tracing source of lame requests

[Mark.Andrews at nominum.com]

	Dump the cache to disk "ndc dumpdb" and search for the MX record.

	Mark

> Somebody seems to have an MX pointing to mail-relay.uni-c.dk,
> which was removed two years ago.
> 
> How do I trace where the requests come from (bind-8.8.2-P5)
> 
> Here is a cut from the log on the master server for uni-c.dk,
> ns-soa.darenet.dk, which is also a slave for .dk:
> 
> Mar  6 12:57:41 ns named[2120]: sysquery: findns error (NXDOMAIN) on mail-rel
> ay.uni-c.dk?
> Mar  6 12:57:43 ns named[2120]: sysquery: findns error (NXDOMAIN) on mail-rel
> ay.uni-c.dk?
> Mar  6 13:00:27 ns named[2120]: sysquery: findns error (NXDOMAIN) on mail-rel
> ay.uni-c.dk?
> Mar  6 13:00:27 ns named[2120]: sysquery: findns error (NXDOMAIN) on mail-rel
> ay.uni-c.dk?
> Mar  6 13:02:29 ns named[2120]: sysquery: findns error (NXDOMAIN) on mail-rel
> ay.uni-c.dk?
> 
> I have considered making a dummy entry for mail-relay.uni-c.dk to stop
> the noise. But I would rather find out who points at it.
> 
> It does not appear anywhere, neither in my master or slave zone
> files.
> 
> I tried tracelevel 4, but don't know how to parse named.run.
> 
> -- 
> Med venlig hilsen / Regards 
> Netdriftgruppen / Network Management Group
> UNI-C          
> 
> Tlf./Phone   +45 35 87 89 41        Mail:  UNI-C                             
>    
> Fax.         +45 35 87 89 90               Bygning 304
> E-mail: torben.fjerdingstad at uni-c.dk       DK-2800 Lyngby
> 
> 
> 
--
Mark Andrews, Nominum Inc. / Internet Software Consortium
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: Mark.Andrews at nominum.com