<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi Otto,<div class=""><br class=""></div><div class="">Thanks for checking. Here is the configuration:</div><div class=""><br class=""></div><div class="">local-address=0.0.0.0, ::<br class="">local-port=53<br class="">query-local-address=::,0.0.0.0<br class="">threads=8<br class=""><br class="">allow-from=127.0.0.0/8, ::1/128, 10.0.0.0/8, 87.251.42.0/26, 2001:7b8:650::/48<br class=""><br class="">dnssec=validate<br class=""><br class="">lua-config-file=/etc/powerdns/recursor.lua<br class=""><br class="">webserver=yes<br class="">webserver-port=8082<br class="">webserver-address=::<br class="">webserver-password=<removed><br class="">webserver-allow-from=0.0.0.0/32,::/0<br class="">api-key=<removed><br class=""><br class="">pdns-distributes-queries=true<br class="">reuseport=yes<br class="">any-to-tcp=yes<br class="">root-nx-trust=no<br class="">version-string=powerdns<br class="">max-ns-per-resolve=5</div><div class=""><div><br class=""></div><div>-- Ariën</div><div><br class=""></div><div><br class=""><blockquote type="cite" class=""><div class="">On 26 Jan 2023, at 17:04, Otto Moerbeek <<a href="mailto:otto@drijf.net" class="">otto@drijf.net</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta charset="UTF-8" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">Hi,</span><br style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">Please show your configuration.</span><br style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">I do not think your analysis is to the point.</span><br style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">If I repeat a scenario, I see a correct retrieval of the A record.</span><br style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">So we have to find out what is different in your case.</span><br style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span class="Apple-tab-span" style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: pre; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"> </span><span style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">-Otto</span><br style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">On Thu, Jan 26, 2023 at 01:30:54PM +0100, Arien Vijn via Pdns-users wrote:</span><br style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><blockquote type="cite" style="font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">Greetings,<br class=""><br class="">We recently upgraded pdns_recursor from version 4.4.5 to 4.8.0. It seems that we run in into the following issue ever since.<br class=""><br class="">1/ Client queries for an A-record for <a href="http://xdsl-serviceweb.kpn.com" class="">xdsl-serviceweb.kpn.com</a>.<br class="">2/ Recursor queries the domain tree and receives the CNAME-record that points to: <a href="http://xdsl-c-serviceweb.gslb.kpn.com" class="">xdsl-c-serviceweb.gslb.kpn.com</a>. from the authoritative DNS server.<br class="">3/ Recursor queries and receives the subsequent an A-record from the authoritative DNS server for that A-record.<br class="">4/ Recursor answers the client mentioned in 1/.<br class=""><br class="">So far so good, until the A-record of <a href="http://xdsl-c-serviceweb.gslb.kpn.com" class="">xdsl-c-serviceweb.gslb.kpn.com</a>. expires out of the 'main record cache' but not from the 'main packet cache'. The CNAME remains in both caches. Please note this excerpt from: rec_control dump-cache below:<br class=""><br class=""> ; main record cache dump follows<br class=""> ;<br class=""> <a href="http://xdsl-serviceweb.kpn.com" class="">xdsl-serviceweb.kpn.com</a>. 300 -224 IN CNAME <a href="http://xdsl-c-serviceweb.gslb.kpn.com" class="">xdsl-c-serviceweb.gslb.kpn.com</a>. ; (Secure) auth=1 zone=<a href="http://kpn.com" class="">kpn.com</a> from=194.151.228.10 nm= rtag= ss=0<br class=""> ; negcache dump follows<br class=""><br class=""> [...]<br class=""><br class=""> ; main packet cache dump from thread follows<br class=""> ;<br class=""> <a href="http://xdsl-c-serviceweb.gslb.kpn.com" class="">xdsl-c-serviceweb.gslb.kpn.com</a>. -1803 A ; tag 0 udp<br class=""><br class=""> [...]<br class=""><br class=""> ; main packet cache dump from thread follows<br class=""> ;<br class=""> <a href="http://xdsl-serviceweb.kpn.com" class="">xdsl-serviceweb.kpn.com</a>. -470 A ; tag 0 udp<br class=""> <a href="http://xdsl-serviceweb.kpn.com" class="">xdsl-serviceweb.kpn.com</a>. 111 A ; tag 0 udp<br class=""> <a href="http://xdsl-serviceweb.kpn.com" class="">xdsl-serviceweb.kpn.com</a>. 111 AAAA ; tag 0 udp<br class=""><br class=""><br class="">From that point on, pdns_recursor replies on queries for the A-record with the SOA-record of the domain of the said A-record:<br class=""><br class=""> ; <<>> DiG 9.11.5-P4-5.1+deb10u2-Debian <<>> <a href="http://xdsl-c-serviceweb.gslb.kpn.com" class="">xdsl-c-serviceweb.gslb.kpn.com</a>. @localhost<br class=""> ;; global options: +cmd<br class=""> ;; Got answer:<br class=""> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36347<br class=""> ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1<br class=""><br class=""> ;; OPT PSEUDOSECTION:<br class=""> ; EDNS: version: 0, flags:; udp: 512<br class=""> ;; QUESTION SECTION:<br class=""> ;<a href="http://xdsl-c-serviceweb.gslb.kpn.com" class="">xdsl-c-serviceweb.gslb.kpn.com</a>. IN A<br class=""><br class=""> ;; AUTHORITY SECTION:<br class=""> <a href="http://gslb.kpn.com" class="">gslb.kpn.com</a>. 79407 IN SOA <a href="http://ns2gslb.kpn.com" class="">ns2gslb.kpn.com</a>. <a href="http://netmaster.gslb.kpn.com" class="">netmaster.gslb.kpn.com</a>. 2023011702 10800 3600 604800 86400<br class=""><br class=""> ;; Query time: 0 msec<br class=""> ;; SERVER: ::1#53(::1)<br class=""> ;; WHEN: Thu Jan 26 12:10:13 CET 2023<br class=""> ;; MSG SIZE rcvd: 113<br class=""><br class=""><br class="">This situation causes actual people to complain and is being resolved by removing the domain tree for the subdomain <a href="http://gslb.kpn.com" class="">gslb.kpn.com</a>. out of the caches. From then on the story starts again.<br class=""><br class="">That the A-record <a href="http://xdsl-c-serviceweb.gslb.kpn.com" class="">xdsl-c-serviceweb.gslb.kpn.com</a>. remains in the packet cache seems not good to me, but I don't know enough about DNS and pdns_recursor be sure. What could trigger this behaviour or is it perhaps a configuration issue because we made such a large jump in versions when we upgraded? Last but not least we see the same behaviour with at least one other hostname<br class=""><br class="">-- Ari??n<br class=""><br class=""></blockquote><br style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br style="caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><blockquote type="cite" style="font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">_______________________________________________<br class="">Pdns-users mailing list<br class=""><a href="mailto:Pdns-users@mailman.powerdns.com" class="">Pdns-users@mailman.powerdns.com</a><br class=""><a href="https://mailman.powerdns.com/mailman/listinfo/pdns-users" class="">https://mailman.powerdns.com/mailman/listinfo/pdns-users</a></blockquote></div></blockquote></div><br class=""></div></body></html>