VERY strange problem with DNS

[Alessandro de Manzano]

Hello!

Sorry if my msg could be a very little offtopic, but I honestly don't
know where to ask for help :(

I'm using a couple of FreeBSD 4.6p1 boxes with BIND 8.3.3.

These are the authoritative DNS servers of a bunch of our domains. We
have also other three DNS servers listed as auth. for a total of five,
including our ISP's one and ns(1,2).secondary.com.

All was working fine till about one week ago, when many our customers
and partners phone us they could'n reach our servers (mail, web, etc.).

A quick investigation reveals that a lot of DNS servers in the world
(non auth. for our domains, of course) were suddenly giving the wrong
IPs for our domains!

i.e. www.playstos.com is alias of masamune.playstos.com and its IP is
195.250.253.136.

But these DNS servers reported 194.79.208.11 !

The same for other records, like our MX mail servers, etc.

Note that:

1) that IP is part of our old class C addresses which we abandoned
(returned to ISP - RIPE) about FOUR MONTHS ago !

2) in our DNS servers there is no istance of the string "194.x.x.x"
etc., our zone files are right! checked and double checked !

3) Till now all worked fine and we changed nothing, besides upgrading
BIND from 8.2.3-T1B to 8.3.3 

4) the SOA record reported from the "wrong DNS servers" is _right_ ! it
reports the current Serial number !

5) all our auth. servers if asked directly with "host" or "nslookup"
reports the correct IPs


I *really* don't know what happens and have no idea of how to stop it!

Please, if you have any idea, hint, suggestion, etc. please tell me! By
private mail if you prefer!


Hoping in your help!


Many many thanks in advance!




Alessandro de Manzano

Senior System & Network Administrator
Playstos - TIMA S.p.A.
Corso Sempione 63
20149 Milano, Italy

tel.: +39-023314153
fax: +39-02315678
email: demanzano at playstos.com

http://www.playstos.com