DNS lookups getting blocked , cant trace where is the block

[Stephane Bortzmeyer]

On Fri, Jan 16, 2009 at 11:44:06AM +0530,
 ram <ram at netcore.co.in> wrote 
 a message of 44 lines which said:

> [root at smtpout1 ~]# dig @localhost bsnl.in
> ; <<>> DiG 9.3.3rc2 <<>> @localhost bsnl.in
> ; (1 server found)
> ;; global options:  printcmd
> ;; connection timed out; no servers could be reached

Since you are root, you can examine BIND's journal on smtpout1, you
will probably find a lot of things.

After that, you can fire tcpdump:

tcpdump -vvv -n udp and port 53 and host 218.248.240.178

And you'll get a lot of information, too.

> Ofcourse I checked that my local bind is working fine, since it can
> resolve almost all other domains 

Yes, but it may do bad things (such as sending requests from port 53)
that are accepted *almost* everywhere but not at bsnl.in. Also, it can
do correct things (such as using extensions like EDNS0) that are
accepted *almost* everywhere but not at bsnl.in (bad example since
218.248.240.178 seems happy with EDNS0).

> So where is the DNS request getting blocked.

Use BIND log and tcpdump