[Pdns-users] Could not retrieve security status update / spamhaus.org unable to query

[Sophie Loewenthal]

Hi Bert,
Thanks for the info.

> Dec 28 21:04:38 10 pdns_recursor[2667]: [1225] 102.77.50.178.xbl.spamhaus.org: timeout resolving after 2503.31msec

I'm travelling and don't have server access, and cannot give the full logs, yet.
I guess you are correct & Spamhaus is blocking this. The source IP address has not been used to query DNS for 9 months, so odd they are blocking it now. Limits are not being exceeded because it is a very small email server with an email rate of 200 messages per day. 
I sent SpamHaus an email asking if they are blocking this.


Thanks, 
Sophie
--

On December 29, 2017 11:16:13 AM CET, bert hubert <bert.hubert at powerdns.com> wrote:
>On Fri, Dec 29, 2017 at 12:02:13AM +0100, Sophie Loewenthal wrote:
>> Hi everyone,
>
>good morning!
>
>> I had this message in my logs in a new installation with a new VPS
>provider, and wonder if this is them or pdns_resolver blocking,
>> Dec 28 22:42:11 mx10 pdns_recursor[7093]: Could not retrieve security
>status update for '4.0.4-1+deb9u3.Debian' on
>'recursor-4.0.4-1_deb9u3.Debian.security-status.secpoll.powerdns.com',
>RCODE = Non-Existent domain
>
>This is a mistake by us, and we'll rectify it. We should list this
>version
>as safe or not, apologies.
>
>> Also, I noticed that spamhaus.org was not resolving, which was quite
>strange. All other queries to RNSBLs work e.g spamcop.
>> Dec 28 21:04:38 10 pdns_recursor[2667]: [1225]
>102.77.50.178.xbl.spamhaus.org: timeout resolving after 2503.31msec
>> Dec 28 21:04:38 10 pdns_recursor[2667]: [1225]
>102.77.50.178.xbl.spamhaus.org: Trying IP 178.209.52.139:53, asking
>'102.77.50.178.xbl.spamhaus.org|AAAA'
>> Dec 28 21:04:38 10 pdns_recursor[2667]: 1 [1225/2] answer to question
>'102.77.50.178.xbl.spamhaus.org|AAAA': 0 answers, 0 additional, took 4
>packets, 7515.07 ms, 2 throttled, 3 timeouts, 0 tcp connections,
>rcode=2
>
>This is likely exactly what it says, that 178.209.52.139 is not
>listening to
>you. Spamhaus is known to limit queries if they exceed a certain rate.
>
>It looks like you deleted some log lines so we can't really tell what
>is
>going on.
>
>	Bert