Lots of errors, having 'lame' day, suggestions?

[Chris Buxton]

No, the bad referral is coming from your own server.

The "query (cache) denied" message means that your server doesn't  
consider itself to be authoritative for the zone in question. Find out  
why.

Chris Buxton
Professional Services
Men & Mice

On Nov 17, 2008, at 6:51 AM, Scott Haneda wrote:

> Look at some web stats, I saw a traffic drop over the weekend on a  
> few sites.  Looking into it, I am stumped.
>
> Here are a few named log snips:
> 17-Nov-2008 05:47:26.582 security: info: client 203.162.4.198#40307:  
> query (cache) 'nuclearrabbit.com/MX/IN' denied
> 17-Nov-2008 05:47:27.375 security: info: client 200.0.194.46#3632:  
> query (cache) 'nuclearrabbit.com/MX/IN' denied
> 17-Nov-2008 05:47:28.170 security: info: client 200.0.194.78#38941:  
> query (cache) 'nuclearrabbit.com/MX/IN' denied
> 17-Nov-2008 05:47:28.495 security: info: client  
> 190.216.29.147#37276: query (cache) 'nuclearrabbit.com/MX/IN' denied
> 17-Nov-2008 05:47:28.659 security: info: client 200.0.194.46#31390:  
> query (cache) 'nuclearrabbit.com/A/IN' denied
> 17-Nov-2008 05:47:28.982 security: info: client 200.0.194.78#51537:  
> query (cache) 'nuclearrabbit.com/A/IN' denied
> 17-Nov-2008 05:47:29.465 security: info: client  
> 190.216.29.147#37276: query (cache) 'nuclearrabbit.com/A/IN' denied
> 17-Nov-2008 05:47:32.647 security: info: client 203.162.4.198#48412:  
> query (cache) 'nuclearrabbit.com/MX/IN' denied
> 17-Nov-2008 05:47:40.632 security: info: client 200.0.194.46#50599:  
> query (cache) 'nuclearrabbit.com/A/IN' denied
>
> What I have no idea, is why they are being denied?
>
> I do get nothing back:
> ; <<>> DiG 9.4.2-P2 <<>> nuclearrabbit.com MX @ns1.hostwizard.com
> ;; global options:  printcmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 59741
> ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
>
> ;; QUESTION SECTION:
> ;nuclearrabbit.com.		IN	MX
>
> ;; Query time: 1 msec
> ;; SERVER: 64.84.37.14#53(64.84.37.14)
> ;; WHEN: Mon Nov 17 05:49:06 2008
> ;; MSG SIZE  rcvd: 35
>
>
> The domain appears to still be registered as far as I can tell,  
> there is a secondary that should pick up this as well.
>
> I do not know much about trace, but I get a bad referral error, is  
> this at my seconary provider?  What do I tell them?
>
> ; <<>> DiG 9.4.2-P2 <<>> nuclearrabbit.com +trace
> ;; global options:  printcmd
> .			292882	IN	NS	H.ROOT-SERVERS.NET.
> .			292882	IN	NS	L.ROOT-SERVERS.NET.
> .			292882	IN	NS	J.ROOT-SERVERS.NET.
> .			292882	IN	NS	D.ROOT-SERVERS.NET.
> .			292882	IN	NS	C.ROOT-SERVERS.NET.
> .			292882	IN	NS	E.ROOT-SERVERS.NET.
> .			292882	IN	NS	F.ROOT-SERVERS.NET.
> .			292882	IN	NS	G.ROOT-SERVERS.NET.
> .			292882	IN	NS	I.ROOT-SERVERS.NET.
> .			292882	IN	NS	B.ROOT-SERVERS.NET.
> .			292882	IN	NS	K.ROOT-SERVERS.NET.
> .			292882	IN	NS	M.ROOT-SERVERS.NET.
> .			292882	IN	NS	A.ROOT-SERVERS.NET.
> ;; Received 336 bytes from 64.84.0.18#53(64.84.0.18) in 1 ms
>
> com.			172800	IN	NS	L.GTLD-SERVERS.NET.
> com.			172800	IN	NS	F.GTLD-SERVERS.NET.
> com.			172800	IN	NS	A.GTLD-SERVERS.NET.
> com.			172800	IN	NS	K.GTLD-SERVERS.NET.
> com.			172800	IN	NS	J.GTLD-SERVERS.NET.
> com.			172800	IN	NS	C.GTLD-SERVERS.NET.
> com.			172800	IN	NS	H.GTLD-SERVERS.NET.
> com.			172800	IN	NS	G.GTLD-SERVERS.NET.
> com.			172800	IN	NS	D.GTLD-SERVERS.NET.
> com.			172800	IN	NS	B.GTLD-SERVERS.NET.
> com.			172800	IN	NS	M.GTLD-SERVERS.NET.
> com.			172800	IN	NS	E.GTLD-SERVERS.NET.
> com.			172800	IN	NS	I.GTLD-SERVERS.NET.
> ;; Received 495 bytes from 202.12.27.33#53(M.ROOT-SERVERS.NET) in  
> 101 ms
>
> nuclearrabbit.com.	172800	IN	NS	ns1.hostwizard.com.
> nuclearrabbit.com.	172800	IN	NS	ns1.nacio.com.
> ;; Received 120 bytes from 192.41.162.30#53(L.GTLD-SERVERS.NET) in  
> 79 ms
>
> nuclearrabbit.com.	172299	IN	NS	ns1.nacio.com.
> nuclearrabbit.com.	172299	IN	NS	ns1.hostwizard.com.
> ;; BAD (HORIZONTAL) REFERRAL
> ;; Received 120 bytes from 64.84.37.14#53(ns1.hostwizard.com) in 1 ms
>
> nuclearrabbit.com.	172299	IN	NS	ns1.nacio.com.
> nuclearrabbit.com.	172299	IN	NS	ns1.hostwizard.com.
> ;; BAD (HORIZONTAL) REFERRAL
> ;; Received 120 bytes from 64.84.37.14#53(ns1.hostwizard.com) in 1 ms
>
> nuclearrabbit.com.	172299	IN	NS	ns1.nacio.com.
> nuclearrabbit.com.	172299	IN	NS	ns1.hostwizard.com.
> ;; BAD (HORIZONTAL) REFERRAL
> ;; Received 120 bytes from 64.84.37.14#53(ns1.hostwizard.com) in 1 ms
>
> nuclearrabbit.com.	172299	IN	NS	ns1.nacio.com.
> nuclearrabbit.com.	172299	IN	NS	ns1.hostwizard.com.
> ;; BAD (HORIZONTAL) REFERRAL
> ;; Received 120 bytes from 64.84.37.14#53(ns1.hostwizard.com) in 0 ms
>
> com.			123824	IN	NS	a.gtld-servers.net.
> com.			123824	IN	NS	d.gtld-servers.net.
> com.			123824	IN	NS	g.gtld-servers.net.
> com.			123824	IN	NS	e.gtld-servers.net.
> com.			123824	IN	NS	k.gtld-servers.net.
> com.			123824	IN	NS	j.gtld-servers.net.
> com.			123824	IN	NS	h.gtld-servers.net.
> com.			123824	IN	NS	b.gtld-servers.net.
> com.			123824	IN	NS	i.gtld-servers.net.
> com.			123824	IN	NS	f.gtld-servers.net.
> com.			123824	IN	NS	m.gtld-servers.net.
> com.			123824	IN	NS	l.gtld-servers.net.
> com.			123824	IN	NS	c.gtld-servers.net.
> ;; BAD REFERRAL
> ;; Received 507 bytes from 64.84.0.18#53(ns1.nacio.com) in 1 ms
>
> --
> Scott
>
> --
> Scott
>
> _______________________________________________
> bind-users mailing list
> bind-users at lists.isc.org
> https://lists.isc.org/mailman/listinfo/bind-users