Problem with Brazilian DNS servers

[Jon Leeman]

Mike Mitchell wrote:
> Has anyone noticed a problem with DNS servers in Brazil?
> I have problems looking up hosts in the following domains:
> 
> 	bb.com.br	predileto.ind.br	ibi.com.br
> 	ig.com.br	telemar.com.br
> 
> I get spotty results when querying those domains.  For example,
> clients with a 149.173.5.XX IP address can query the Brazilian
> nameservers with either UDP or TCP, but clients with 149.173.6.XX
> addresses can only use TCP.  Packet captures at the Internet router
> shows queries going out but never see a UDP answer back.  Since the
> TCP queries function properly I know it isn't a routing issue.  I've
> tried 'dig' with a one-second timeout and a repeat count of 50, and
> the UDP query never succeeds.  When I immediately try it again using
> TCP the answer comes back in 130ms.  I am querying the Brazilian
> nameservers directly, i.e. 'dig @200.225.157.104 A www.ig.com.br.'
> 
> I've tried the same queries at different points on the Internet and
> at some places it works, but others it doesn't.  I've even seen a case
> where UDP worked but TCP didn't work.

For What It's Worth the first dig is from within 203.98.224.0/23 via
IntelSat / Telstra and the second is from within 203.98.227.0/24 via
NSS5 / Optus.

Rgds.,

Jon

; <<>> DiG 9.2.1 <<>> @200.225.157.104 A www.ig.com.br
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12822
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;www.ig.com.br.                 IN      A

;; ANSWER SECTION:
www.ig.com.br.          3600    IN      A       200.226.133.74

;; AUTHORITY SECTION:
ig.com.br.              3600    IN      NS      ns1.ig.com.br.
ig.com.br.              3600    IN      NS      ns2.ig.com.br.

;; ADDITIONAL SECTION:
ns1.ig.com.br.          3600    IN      A       200.225.157.104
ns2.ig.com.br.          3600    IN      A       200.225.157.105

;; Query time: 3377 msec
;; SERVER: 200.225.157.104#53(200.225.157.104)
;; WHEN: Thu Nov 10 10:02:04 2005
;; MSG SIZE  rcvd: 115

; <<>> DiG 9.2.3 <<>> @200.225.157.104 A www.ig.com.br
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;www.ig.com.br.                 IN      A

;; ANSWER SECTION:
www.ig.com.br.          3600    IN      A       200.226.133.74

;; AUTHORITY SECTION:
ig.com.br.              3600    IN      NS      ns2.ig.com.br.
ig.com.br.              3600    IN      NS      ns1.ig.com.br.

;; ADDITIONAL SECTION:
ns1.ig.com.br.          3600    IN      A       200.225.157.104
ns2.ig.com.br.          3600    IN      A       200.225.157.105

;; Query time: 931 msec
;; SERVER: 200.225.157.104#53(200.225.157.104)
;; WHEN: Thu Nov 10 10:08:06 2005
;; MSG SIZE  rcvd: 115