BIND and 127.0.0.1 clients

[Justin Pryzby]

On Mon, Sep 29, 2008 at 01:42:30AM -0400, Barry Margolin wrote:
> In article <gbpp23$1qo6$1 at sf1.isc.org>,
>  Klunk <givemespam at wibblywobblyteapot.co.uk> wrote:
> 
> > Can anyone shed some light on why I am seeing occasional lookups like 
> > these? (the key is the client is 127.0.0.1 - localhost)
> > 
> > 27-Sep-2008 5:56:55.851 client 127.0.0.1#3068: query: 1.0.0.127.in-
> > addr.arpa IN PTR +
> > 27-Sep-2008 5:56:55.851 client 127.0.0.1#3069: query: gmx.us IN A +
> > 27-Sep-2008 5:56:56.242 client 127.0.0.1#3070: query: 1.0.0.127.in-
> > addr.arpa IN PTR +
> > 27-Sep-2008 5:56:56.242 client 127.0.0.1#3071: query: gmx.us IN MX +
> > 
> > AFAIAA I don't have any clients running on the box that would address the 
> > DNS server at a local host level - they are all seen connecting by their 
> > respective IP addresses. My googles on this, as you can imagine, have not 
> > given much use with a search string like '127.0.0.1' :-)
> 
> I assume that you don't have 
> 
> nameserver 127.0.0.1
> 
> in the machine's /etc/resolv.conf.
> 
> > 
> > It's a few every day, always the same lookups, differing times.
> 
> Maybe there's a shell script that does these lookups and has the server 
> 127.0.0.1 hard-coded into it.
Or, you had 127.0.0.1 in resolv.conf at some point in the past (or
didn't have a resolv.conf, which is equivalent).  If there's an old
process from that time, it won't reread resolv.conf, you have
to restart it.  Last I knew, glibc reads that information the first
time it's needed, caches it, and never rereads the relevant files.

Justin