Hi, On 17/04/2020 14:34, Юрий Иванов via Unbound-users wrote: > Hi > My unbound returns incorrect results > > Unboud returns .203 IP
Unbound looks up the target of the CNAME by itself, this is necessary for security reasons for caching the correct data for that name. The lookup for that returned the .203 IP. So that is the correct answer. The original server was not returning the correct information. It must return the same IP address for 'mysite.net' as when the DNS is queried directly for the name. For security reasons, unbound queries for all CNAME answers for the target name, to look it up directly, to make sure it gets the correct information in cache. In the print out you are missing a direct dig query for the 'mysite.net' record, that would (apparantly because unbound finds it) return the .203 IP address. If I query for the names over here I get different results. Since you say it was half a year ago .203, perhaps the .203 is still there and returned for direct lookups for 'mysite.net' and this causes it. If so, fix it so that the authoritative servers for 'mysite.net' return the .203 answer for the name mysite.net. Best regards, Wouter > suser@gong:~$ dig @1.204.196.202 www.mysite.net > > ; <<>> DiG 9.11.5-P4-5.1ubuntu2.1-Ubuntu <<>> @1.204.196.202 www.mysite.net > ; (1 server found) > ;; global options: +cmd > ;; Got answer: > ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2722 > ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 > > ;; OPT PSEUDOSECTION: > ; EDNS: version: 0, flags:; udp: 4096 > ;; QUESTION SECTION: > ;www.mysite.net. IN A > > ;; ANSWER SECTION: > www.mysite.net. 4275 IN CNAME mysite.net. > mysite.net. 5048 IN A 1.204.196.203 > > > But my authoritative DNS server returns: > > suser@gong:~$ dig @1.204.196.130 www.mysite.net > > ; <<>> DiG 9.11.5-P4-5.1ubuntu2.1-Ubuntu <<>> @1.204.196.130 www.mysite.net > ; (1 server found) > ;; global options: +cmd > ;; Got answer: > ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58582 > ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 3, ADDITIONAL: 4 > > ;; OPT PSEUDOSECTION: > ; EDNS: version: 0, flags:; udp: 4096 > ;; QUESTION SECTION: > ;www.mysite.net. IN A > > ;; ANSWER SECTION: > www.mysite.net. 10800 IN CNAME mysite.net. > mysite.net. 10800 IN A 1.2.25.159 > > ;; AUTHORITY SECTION: > mysite.net. 10800 IN NS ns4.mysite.net. > mysite.net. 10800 IN NS ns1.mysite.net. > mysite.net. 10800 IN NS ns2.mysite.net. > > ;; ADDITIONAL SECTION: > ns1.mysite.net. 10800 IN A 1.204.196.130 > ns2.mysite.net. 10800 IN A 1.2.25.199 > ns4.mysite.net. 10800 IN A 1.204.196.200 > > ;; Query time: 0 msec > ;; SERVER: 1.204.196.130#53(1.204.196.130) > ;; WHEN: Птн апр 17 15:30:39 EEST 2020 > ;; MSG SIZE rcvd: 178 > > and google returns correct records: > > suser@gong:~$ dig @8.8.8.8 www.mysite.net > > ; <<>> DiG 9.11.5-P4-5.1ubuntu2.1-Ubuntu <<>> @8.8.8.8 www.mysite.net > ; (1 server found) > ;; global options: +cmd > ;; Got answer: > ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6220 > ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 > > ;; OPT PSEUDOSECTION: > ; EDNS: version: 0, flags:; udp: 512 > ;; QUESTION SECTION: > ;www.mysite.net. IN A > > ;; ANSWER SECTION: > www.mysite.net. 1842 IN CNAME mysite.net. > mysite.net. 1842 IN A 1.2.25.159 > > ;; Query time: 46 msec > ;; SERVER: 8.8.8.8#53(8.8.8.8) > ;; WHEN: Птн апр 17 15:30:05 EEST 2020 > ;; MSG SIZE rcvd: 76 > > > This 1.204.196.203 was valid IP about half a year ago. > Can't find where it comes from. > This is new clean unbound setup installed two days ago.
