0

We run bind9 on RHEL/CentOS and one of our international offices that has their own auth and caching servers cannot resolve lenovo.com for some reason. If that office uses google DNS it works but using their own DNS caching servers, it cant resolve. Commands dig and nslookup give a timeout. Although dig with trace is able to get to the final answer. Nothing in the logs indicate an issue. Also, this is the only address that we cant resolve, everything else works fine.

Can anyone advise/suggest any ideas? Thanks

3 Answers 3

0

You should post your DNS config details so that we can see if anything is wrong there. recursion should be enabled for caching only DNS server (It should be allowed for trusted users else, you might end up having DNS amplification attack). The second thing you need to check is, UDP port 53. Your ISP could be blocking this port due to the excessive DNS queries.

2
  • Thanks Mukesh. I checked with our Network folks and the ISP, no such block or filter in place. They said if that was the case, it would affect all DNS traffic not just for one domain. For the configuration, what would be relevant? named.conf from our authoritative and caching servers both?
    – jackie1100
    Aug 11, 2017 at 20:21
  • Not true "it would affect all DNS not just one domain", as some firewall do deep packet inspection and can act differently based on the content, not just the protocol. Aug 11, 2017 at 23:34
0

Make sure to use dig while specifying the nameserver you query (dig with trace starts again at root so this bypass your local caching resolver). And if you really have a timeout, do a network trace to verify that the DNS packet get emitted from the machine where the dig command runs, and that you do not get back any DNS packet.

That would mean that probably something on the network is filtering those packets. And/Or if you have access to the local resolver, in the same way do a network trace to see if it gets the DNS packet of the query. See if it generates locally a DNS reply. If yes, the network is filtering the reply. If no, but the DNS query packet comes to the resolver then the DNS resolver does something weird, if there is no DNS query packet reaching the resolver, it means again the network ate the packet during its route.

2
  • I'm trying to provide a tcpdump output but it wont let me add it? I guess theres a char limit on the comment. How can I add a comment which has some output then?
    – jackie1100
    Aug 12, 2017 at 23:35
  • At this time the raw full tcpdump output may not be needed. Have you seen packets going out of your computer? Coming to the resolver? Sent by the resolver? Aug 14, 2017 at 9:17
0

Make sure that your cacheing resolver has recursion enabled (and is only reachable by internal users) and has a root hints zone file. Without root hints nothing can be resolved that the DNS server doesn't already know about.

https://www.cyberciti.biz/faq/unix-linux-update-root-hints-data-file/

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .