Intermittent Issues Resolving Microsoft Hostnames

[Sam Wilson]

In article <mailman.710.1462385639.73610.bind-users at lists.isc.org>,
 Stephane Bortzmeyer <bortzmeyer at nic.fr> wrote:

> On Wed, May 04, 2016 at 02:02:24PM -0400,
>  Rob Heilman <rheilman at echolabs.net> wrote 
>  a message of 305 lines which said:
> 
> > We run BIND 9.9.5-9 on Debian x86_64 to support a moderately sized
> > email hosting system.  System info listed at the end of this
> > message.  We are seeing intermittent but frequent issues resolving
> > Microsoft records.  The hostnames are usually in the form of
> > *.mail.protection.outlook.com
> 
> protection.outlook.com has a legal but unusual setup. It has only two
> name servers (not enough for an important domain) but each has several
> IP addresses. It should work because the RFC says that the resolver
> has to try every _address_ not just every name. And I'm confident BIND
> does the right thing.
> 
> However, one can note that both name servers have _exactly_ the same
> set of IP addresses. Again, it should work, but this setup is strange.

<http://dnscheck.iis.se/> (and its duplicate at 
<http://dnscheck.ripe.net/>) both report a) that neither/none of the 
servers supports queries over TCP and b) that there is no SOA for the 
zone mail.protection.outlook.com.  Using dig from my desktop confirms 
the TCP analysis and that when queried for the SOA they return 
NOERROR/NODATA, but with an authority section containing the SOA that's 
been queried for.

Sam

-- 
The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.