2

I assure you I have searched far and wide for a clue to this problem! I have a DNS server running CentOS 5.5 and BIND 9.3. Most external lookups work fine, but lookups on one particular domain returns SERVFAIL.

  • dig @127.0.0.1 google.com -- works fine !
  • dig @127.0.0.1 athleta.com -- works fine !
  • dig @127.0.0.1 anythingelse.com -- works fine !
  • dig @127.0.0.1 bistel.co.uk -- gives SERVFAIL error

There is no reference to co.uk in any of my DNS configuration files - I never even heard of it until this problem came to my attention.

If I start using dig at a root nameserver and "work my way down", so to speak, lookups are working fine at each step. Here I start at a root nameserver and it refers me to nameserver g.dns.kr. :

dig @a.root-servers.net. bistel.co.kr
    . . .<snip>. . .
    ;; AUTHORITY SECTION:
    kr.                     172800  IN      NS      g.dns.kr.
    . . .<snip>. . .
    ;; ADDITIONAL SECTION:
    g.dns.kr.               172800  IN      A       202.31.190.1
    . . .<snip>. . .

Next I send my query to nameserver g.dns.kr. and it refers me to nameserver bistel.co.kr :

    > dig @g.dns.kr. bistel.co.kr
    . . .<snip>. . .
    ;; AUTHORITY SECTION:
    bistel.co.kr.           86400   IN      NS      ns.bistel.co.kr.
    . . .<snip>. . .
    ;; ADDITIONAL SECTION:
    ns.bistel.co.kr.        86400   IN      A       1.227.57.68
    . . .<snip>. . .

Finally I send my query to ns.bistel.co.kr. and I get the address data I was seeking:

    > dig @ns.bistel.co.kr. bistel.co.kr
    . . .<snip>. . .
    ;; ANSWER SECTION:
    bistel.co.kr.           600     IN      A       1.227.57.69
    bistel.co.kr.           600     IN      A       1.227.57.68
    bistel.co.kr.           600     IN      A       1.227.57.74
    . . .<snip>. . .

If I search for some other domain, as I mentioned in the introduction, there is success - for example :

    > dig @127.0.0.1 athleta.com
    . . .<snip>. . .
    ;; ANSWER SECTION:
    athleta.com.            1690    IN      A       198.153.202.150
    . . .<snip>. . .

But for the domain bistel.co.kr, I'm out of luck:

    > dig @127.0.0.1 bistel.co.kr

    ; <<>> DiG 9.3.6-P1-RedHat-9.3.6-20.P1.el5 <<>> @127.0.0.1 bistel.co.kr
    ; (1 server found)
    ;; global options:  printcmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 19191
    ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

    ;; QUESTION SECTION:
    ;bistel.co.kr.                  IN      A

    ;; Query time: 2 msec
    ;; SERVER: 127.0.0.1#53(127.0.0.1)
    ;; WHEN: Wed Sep 17 20:21:52 2014
    ;; MSG SIZE  rcvd: 30

I tried enabling logging in the following manner :

    logging {
            channel default_file {
                    file "/var/log/named.log" size 10m;
                    severity info;
                    print-time yes;
                    print-severity yes;
                    print-category yes;
            };
            category default{ default_file; };
    };

Then I issued "dig @127.0.0.1 athleta.com" (SUCCESS) and "dig @127.0.0.1 bistel.co.kr" (SERVFAIL). The only relevant entries in /var/log/named.log were as follows.

    > grep athleta /var/log/named.log
    17-Sep-2014 20:26:34.812 lame-servers: info: network unreachable resolving 'athleta.com/A/IN': 2610:a1:1015::1#53
    17-Sep-2014 20:26:34.826 lame-servers: info: network unreachable resolving 'athleta.com/A/IN': 2001:502:f3ff::1#53

    > grep bistel /var/log/named.log
    17-Sep-2014 20:26:38.693 lame-servers: info: network unreachable resolving 'bistel.co.kr/A/IN': 2001:503:ba3e::2:30#53
    17-Sep-2014 20:26:38.693 lame-servers: info: network unreachable resolving 'bistel.co.kr/A/IN': 2001:500:84::b#53
    17-Sep-2014 20:26:38.693 lame-servers: info: network unreachable resolving 'bistel.co.kr/A/IN': 2001:500:2::c#53
    17-Sep-2014 20:26:40.769 lame-servers: info: network unreachable resolving 'bistel.co.kr/A/IN': 2001:dc5:a::1#53

I thank you sincerely for reading my inquiry and hope you can guide me to a clue!

BR, Janet

1

It looks like you may be having IPv6 connectivity problems. The other domains perhaps don't have IPv6 nameservers.

You also start talking about bistel.co.uk and then in your example you use bistel.co.kr.

BTW: try dig +trace -t soa bistel.co.kr

  • Thanks for your interest, wurtel. I don't understand what leads you to focus on ipv6. I tried dig +trace as you recommended; the result is:> dig +trace -t soa bistel.co.kr ; <<>> DiG 9.3.6-P1-RedHat-9.3.6-20.P1.el5 <<>> +trace -t soa bistel.co.kr ;; global options: printcmd ;; Received 17 bytes from 199.171.180.130#53(199.171.180.130) in 1 ms – Janet Sep 18 '14 at 11:59
  • Thanks for your interest, @wurtel. "bistel.co.uk" was a mis-type. The issue pertains to "bistel.co.kr". I don't understand what leads you to focus on ipv6. I tried dig +trace as you recommended; the result is: > dig +trace -t soa bistel.co.kr ; <<>> DiG 9.3.6-P1-RedHat-9.3.6-20.P1.el5 <<>> +trace -t soa bistel.co.kr ;; global options: printcmd ;; Received 17 bytes from 199.171.180.130#53(199.171.180.130) in 1 ms – Janet Sep 18 '14 at 12:05
  • > dig @127.0.0.1 +trace -t soa bistel.co.kr ; <<>> DiG 9.3.6-P1-RedHat-9.3.6-20.P1.el5 <<>> @127.0.0.1 +trace -t soa bistel.co.kr ; (1 server found) ;; global options: printcmd . 476269 IN NS m.root-servers.net. . . . <snip> . . . kr. 172800 IN NS c.dns.kr. . . . <snip> . . . bistel.co.kr. 86400 IN NS ns.bistel.co.kr. bistel.co.kr. 86400 IN NS ns2.bistel.co.kr. . . . <snip> . . . bistel.co.kr. 3600 IN SOA bis-ad2.bistel.co.kr. hostmaster.bistel.co.kr. 50998 900 600 86400 3600 . . <snip> . . – Janet Sep 18 '14 at 12:14
  • I focused on IPv6 because all the errors you showed from named.log were connection errors to IPv6 addresses. – wurtel Sep 18 '14 at 13:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.