<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi Steffan,<div class=""><br class=""></div><div class="">It smells like a bunch of Windows clients that all want to lookup a DomainController... (all capitals, DC, ... typical MS naming conventions)</div><div class=""><br class=""></div><div class="">Are the <font face="Calibri, sans-serif" class=""><span style="font-size: 14.666666984558105px;" class="">195.121.82.103-</span></font><span style="font-family: Calibri, sans-serif; font-size: 11pt;" class="">195.121.82.139</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> ips under your control?</span></div><div class=""><div><br class=""></div><div>Best of luck hunting :)</div><div><br class=""></div><div>Frank</div><div><br class=""><blockquote type="cite" class=""><div class="">On 10 Jun 2020, at 08:32, Steffan via Pdns-users <<a href="mailto:pdns-users@mailman.powerdns.com" class="">pdns-users@mailman.powerdns.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Lato-Light; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class="" type="cite"><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">On 06/08/2020 8:12 PM Steffan via Pdns-users <<a href="mailto:pdns-users@mailman.powerdns.com" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">pdns-users@mailman.powerdns.com</a>> wrote:<span class="Apple-converted-space"> </span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="">Hello,</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="">Im rusiing 4.1.13-1pdns.el7</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="">I just noticed a lot of these lines</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="">Jun 8 19:55:08 ns2 pdns_server: Exception building answer packet for<span class="Apple-converted-space"> </span><a href="http://ks-dc-01.ksprofiel.nl/DS" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">KS-DC-01.ksprofiel.nl/DS</a><span class="Apple-converted-space"> </span>(All data was not consumed) sending out servfail</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="">Jun 8 19:55:08 ns2 pdns_server: Exception building answer packet for<span class="Apple-converted-space"> </span><a href="http://ks-dc-01.ksprofiel.nl/AAAA" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">KS-DC-01.ksprofiel.nl/AAAA</a><span class="Apple-converted-space"> </span>(All data was not consumed) sending out servfail</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="">Jun 8 19:55:08 ns2 pdns_server: Exception building answer packet for<span class="Apple-converted-space"> </span><a href="http://ks-dc-01.ksprofiel.nl/A" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">KS-DC-01.ksprofiel.nl/A</a><span class="Apple-converted-space"> </span>(All data was not consumed) sending out servfail</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="">Jun 8 19:55:10 ns2 pdns_server: Exception building answer packet for<span class="Apple-converted-space"> </span><a href="http://ks-dc-01.ksprofiel.nl/A" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">KS-DC-01.ksprofiel.nl/A</a><span class="Apple-converted-space"> </span>(All data was not consumed) sending out servfail</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="">Jun 8 19:55:10 ns2 pdns_server: Exception building answer packet for<span class="Apple-converted-space"> </span><a href="http://ks-dc-01.ksprofiel.nl/DS" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">KS-DC-01.ksprofiel.nl/DS</a><span class="Apple-converted-space"> </span>(All data was not consumed) sending out servfail</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="">Jun 8 19:55:10 ns2 pdns_server: Exception building answer packet for<span class="Apple-converted-space"> </span><a href="http://ks-dc-01.ksprofiel.nl/DS" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">KS-DC-01.ksprofiel.nl/DS</a><span class="Apple-converted-space"> </span>(All data was not consumed) sending out servfail</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="">Jun 8 19:55:10 ns2 pdns_server: Exception building answer packet for<span class="Apple-converted-space"> </span><a href="http://ks-dc-01.ksprofiel.nl/AAAA" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">KS-DC-01.ksprofiel.nl/AAAA</a><span class="Apple-converted-space"> </span>(All data was not consumed) sending out servfail</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="">Jun 8 19:55:10 ns2 pdns_server: Exception building answer packet for<span class="Apple-converted-space"> </span><a href="http://ks-dc-01.ksprofiel.nl/A" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">KS-DC-01.ksprofiel.nl/A</a><span class="Apple-converted-space"> </span>(All data was not consumed) sending out servfail</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="">Jun 8 19:55:10 ns2 pdns_server: Exception building answer packet for<span class="Apple-converted-space"> </span><a href="http://ks-dc-01.ksprofiel.nl/DS" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">KS-DC-01.ksprofiel.nl/DS</a><span class="Apple-converted-space"> </span>(All data was not consumed) sending out servfail</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="">Jun 8 19:55:10 ns2 pdns_server: Exception building answer packet for<span class="Apple-converted-space"> </span><a href="http://ks-dc-01.ksprofiel.nl/AAAA" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">KS-DC-01.ksprofiel.nl/AAAA</a><span class="Apple-converted-space"> </span>(All data was not consumed) sending out servfail</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="">When debugging i see one iprange over and over and over again.</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="">Jun 8 20:10:24 ns3 pdns_server: Remote 195.121.82.135 wants '<a href="http://ks-dc-01.ksprofiel.nl/" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">KS-DC-01.ksprofiel.nl</a>|A', do = 1, bufsize = 1232: packetcache MISS</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="">Jun 8 20:10:24 ns3 pdns_server: Remote 195.121.82.139 wants '<a href="http://ks-dc-01.ksprofiel.nl/" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">KS-DC-01.ksprofiel.nl</a>|AAAA', do = 1, bufsize = 1232: packetcache MISS</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="">Jun 8 20:10:24 ns3 pdns_server: Remote 195.121.82.111 wants '<a href="http://ks-dc-01.ksprofiel.nl/" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">KS-DC-01.ksprofiel.nl</a>|AAAA', do = 1, bufsize = 1232: packetcache MISS</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="">Jun 8 20:10:24 ns3 pdns_server: Remote 195.121.82.103 wants '<a href="http://ks-dc-01.ksprofiel.nl/" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">KS-DC-01.ksprofiel.nl</a>|A', do = 1, bufsize = 1232: packetcache MISS</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="">Jun 8 20:10:27 ns3 pdns_server: Remote 195.121.82.111 wants '<a href="http://ks-dc-01.ksprofiel.nl/" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">KS-DC-01.ksprofiel.nl</a>|DS', do = 1, bufsize = 1232: packetcache MISS</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="">Jun 8 20:10:27 ns3 pdns_server: Remote 195.121.82.111 wants '<a href="http://ks-dc-01.ksprofiel.nl/" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">KS-DC-01.ksprofiel.nl</a>|A', do = 1, bufsize = 1232: packetcache MISS</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="">Soemthimes it is a packetcache HIT (another domain)</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="">Is this some kind of hakking attempt or normal ?</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class=""> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class=""> </span><o:p class=""></o:p></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt; font-family: "Times New Roman", serif;" class="">Met vriendelijke groet,</span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 12pt; font-family: "Times New Roman", serif;" class="">Steffan Noord<span class="Apple-converted-space"> </span></span><o:p class=""></o:p></div></div></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">_______________________________________________<span class="Apple-converted-space"> </span><br class="">Pdns-users mailing list<span class="Apple-converted-space"> </span><br class=""><a href="mailto:Pdns-users@mailman.powerdns.com" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">Pdns-users@mailman.powerdns.com</a><span class="Apple-converted-space"> </span><br class=""><a href="https://mailman.powerdns.com/mailman/listinfo/pdns-users" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">https://mailman.powerdns.com/mailman/listinfo/pdns-users</a><o:p class=""></o:p></div></blockquote><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">>Seems like you have something wrong with those records. All data was not consumed happens when there is something left after parsing the record data.<span class="Apple-converted-space"> </span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">>Try pdnssec/pdnsutil check-zone and if you cant figure it out post unredacted problem records.<span class="Apple-converted-space"> </span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">>Aki<span class="Apple-converted-space"> </span><o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Hello Aki,<o:p class=""></o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="">'<a href="http://ks-dc-01.ksprofiel.nl/" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">KS-DC-01.ksprofiel.nl</a><span class="Apple-converted-space"> </span>does not exsist in the dns so that is correct<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class=""><a href="http://ksprofiel.nl/" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">Ksprofiel.nl</a><span class="Apple-converted-space"> </span>is.<o:p class=""></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div></div><span style="caret-color: rgb(0, 0, 0); font-family: Lato-Light; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">_______________________________________________</span><br style="caret-color: rgb(0, 0, 0); font-family: Lato-Light; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Lato-Light; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">Pdns-users mailing list</span><br style="caret-color: rgb(0, 0, 0); font-family: Lato-Light; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><a href="mailto:Pdns-users@mailman.powerdns.com" style="color: rgb(5, 99, 193); text-decoration: underline; font-family: Lato-Light; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">Pdns-users@mailman.powerdns.com</a><br style="caret-color: rgb(0, 0, 0); font-family: Lato-Light; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><a href="https://mailman.powerdns.com/mailman/listinfo/pdns-users" style="color: rgb(5, 99, 193); text-decoration: underline; font-family: Lato-Light; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">https://mailman.powerdns.com/mailman/listinfo/pdns-users</a></div></blockquote></div><br class=""></div></body></html>