Score:1

Server

Why won't my recursive DNS resolver resolve this domain?

pnadeau

1/13/23, 11:39 AM

I am using bind9 as a recursive resolver and it works beautifully for 99% of domains.

However it returns an NXDOMAIN for this one michaelkors.scene7.com even though some public nameservers return an answer for it.

What is curious is that in the linked online DNS utility, some servers report one IP, others another IP, and the authoritative servers don't return any records at all.

It seems like the nameservers for this domain are misconfigured, but then how come Google and Cloudflare are returning results? Are they perhaps just returning cached results?

What can one do in situations like this?

Update: It looks as if my bind is trying to use their IPV6 nameservers.

Problem is I don't have IPV6 connectivity. How does one turn this off in bind9?

13-Sep-2021 15:41:52.907 queries: client @0x8233e3000 192.168.1.4#33106 (michaelkors.scene7.com): query: michaelkors.scene7.com IN A +E(0) (192.168.1.4)
13-Sep-2021 15:41:53.299 lame-servers: host unreachable resolving 'ns201.adobe.net/A/IN': 2001:502:8cc::30#53
...
13-Sep-2021 15:41:53.301 lame-servers: host unreachable resolving 'ns204.adobe.net/AAAA/IN': 2001:500:d937::30#53
13-Sep-2021 15:41:53.409 query-errors: client @0x8233e3000 192.168.1.4#33106 (michaelkors.scene7.com): query failed (SERVFAIL) for michaelkors.scene7.com/IN/A at query.c:8678
13-Sep-2021 15:41:53.414 queries: client @0x824194000 192.168.1.22#61146 (michaelkors.scene7.com): query: michaelkors.scene7.com IN A + (192.168.1.4)
13-Sep-2021 15:41:53.414 query-errors: client @0x824194000 192.168.1.22#61146 (michaelkors.scene7.com): query failed (SERVFAIL) for michaelkors.scene7.com/IN/A at query.c:7118

Update 2: After disabling IPV6 with the -4 flag, I am still unable to resolve that domain. Here is the log output now:

3-Sep-2021 16:09:18.392 queries: client @0x823293a00 192.168.1.22#51775 (michaelkors.scene7.com): query: michaelkors.scene7.com IN A + (192.168.1.4)
13-Sep-2021 16:09:18.394 query-errors: client @0x823293a00 192.168.1.22#51775 (michaelkors.scene7.com): query failed (SERVFAIL) for michaelkors.scene7.com/IN/A at query.c:8678
13-Sep-2021 16:09:18.395 queries: client @0x823293000 192.168.1.22#58047 (michaelkors.scene7.com.localnet): query: michaelkors.scene7.com.localnet IN A + (192.168.1.4)

150

0 + 0

domain-name-system

bind

Nikita Kipriyanov

1/13/23, 12:43 PM

My bind9 resolves it. Probably something wrong on your side. What to do? First, use public DNS Looking Glass (there are lots of them in the Internet) to check if it's only you or everybody.

Patrick Mevzek

1/13/23, 2:41 PM

Did you look at the logfiles (and increase verbosity) of your own recursive nameserver to see why it think `NXDOMAIN`? You can look at https://dnsviz.net/d/michaelkors.scene7.com/YT9hzQ/dnssec/ for troubleshooting your record seems fine, albeit depending on a zone that is in a lame delegation situation.

pnadeau

1/13/23, 7:50 PM

See above. I *think* my resolver is trying to connect to their IPV6 nameservers.

Score:1

Server

pnadeau

1/13/23, 8:58 PM

I am blocking some zones using an adblock blacklist.

When I disable that blacklist, the domain resolves fine.

It still isn't obvious which blocked domain is causing the problem, probably one of the dozens of *.edgekey.net entries in the list. I can sort this out later.

The one good thing is that it alerted me to the fact that I needed to disable IPV6.

0 + 0

Michael Hampton

1/13/23, 9:01 PM

Eh? IPv6 is completely irrelevant to this problem.

pnadeau

1/13/23, 9:42 PM

Yes, IPV6 was not the cause, but while debugging this problem I noticed that my nameserver was trying to connect to IPV6 namservers which would always fail.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Why won't my recursive DNS resolver resolve this domain?

TH: เหตุใดตัวแก้ไข DNS แบบเรียกซ้ำของฉันจึงไม่แก้ไขโดเมนนี้

RO: De ce soluția mea recursiva DNS nu va rezolva acest domeniu?

RU: Почему мой рекурсивный преобразователь DNS не разрешает этот домен?

VI: Tại sao trình phân giải DNS đệ quy của tôi không giải quyết miền này?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.