got a strange selection of errors in my logwatch that lists a 'network unreachable resolving nsX.somedomain.com' error repeatedly. This is on an Ubuntu 9.04 Server install with latest updates using bind for dns.

I've seen various blog posts blaming the repeated entries on spamassasin, but I don't have that installed. The domains listed seem to be ones that are accessed within my network - but there's no reason my server should be attempting to resolve these - I have my ISP's name servers for that, and all my computers are configured to get DNS from the correct location.

Any ideas for a solution would be incredibly helpful - my logwatch results are getting longer and longer! I've given an example of these logs below.

    network unreachable resolving 'e.ns.lanechange.info/A/IN': 2001:500:49::1#53: 1 Time(s)
    network unreachable resolving 'e.ns.lanechange.info/AAAA/IN': 2001:500:49::1#53: 1 Time(s)
    network unreachable resolving 'echochamber.me/A/IN': 2001:4830:120:1::1#53: 1 Time(s)

I also have similar results for ROOT-SERVERS.NET

  • Your post is quite contradictory: you say you use BIND on your Ubuntu machine and later you say you use the ISP's name servers for name resolution. Which sentence is correct? – bortzmeyer Oct 23 '09 at 10:22
  • I use BIND to serve my own DNS records ie the results for resborand.co.uk and its subdomains. I use my ISPs nameservers to resolve requests for everything else e.g google.com yahoo.com – Elliot Hughes Oct 24 '09 at 12:05

It seems bind by default now tries to resolve queries recursively using ipv6. The log clearly states that bind tries to resolve recursively using ipv6, so I doubt that it isn't used for that. 2001:4830:120:1 is not reachable at least.

Add -4 to the bind command line to disable this. For debian, this means to put

OPTIONS="-u bind -4"

into /etc/default/bind9, don't know if it's the same in ubuntu.


OK, with the comment you added (that the BIND on your machine is just here for serving data authoritatively), you should not see these warnings because BIND should not attempt to contact other name servers (except secondaries, to notify them of updates). Hence my question: are you sure your BIND is purely authoritative? Do you have "recursion no;" in its configuration? Does it reply to recursive queries?

Otherwise, remember that the IPv6 Internet is currently split in two, due to Cogent's refusal to peer with other operators. So, at this time, IPv6 connectivity errors, like the ones you see, are to be expected.

Not the answer you're looking for? Browse other questions tagged or ask your own question.