-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi,
On 08/19/2011 04:53 PM, Robert Fleischman wrote: > I have been having trouble resolving "www.balfour.com" > > It appears that ns1.worldnic.com and ns2.worldnic.com (the NS for > www.balfour.com") is returning a CNAME response (pointing off to an > amazon'd name) with the SERVFAIL bit set in the header. It also > (according to dig) sometimes spits back a truncated response requiring > a TCP retry. So it returns SERVFAIL. The content of the message is junk. unbound ignores the contents of the message. > This combination of things makes unbound a bit upset. I've seen > discussions of this here: Well, its not upset, it is simply not resolving the name. But that is the issue here, of course. > http://mailman.powerdns.com/pipermail/pdns-dev/2010-October/000886.html > > (My guess is that worldnic.com is running PowerDNS) Yes, I hope that patch fixes authority-server-powerdns so it does not emit errors when it should not. It looks a bit bland to me - like emitting noerror when there could be errors, but I am not the powerdns code expert. > In practice, sometimes unbound returns the A record, sometimes not! > It appears other recursive servers are much more permissive here. I guess the +TC tcp fallback actually works. Other cases have an error set, and are thus ignored. > --- > > Is there a way to make Unbound "happier" about this name and semi-broken > setup? Not return error codes when you mean to return a CNAME? You could email the owners of the site (SOA hostmaster should be a good email to start). local-data: "www.balfour.com A <IP>" in your config to provide an override for this name to the correct IP address? Best regards, Wouter -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.15 (GNU/Linux) Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org/ iQIcBAEBAgAGBQJOTp/3AAoJEJ9vHC1+BF+NNK8P/0JW3ZrOnjxOF1eYLUWi3tGd iy5qNuB1yeyqMqzUtpx0bMb2uXEBqFpxwVWqHoxXEy9bOeOMT38e7wd2hI8mex+2 n4mmNwF1sEm/ieNdCVOiUZ3lQj+cpOL+0y4SmUoNsql36NtOK00DNso+S1/dyQPr tIToxgKOVKzSgBGSEQ85itO8fYynLL0gVdEJu3aaq3hnJZ4BbKqHqDSFhHaKlPa5 CfEfVqMrWLcnxNAWynjaGZrbe2U+VthMFsJli7Ht+JsigieEjOeOZG8Xp+DKRtfL qzrVMA4cennxDgi6xA1QwbSE5FVqqBD/rcJdV7Ypj4SyVY51LXREUpPxainTxms1 Geinlx/ahC7Mi2JJt8aPIS/Egvkm1uaHD3ATjqxAxtgHqunO8nQOm9/g+hF9IVr0 uCQRARwd2LlcysNcCGQ+a0mglCF6+w+i2kLto7iO4Makq0K9a0ziQS19QqIJvWsW 65MQXA3aprlzYd3xOiFaHx/CGglap0nbAuloEG4rGz7DwezEmCSHRXr7EN52sxzl li33z3JP8HWjDJ/k/vVt68Lk1p8d4nMBySDMOeGFv8P/1RWbetlJHqeybhCfiTIa d848Y5Qlri5repr3Jx4v5DpupM/xFaJBOV0nsWMAfTx8YL9ro+Ace5YpCoyjHF5b cJE2MMAi7OuDUQJ7s4rL =diQF -----END PGP SIGNATURE----- _______________________________________________ Unbound-users mailing list [email protected] http://unbound.nlnetlabs.nl/mailman/listinfo/unbound-users
