of what is asking to do a lookup. It only knows that a connection was made on a port... and it asked for some DNS records. Your best bet is to log DNS connections using iptables. From there you can find out exactly who connected & when, and cross-reference them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.