<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Hi Tony,<div><br></div><div>So from what I understand, your issue is with resolving domains that are not yours through the PowerDNS Recursor?</div><div><div apple-content-edited="true"><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div><br></div><div>And that your authoritative servers are not involved in this issue?</div><div><br></div><div>Which version of the PowerDNS Recursor do you run? Please note that version 3.3 is rather more strict in its interpretation of DNS rules than 3.5.1, and that this might be the issue.</div><div><br></div><div>Does the log file have anything relevant to say? Are the domains you mention the specific ones with issues, or is it generic .au, .uk?</div><div><br></div><div> Bert</div></span><br class="Apple-interchange-newline">
</div>
<br><div><div>On May 24, 2013, at 7:53 PM, Tony DeMatteis wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div>Hello,<br><br>We have PDNS running for several years w/o any issues. Our setup is two Authoritative, two resolvers, and a mySQL backend. Problem that has been brought to my attention by customers is that certain domains are unreachable. I can reach those sites reported via the IP Address. Google resolves the site(s) fine. We've verified reachability from other ISP's, i.e. they resolve the domains. I don't have any firewall rules that would prohibit reaching an key IP. Here's what I see.<br><br>Thank you for your input!!<br><br>tonyd<br><br><br># dig my primary resolver (same for secondary)<br>root@tonyd# dig @216.19.2.83 <a href="http://unitedserviceclub.com.au">unitedserviceclub.com.au</a><br><br>; <<>> DiG 9.7.3 <<>> @216.19.2.83 <a href="http://unitedserviceclub.com.au">unitedserviceclub.com.au</a><br>; (1 server found)<br>;; global options: +cmd<br>;; connection timed out; no servers could be reached<br><br><br><br># dig my primary resolver a second time<br>root@tonyd# dig @216.19.2.83 <a href="http://unitedserviceclub.com.au">unitedserviceclub.com.au</a><br><br>; <<>> DiG 9.7.3 <<>> @216.19.2.83 <a href="http://unitedserviceclub.com.au">unitedserviceclub.com.au</a><br>; (1 server found)<br>;; global options: +cmd<br>;; Got answer:<br>;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 6159<br>;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0<br><br>;; QUESTION SECTION:<br>;unitedserviceclub.com.au. IN A<br><br>;; Query time: 2459 msec<br>;; SERVER: 216.19.2.83#53(216.19.2.83)<br>;; WHEN: Fri May 24 10:39:51 2013<br>;; MSG SIZE rcvd: 42<br><br><br><br># dig my primary authoritative<br>root@tonyd# dig @216.19.2.80 <a href="http://unitedserviceclub.com.au">unitedserviceclub.com.au</a><br><br>; <<>> DiG 9.7.3 <<>> @216.19.2.80 <a href="http://unitedserviceclub.com.au">unitedserviceclub.com.au</a><br>; (1 server found)<br>;; global options: +cmd<br>;; connection timed out; no servers could be reached<br><br><br><br># dig primary resolver with +norec<br>root@tonyd# dig @216.19.2.83 <a href="http://unitedserviceclub.com.au">unitedserviceclub.com.au</a> +norec<br><br>; <<>> DiG 9.7.3 <<>> @216.19.2.83 <a href="http://unitedserviceclub.com.au">unitedserviceclub.com.au</a> +norec<br>; (1 server found)<br>;; global options: +cmd<br>;; Got answer:<br>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12017<br>;; flags: qr ra; QUERY: 1, ANSWER: 0, AUTHORITY: 4, ADDITIONAL: 4<br><br>;; QUESTION SECTION:<br>;unitedserviceclub.com.au. IN A<br><br>;; AUTHORITY SECTION:<br><a href="http://com.au">com.au</a>. 101509 IN NS <a href="http://w.au">w.au</a>.<br><a href="http://com.au">com.au</a>. 101509 IN NS <a href="http://x.au">x.au</a>.<br><a href="http://com.au">com.au</a>. 101509 IN NS <a href="http://y.au">y.au</a>.<br><a href="http://com.au">com.au</a>. 101509 IN NS <a href="http://z.au">z.au</a>.<br><br>;; ADDITIONAL SECTION:<br><a href="http://z.au">z.au</a>. 101469 IN A 37.209.198.2<br><a href="http://y.au">y.au</a>. 101469 IN A 37.209.196.2<br><a href="http://w.au">w.au</a>. 101469 IN A 37.209.192.2<br><a href="http://x.au">x.au</a>. 101469 IN A 37.209.194.2<br><br>;; Query time: 1 msec<br>;; SERVER: 216.19.2.83#53(216.19.2.83)<br>;; WHEN: Fri May 24 10:40:01 2013<br>;; MSG SIZE rcvd: 170<br><br><br># dig 8.8.8.8 BINGO!<br>root@tonyd# dig @8.8.8.8 <a href="http://unitedserviceclub.com.au">unitedserviceclub.com.au</a><br><br>; <<>> DiG 9.7.3 <<>> @8.8.8.8 <a href="http://unitedserviceclub.com.au">unitedserviceclub.com.au</a><br>; (1 server found)<br>;; global options: +cmd<br>;; Got answer:<br>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39625<br>;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0<br><br>;; QUESTION SECTION:<br>;unitedserviceclub.com.au. IN A<br><br>;; ANSWER SECTION:<br><a href="http://unitedserviceclub.com.au">unitedserviceclub.com.au</a>. 1800 IN A 68.171.219.193<br><br>;; Query time: 188 msec<br>;; SERVER: 8.8.8.8#53(8.8.8.8)<br>;; WHEN: Fri May 24 10:41:01 2013<br>;; MSG SIZE rcvd: 58<br><br><br><br># dig Random site from our resolvers<br>root@tonyd# dig @216.19.2.83 <a href="http://devry.edu">devry.edu</a><br><br>; <<>> DiG 9.7.3 <<>> @216.19.2.83 <a href="http://devry.edu">devry.edu</a><br>; (1 server found)<br>;; global options: +cmd<br>;; Got answer:<br>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36779<br>;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 4<br><br>;; QUESTION SECTION:<br>;devry.edu. IN A<br><br>;; ANSWER SECTION:<br><a href="http://devry.edu">devry.edu</a>. 600 IN A 166.78.67.22<br><br>;; AUTHORITY SECTION:<br><a href="http://devry.edu">devry.edu</a>. 600 IN NS <a href="http://adns1.devry.net">adns1.devry.net</a>.<br><a href="http://devry.edu">devry.edu</a>. 600 IN NS <a href="http://adns3.devry.net">adns3.devry.net</a>.<br><a href="http://devry.edu">devry.edu</a>. 600 IN NS <a href="http://adns4.devry.net">adns4.devry.net</a>.<br><a href="http://devry.edu">devry.edu</a>. 600 IN NS <a href="http://adns2.devry.net">adns2.devry.net</a>.<br><br>;; ADDITIONAL SECTION:<br><a href="http://adns2.devry.net">adns2.devry.net</a>. 3599 IN A 206.209.110.52<br><a href="http://adns1.devry.net">adns1.devry.net</a>. 3599 IN A 206.209.110.51<br><a href="http://adns3.devry.net">adns3.devry.net</a>. 3599 IN A 206.209.104.51<br><a href="http://adns4.devry.net">adns4.devry.net</a>. 3599 IN A 206.209.104.52<br><br>;; Query time: 200 msec<br>;; SERVER: 216.19.2.83#53(216.19.2.83)<br>;; WHEN: Fri May 24 10:45:53 2013<br>;; MSG SIZE rcvd: 196<br><br><br><br>root@tonyd# dig @216.19.2.83 <a href="http://earthlink.net">earthlink.net</a><br><br>; <<>> DiG 9.7.3 <<>> @216.19.2.83 <a href="http://earthlink.net">earthlink.net</a><br>; (1 server found)<br>;; global options: +cmd<br>;; Got answer:<br>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62913<br>;; flags: qr rd ra; QUERY: 1, ANSWER: 11, AUTHORITY: 2, ADDITIONAL: 0<br><br>;; QUESTION SECTION:<br>;earthlink.net. IN A<br><br>;; ANSWER SECTION:<br><a href="http://earthlink.net">earthlink.net</a>. 1794 IN A 209.86.93.205<br><a href="http://earthlink.net">earthlink.net</a>. 1794 IN A 209.86.93.206<br><a href="http://earthlink.net">earthlink.net</a>. 1794 IN A 209.86.93.207<br><a href="http://earthlink.net">earthlink.net</a>. 1794 IN A 209.86.93.208<br><a href="http://earthlink.net">earthlink.net</a>. 1794 IN A 209.86.93.209<br><a href="http://earthlink.net">earthlink.net</a>. 1794 IN A 209.86.93.210<br><a href="http://earthlink.net">earthlink.net</a>. 1794 IN A 209.86.93.211<br><a href="http://earthlink.net">earthlink.net</a>. 1794 IN A 209.86.93.201<br><a href="http://earthlink.net">earthlink.net</a>. 1794 IN A 209.86.93.202<br><a href="http://earthlink.net">earthlink.net</a>. 1794 IN A 209.86.93.203<br><a href="http://earthlink.net">earthlink.net</a>. 1794 IN A 209.86.93.204<br><br>;; AUTHORITY SECTION:<br><a href="http://earthlink.net">earthlink.net</a>. 839 IN NS <a href="http://scratchy.earthlink.net">scratchy.earthlink.net</a>.<br><a href="http://earthlink.net">earthlink.net</a>. 839 IN NS <a href="http://itchy.earthlink.net">itchy.earthlink.net</a>.<br><br>;; Query time: 0 msec<br>;; SERVER: 216.19.2.83#53(216.19.2.83)<br>;; WHEN: Fri May 24 10:46:24 2013<br>;; MSG SIZE rcvd: 250<br><br><br><br>_______________________________________________<br>Pdns-users mailing list<br><a href="mailto:Pdns-users@mailman.powerdns.com">Pdns-users@mailman.powerdns.com</a><br>http://mailman.powerdns.com/mailman/listinfo/pdns-users<br><br></div></blockquote></div><br></div></body></html>