Akadns and Bind

[Chris Buxton]

+trace does not do what you think it does. It does not query the target name server for each successive query. Rather, it causes the 'dig' command to perform recursion on its own, only using the indicated server (@server) to seed its root server list. +trace also stops at the CNAME, and does not restart the recursion process as needed to track down the final A record(s).

Perform the trace manually, using either +dnssec or at least +bufsize=4096. For example, one step in the process will look like this:

dig +bufsize=4096 +norec www.yahoo.com @ns1.yahoo.com

You will find that the Yahoo load balancers do not understand EDNS0. This might be part of the problem, although named should be able to work around this automatically. Check the log file (or configure logging as needed and re-run the query against your problem server) to see if it will tell you exactly what the problem is.

Chris Buxton
BlueCat Networks

On Feb 3, 2011, at 6:07 PM, Tory M Blue wrote:

> On Thu, Feb 3, 2011 at 5:23 PM, Barry Margolin <barmar at alum.mit.edu> wrote:
>> In article <mailman.1636.1296781581.555.bind-
>> SNIPPED<
>> www.yahoo.com.    300   IN CNAME fp.wg1.b.yahoo.com.
>> 
>> And even when they did, it didn't get involved until you followed the
>> CNAME returned for www.yahoo.com.  Your log message above indicates an
>> issue just with the yahoo.com domain, not resolution of the CNAME target.
>> 
>> --
> Thanks Barry so maybe I need some further education
> 
> 
> [tblue at mx3 ~]$ dig @problemserver.net  www.yahoo.com
> 
> ; <<>> DiG 9.6.2-P2-RedHat-9.6.2-5.P2.fc12 <<>> @problemserver.net www.yahoo.com
> ; (1 server found)
> ;; global options: +cmd
> ;; connection timed out; no servers could be reached
> 
> So let's add the trace option (Same servers)
> 
> [tblue at mx3 ~]$ dig @problemserver.net  www.yahoo.com  +trace
> 
> ; <<>> DiG 9.6.2-P2-RedHat-9.6.2-5.P2.fc12 <<>> @problemserver.net
> www.yahoo.com +trace
> ; (1 server found)
> ;; global options: +cmd
> .			514246	IN	NS	f.root-servers.net.
> .			514246	IN	NS	b.root-servers.net.
> .			514246	IN	NS	e.root-servers.net.
> .			514246	IN	NS	a.root-servers.net.
> .			514246	IN	NS	l.root-servers.net.
> .			514246	IN	NS	k.root-servers.net.
> .			514246	IN	NS	i.root-servers.net.
> .			514246	IN	NS	d.root-servers.net.
> .			514246	IN	NS	c.root-servers.net.
> .			514246	IN	NS	m.root-servers.net.
> .			514246	IN	NS	j.root-servers.net.
> .			514246	IN	NS	h.root-servers.net.
> .			514246	IN	NS	g.root-servers.net.
> ;; Received 336 bytes from 10.13.255.101#53(10.13.255.101) in 1 ms
> 
> com.			172800	IN	NS	a.gtld-servers.net.
> com.			172800	IN	NS	b.gtld-servers.net.
> com.			172800	IN	NS	c.gtld-servers.net.
> com.			172800	IN	NS	d.gtld-servers.net.
> com.			172800	IN	NS	e.gtld-servers.net.
> com.			172800	IN	NS	f.gtld-servers.net.
> com.			172800	IN	NS	g.gtld-servers.net.
> com.			172800	IN	NS	h.gtld-servers.net.
> com.			172800	IN	NS	i.gtld-servers.net.
> com.			172800	IN	NS	j.gtld-servers.net.
> com.			172800	IN	NS	k.gtld-servers.net.
> com.			172800	IN	NS	l.gtld-servers.net.
> com.			172800	IN	NS	m.gtld-servers.net.
> ;; Received 494 bytes from 199.7.83.42#53(l.root-servers.net) in 11 ms
> 
> yahoo.com.		172800	IN	NS	ns1.yahoo.com.
> yahoo.com.		172800	IN	NS	ns5.yahoo.com.
> yahoo.com.		172800	IN	NS	ns2.yahoo.com.
> yahoo.com.		172800	IN	NS	ns3.yahoo.com.
> yahoo.com.		172800	IN	NS	ns4.yahoo.com.
> ;; Received 201 bytes from 192.31.80.30#53(d.gtld-servers.net) in 55 ms
> 
> www.yahoo.com.		300	IN	CNAME	fp.wg1.b.yahoo.com.
> wg1.b.yahoo.com.	300	IN	NS	yf2.yahoo.com.
> wg1.b.yahoo.com.	300	IN	NS	yf4.yahoo.com.
> wg1.b.yahoo.com.	300	IN	NS	yf8.yahoo.com.
> wg1.b.yahoo.com.	300	IN	NS	yf3.yahoo.com.
> wg1.b.yahoo.com.	300	IN	NS	yf6.yahoo.com.
> wg1.b.yahoo.com.	300	IN	NS	yf5.yahoo.com.
> wg1.b.yahoo.com.	300	IN	NS	yf1.yahoo.com.
> wg1.b.yahoo.com.	300	IN	NS	yf7.yahoo.com.
> ;; Received 326 bytes from 68.180.131.16#53(ns1.yahoo.com) in 2 ms
> 
> 
> So what am I missing? No servers available and the trace shows that
> it's finding the CNAME record, but doesn't appear to be going far
> enough,
> 
> 
> Here is the second server who can resolve this. Identical
> configuration as the problem server, same network segment, behind same
> SNAT, the same..
> 
> [tblue at mx3 ~]$ dig @functioningserver.net  www.yahoo.com
> 
> ; <<>> DiG 9.6.2-P2-RedHat-9.6.2-5.P2.fc12 <<>> @functioningserver.net
> www.yahoo.com
> ; (1 server found)
> ;; global options: +cmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 30158
> ;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 2, ADDITIONAL: 0
> 
> ;; QUESTION SECTION:
> ;www.yahoo.com.			IN	A
> 
> ;; ANSWER SECTION:
> www.yahoo.com.		300	IN	CNAME	fp.wg1.b.yahoo.com.
> fp.wg1.b.yahoo.com.	3238	IN	CNAME	any-fp.wa1.b.yahoo.com.
> any-fp.wa1.b.yahoo.com.	60	IN	A	98.137.149.56
> any-fp.wa1.b.yahoo.com.	60	IN	A	72.30.2.43
> 
> ;; AUTHORITY SECTION:
> wa1.b.yahoo.com.	300	IN	NS	yf2.yahoo.com.
> wa1.b.yahoo.com.	300	IN	NS	yf1.yahoo.com.
> 
> ;; Query time: 1759 msec
> ;; SERVER: 10.13.255.102#53(10.13.255.102)
> ;; WHEN: Thu Feb  3 18:03:55 2011
> ;; MSG SIZE  rcvd: 147
> 
> I'm missing something I'm sure, but it's under my skin now!
> 
> Thanks again
> Tory
> _______________________________________________
> bind-users mailing list
> bind-users at lists.isc.org
> https://lists.isc.org/mailman/listinfo/bind-users