[Pdns-users] CNAME lookup failure PDNS 2.9.22/PDNS Recursor 3.3.1

ktm at rice.edu ktm at rice.edu
Wed Mar 21 13:24:45 UTC 2012


Hi Peter,

I guess I just do not understand. I added a similar CNAME record
in our domain pointing to the same name domains.tumblr.com and
here is what I get for the lookup:

> dig +norec a wombat1.rice.edu @ns1.rice.edu

; <<>> DiG 9.3.6-P1-RedHat-9.3.6-20.P1.el5 <<>> +norec a wombat1.rice.edu @ns1.rice.edu
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36391
;; flags: qr aa; QUERY: 1, ANSWER: 1, AUTHORITY: 13, ADDITIONAL: 0

;; QUESTION SECTION:
;wombat1.rice.edu.		IN	A

;; ANSWER SECTION:
wombat1.rice.edu.	3600	IN	CNAME	domains.tumblr.com.

;; AUTHORITY SECTION:
.			518400	IN	NS	a.root-servers.net.
.			518400	IN	NS	b.root-servers.net.
.			518400	IN	NS	c.root-servers.net.
.			518400	IN	NS	d.root-servers.net.
.			518400	IN	NS	e.root-servers.net.
.			518400	IN	NS	f.root-servers.net.
.			518400	IN	NS	g.root-servers.net.
.			518400	IN	NS	h.root-servers.net.
.			518400	IN	NS	i.root-servers.net.
.			518400	IN	NS	j.root-servers.net.
.			518400	IN	NS	k.root-servers.net.
.			518400	IN	NS	l.root-servers.net.
.			518400	IN	NS	m.root-servers.net.

;; Query time: 1 msec
;; SERVER: 128.42.209.32#53(128.42.209.32)
;; WHEN: Wed Mar 21 08:14:18 2012
;; MSG SIZE  rcvd: 277

Note, it still does not return the A record IP address. I thought that
the DNS lookup is to restart using the new value returned from the
CNAME record, but in this case, it does not. The other noise in the
authority section was me trying with send-root-referrals=lean.

It does not sent NXDOMAIN in this case. If I instead remove the +norecurse
option I get:

> dig a wombat1.rice.edu @ns1.rice.edu

; <<>> DiG 9.3.6-P1-RedHat-9.3.6-20.P1.el5 <<>> a wombat1.rice.edu @ns1.rice.edu
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 577
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;wombat1.rice.edu.		IN	A

;; AUTHORITY SECTION:
rice.edu.		2699	IN	SOA	ns1.rice.edu. hostmaster.rice.edu. 2012030284 10800 900 3600000 3600

;; Query time: 1 msec
;; SERVER: 128.42.209.32#53(128.42.209.32)
;; WHEN: Wed Mar 21 08:22:46 2012
;; MSG SIZE  rcvd: 85

Which is still returning NXDOMAIN, even though the A record for domains.tumblr.com
does exist:

> dig a domains.tumblr.com @ns1.rice.edu

; <<>> DiG 9.3.6-P1-RedHat-9.3.6-20.P1.el5 <<>> a domains.tumblr.com @ns1.rice.edu
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29239
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;domains.tumblr.com.		IN	A

;; ANSWER SECTION:
domains.tumblr.com.	600	IN	A	66.6.44.4

;; Query time: 9 msec
;; SERVER: 128.42.209.32#53(128.42.209.32)
;; WHEN: Wed Mar 21 08:23:50 2012
;; MSG SIZE  rcvd: 52

Why doesn't the recursor restart with the CNAME results?

Regards,
Ken

On Wed, Mar 21, 2012 at 11:22:17AM +0100, Peter van Dijk wrote:
> Hello Ken,
> 
> On Mar 20, 2012, at 19:10 , ktm at rice.edu wrote:
> 
> > I am investigating a CNAME resolution problem using
> > PDNS Recursor 3.3.1. Here is the lookup that fails:
> > 
> >> nslookup blog.mythandsymbol.com
> > Server:		127.0.0.1
> > Address:	127.0.0.1#53
> > 
> > ** server can't find blog.mythandsymbol.com: NXDOMAIN
> 
> Recursor is returning NXDOMAIN because that's what ns1-3.dreamhost.com, the auths for mythandsymbol.com, are returning:
> 
> $ dig +norec a blog.mythandsymbol.com @ns1.dreamhost.com
> ; <<>> DiG 9.7.0-P1 <<>> +norec a blog.mythandsymbol.com @ns1.dreamhost.com
> ;; global options: +cmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 40440
> ;; flags: qr aa; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0
> 
> ;; QUESTION SECTION:
> ;blog.mythandsymbol.com.                IN      A
> 
> ;; ANSWER SECTION:
> blog.mythandsymbol.com. 14400   IN      CNAME   domains.tumblr.com.
> 
> ;; AUTHORITY SECTION:
> tumblr.com.             14400   IN      SOA     ns1.dreamhost.com. hostmaster.dreamhost.com. 2011092301 21293 1800 1814400 14400
> 
> ;; Query time: 168 msec
> ;; SERVER: 66.33.206.206#53(66.33.206.206)
> ;; WHEN: Wed Mar 21 11:20:51 2012
> ;; MSG SIZE  rcvd: 130
> 
> 
> They are returning NXDOMAIN because somebody configured tumblr.com as a zone in their name server, without adding a 'domains' name in it. Recursor 3.4-pre and newer (and perhaps 3.3) compensate for this misconfiguration, older versions do not.
> 
> I suggest contacting dream host to have them get rid of tumblr.com; I also suggest upgrading your recursor because there are many more misconfigured domains like this one out there.
> 
> Kind regards,
> Peter van Dijk
> _______________________________________________
> Pdns-users mailing list
> Pdns-users at mailman.powerdns.com
> http://mailman.powerdns.com/mailman/listinfo/pdns-users
> 



More information about the Pdns-users mailing list