strange dig behavior

[Taylor, Gord]

Also need to ensure the allow-query-cache ACL on the recursive server allows the client. Otherwise, name resolution may work the first time (allow-recursion), but not the 2nd time (allow-query-cache) since the result is cached.


Sent from my BlackBerry

----- Original Message -----
From: bind-users-bounces+gord.taylor=rbc.com at lists.isc.org <bind-users-bounces+gord.taylor=rbc.com at lists.isc.org>
To: comp-protocols-dns-bind at isc.org <comp-protocols-dns-bind at isc.org>
Sent: Sun Dec 20 22:59:12 2009
Subject: Re: strange dig behavior

In article <mailman.18.1261358139.21153.bind-users at lists.isc.org>,
 Pamela Rock <prock111 at yahoo.com> wrote:

> I've got the following three scenarios
> 
> The client can query a domain A residing on a recursive name server.

What do you mean by a domain "residing" on a recursive nameserver?  If a 
domain resides on a server, the server should be authoritative for that 
domain.

> 
> The client can query a domain B on an authratative name server.
> 
> When client queries domain B through the RNS, a Status: refused results.
> 
> I don't know what is causing the refused.  IP tables is off everywhere, and 
> there are no ACL's on routers or firewalls.  
> 
> The only error I'm seeing is the following in the debug log
> 
> 20-Dec-2009 19:21:09.443 query-errors: debug 3: client 172.16.0.5#41484: 
> query failed (REFUSED) for test.com/IN/A at query.c:3882
> 
> I'm running bind 9.6.1 on RH ES 5 64 bit O/S.  Any ideas?  Thanks!!

Is that log on the recursive nameserver or the authoritative nameserver?

If it's on the recursive server, is the client in the allow-recursion 
ACL on the server?

If it's on the authoritative server, is the recursive server in the 
allow-query ACL?

-- 
Barry Margolin, barmar at alum.mit.edu
Arlington, MA
*** PLEASE don't copy me on replies, I'll read them in the group ***
_______________________________________________
bind-users mailing list
bind-users at lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
_______________________________________________________________________

This e-mail may be privileged and/or confidential, and the sender does not waive
any related rights and obligations. Any distribution, use or copying of this e-mail or the information
it contains by other than an intended recipient is unauthorized.
If you received this e-mail in error, please advise me (by return e-mail or otherwise) immediately.

Ce courriel peut contenir des renseignements protégés et confidentiels.
L’expéditeur ne renonce pas aux droits et obligations qui s’y rapportent.
Toute diffusion, utilisation ou copie de ce courriel ou des renseignements qu’il contient
par une personne autre que le destinataire désigné est interdite.
Si vous recevez ce courriel par erreur, veuillez m’en aviser immédiatement, 
par retour de courriel ou par un autre moyen.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20091221/ee85873c/attachment.html>