Please clarify for me the meaning of the following BIND messages in syslog, these are from a DNS resolver. Whilst I think I understand them, I don't know what all four mean, so I think it's best if someone will clarify for me:

Oct 14 18:36:34 resolver1 named[14958]: lame server resolving 'arrivatn.co.uk' (in 'arrivatn.co.uk'?):

Oct 14 18:36:36 resolver1 named[14958]: unexpected RCODE (SERVFAIL) resolving '':

Oct 14 18:38:49 resolver1 named[14958]: unexpected RCODE (REFUSED) resolving 'internal-server.ournetwork.com/AAAA/IN': auth.dns.server.ip#53

Oct 14 18:39:05 resolver1 named[14958]: client query (cache) 'image.sinajs.cn/A/IN' denied

Thank you.

  1. The nameserver it contacted was expected to be authoritative but isn't.
  2. The nameserver responded with a SERVFAIL error code.
  3. The nameserver responded with a REFUSED error code.
  4. The client was denied access to read the cached response for that domain.

1-3 are issues with the configuration of the nameserver for the domains/zones in question, #4 is caused by your local security configuration restricting the (probably remote, unauthorized) from reading from your local query cache. (Reading said cache remotely may allow certain kinds of attacks, so generally speaking you don't allow this unless you're providing a recursive resolver.)

All of these errors are fairly normal, however, if your resolver is just for local use, and not also providing authoritative replies for a zone, you might consider changing the nameserver to only listen on localhost, or firewalling it from remote access. (This will prevent #4, and reduce your attack surface area.)

  • Whoops, I put 3 and 4 the wrong way round. Did you write your answers against the numbers so they are still in the correct order?
    – jwbensley
    Oct 15 '12 at 8:05
  • The answer here still matches up, I wrote based on the order, not the numbers.
    – Eric
    Oct 15 '12 at 19:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.