formerr for some queries until named restarted

[Barry Finkel]

Kal Feher <kal.feher at melbourneit.com.au> wrote:

>Ok, now I'm confused.
>I said " FORMERR means the remote server server replied that the query had a
>format error"
>
>Rfc 2136 says " The name server was unable to interpret the request due
> to a format error"
>
>The query response was from the modem (remote server). So what is wrong with
>this interpretation? No where in the rfc does formerr ever refer to the
>format of a response.
>
>Does formerr also apply if the caching name server receives bad data?
>Because that is not covered under any of the scenarios within the RFC for
>the use of the formerr rcode.

Here is a recent FORMERR detected on one of my BIND 9.4.1-P1 servers:

     08-Aug-2007 08:33:43.597 lame-servers: info:
           FORMERR resolving 'fiyh.com/MX/IN': 64.20.39.26#53

classroom% dig fiyh.com @64.20.39.26

; <<>> DiG 8.3 <<>> fiyh.com @64.20.39.26 
; (1 server found)
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4
;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 0
;; QUERY SECTION:
;;      fiyh.com, type = A, class = IN

;; ANSWER SECTION:
fiyh.com.               1H IN A         66.45.252.236
fiyh.com.               1H IN A         66.45.252.237

;; AUTHORITY SECTION:
.                       3D IN NS        ns.

;; Total query time: 5034 msec
;; FROM: classroom.ctd.anl.gov to SERVER: 64.20.39.26  64.20.39.26
;; WHEN: Wed Aug  8 08:36:07 2007
;; MSG SIZE  sent: 26  rcvd: 73

classroom% dig fiyh.com @64.20.39.26 mx

; <<>> DiG 8.3 <<>> fiyh.com @64.20.39.26 mx 
; (1 server found)
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUERY SECTION:
;;      fiyh.com, type = MX, class = IN

;; AUTHORITY SECTION:
.                       42m40s IN SOA   ns. hostmaster. (
                                        1186550753      ; serial
                                        4h33m4s         ; refresh
                                        34m8s           ; retry
                                        1w5d3h16m16s    ; expiry
                                        42m40s )                ; minimum


;; Total query time: 35 msec
;; FROM: classroom.ctd.anl.gov to SERVER: 64.20.39.26  64.20.39.26
;; WHEN: Wed Aug  8 08:36:24 2007
;; MSG SIZE  sent: 26  rcvd: 73

classroom%

Note that in both cases the Authority section in the response packet
claims to be root.  For this reason, BIND does not accept the response
and returns FORMERR.
----------------------------------------------------------------------
Barry S. Finkel
Computing and Information Systems Division
Argonne National Laboratory          Phone:    +1 (630) 252-7277
9700 South Cass Avenue               Facsimile:+1 (630) 252-4601
Building 222, Room D209              Internet: BSFinkel at anl.gov
Argonne, IL   60439-4828             IBMMAIL:  I1004994