<html><head></head><body><div style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:medium;"><div><div>Hi Bert,</div></div><div><br></div><div>Thanks for your quick response. 4.1 didn't work and I already set use-incoming-edns-subnet but I was getting timeouts. From what I could see from my tcpdump, the authoritative server didn't return the correct answer </div><div><br></div><div>root@DFW01-CPS01:~# service pdns-recursor restart<br> * Restarting PowerDNS recursor pdns-recursor<br>Aug 02 06:33:34 PowerDNS Recursor 4.1.0-alpha1 (C) 2001-2017 PowerDNS.COM BV<br>Aug 02 06:33:34 Using 64-bits mode. Built using gcc 5.4.0 20160609 on Jul 18 2017 13:15:53 by root@24d7ea40a89f.<br>Aug 02 06:33:34 PowerDNS comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it according to the terms of the GPL version 2.<br>Aug 02 06:33:34 Reading random entropy from '/dev/urandom'<br>Aug 02 06:33:34 If using IPv6, please raise sysctl net.ipv6.route.max_size, currently set to 4096 which is < 16384<br>Aug 02 06:33:34 NOT using IPv6 for outgoing queries - set 'query-local-address6=::' to enable<br>Aug 02 06:33:34 Only allowing queries from: 127.0.0.0/8, 10.0.0.0/8, 100.64.0.0/10, 169.254.0.0/16, 192.168.0.0/16, 172.16.0.0/12, ::1/128, fc00::/7, fe80::/10<br>Aug 02 06:33:34 Will not send queries to: 127.0.0.0/8, 10.0.0.0/8, 100.64.0.0/10, 169.254.0.0/16, 192.168.0.0/16, 172.16.0.0/12, ::1/128, fc00::/7, fe80::/10, 0.0.0.0/8, 192.0.0.0/24, 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24, 240.0.0.0/4, ::/96, ::ffff:0:0/96, 100::/64, 2001:db8::/32, 0.0.0.0, ::<br>Aug 02 06:33:34 PowerDNS Recursor itself will distribute queries over threads<br>Aug 02 06:33:34 Inserting rfc 1918 private space zones<br>Aug 02 06:33:34 Listening for UDP queries on 127.0.0.1:53<br>Aug 02 06:33:34 Enabled TCP data-ready filter for (slight) DoS protection<br>Aug 02 06:33:34 Listening for TCP queries on 127.0.0.1:53<br>Aug 02 06:33:34 Calling daemonize, going to background<br> ...done.<br>root@DFW01-CPS01:~#<br>root@DFW01-CPS01:~# dig @127.0.0.1 +subnet=52.57.28.138 morpheus-ien.insnw.net<br><br>; <<>> DiG 9.11.0-P3 <<>> @127.0.0.1 +subnet=52.57.28.138 morpheus-ien.insnw.net<br>; (1 server found)<br>;; global options: +cmd<br>;; connection timed out; no servers could be reached<br>root@DFW01-CPS01:~# dig @127.0.0.1 insnw.net<br><br>; <<>> DiG 9.11.0-P3 <<>> @127.0.0.1 insnw.net<br>; (1 server found)<br>;; global options: +cmd<br>;; Got answer:<br>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38401<br>;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1<br><br>;; OPT PSEUDOSECTION:<br>; EDNS: version: 0, flags:; udp: 4096<br>;; QUESTION SECTION:<br>;insnw.net. IN A<br><br>;; AUTHORITY SECTION:<br>insnw.net. 60 IN SOA ns1.insnw.net. sysadmin.instart.co. 286989 3600 600 604800 60<br><br>;; Query time: 48 msec<br>;; SERVER: 127.0.0.1#53(127.0.0.1)<br>;; WHEN: Wed Aug 02 06:35:04 GMT 2017<br>;; MSG SIZE rcvd: 97<br></div><div><br></div><div>root@DFW01-CPS01:/etc/powerdns# grep -v \# /etc/powerdns/recursor.conf | sed -e '/^$/d'<br>config-dir=/etc/powerdns<br>edns-subnet-whitelist=insnw.net<br>local-address=127.0.0.1<br>quiet=yes<br>setgid=pdns<br>setuid=pdns<br>use-incoming-edns-subnet=yes<br></div><hr><div id="ydp6dc300dbyahoo_quoted_2415189380" class="ydp6dc300dbyahoo_quoted"><div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:13px;color:#26282a;"><div>On Tuesday, August 1, 2017, 11:21:24 PM PDT, bert hubert <bert.hubert@powerdns.com> wrote:</div><div><br></div><div><br></div><div>On Wed, Aug 02, 2017 at 05:52:26AM +0000, Shawn Zhou wrote:<div class="ydp6dc300dbyqt0590081568" id="ydp6dc300dbyqtfd36248"><br clear="none">> Hi,<br clear="none">> I am trying out pdns recursor 4.0.6 on Ubuntu Xenial and cache lookup for same record with and without client subnet give me the same result which is not expected. I expect [3] to return a different value as the cache should have different value based on client subnet. I wonder if that's bug with edns-client-subnet implementation with pdns or I miss something in the configuration file.<br clear="none">> Also, I noticed dig doesn't show "CLIENT-SUBNET: 52.57.28.138/32/16" when I dig against pdns but I get that when I dig it against the authoritative directly. see [4].</div><br clear="none"><br clear="none">Hi Shawn,<br clear="none"><br clear="none">We did a lot of work on EDNS Client Subnet in 4.1, for which a trial release<br clear="none">can be found in <a shape="rect" href="https://blog.powerdns.com/2017/07/18/powerdns-recursor-4-1-0-alpha1-released/" rel="nofollow" target="_blank">https://blog.powerdns.com/2017/07/18/powerdns-recursor-4-1-0-alpha1-released/</a><br clear="none"><br clear="none">Before we analyse your issue to deeply, can you check what 4.1 does in your<br clear="none">case?<br clear="none"><br clear="none">Have you set use-incoming-edns-subnet?<br clear="none"><br clear="none">Good luck!<br clear="none"><br clear="none"> Bert<div class="ydp6dc300dbyqt0590081568" id="ydp6dc300dbyqtfd00031"><br clear="none"></div></div></div></div></div></body></html>