[Pdns-users] SERVFAIL on possibly broken zone supersport.co.za

Sven Ulland sveniu at opera.com
Mon May 7 10:18:58 UTC 2012

Summary: PowerDNS recursor 3.3 returns SERVFAIL when looking up
the A record of images.supersport.co.za due to not following the final
glue records, while BIND 9.8.1 returns the correct A record after
following the glue. Which is right, what is broken?

Skipping root, .za and .co.za NS steps. Also, recursion must be
explicitly disabled, since their NS actually recurses.

dig +norecurse @ns0.is.co.za a images.supersport.co.za
  supersport.co.za.      86400   IN  NS  ns1.mwebhosting.net.
  supersport.co.za.      86400   IN  NS  ns2.mwebhosting.net.

dig +norecurse @ns1.mwebhosting.net a images.supersport.co.za
  images.supersport.co.za. 600   IN  NS images.supersport.co.za.

  images.supersport.co.za. 600   IN  A
  images.supersport.co.za. 600   IN  A

At this point, PowerDNS seems to stop, and returns SERVFAIL to the
stub resolver. BIND follows the NS+glue, and does:

dig +norecurse @ a images.supersport.co.za
  images.supersport.co.za. 0     IN  A

This gives the final IP that can be connected to on port 80.


1) Why doesn't PowerDNS follow the glue in that last answer?

2) If PowerDNS is doing the right thing, exactly which spec (RFC
    and which section) is the zone (and thus also BIND) violating?

I intend to contact the zone admins about this once I get to the
bottom of it.


More information about the Pdns-users mailing list