topic Re: DNS forwarding randomly fails for random sites in Operating System - HP-UX

DNS forwarding randomly fails for random sites

Frank417 — Fri, 22 Jan 2010 18:07:20 GMT

Our topology consists of forwarding DNS servers in our DMZ and internal DNS servers that are authoritative for internal domains and forward to our forwarding DNS servers in the DMZ. All are running on HP-UX. For some reason, sites like google.com or finance.yahoo.com sometimes don't return an IP address on our internal DNS servers but every other query works fine. No error, just no IP address. Doing a query on the servers in our DMZ successfully returns an IP address. So there is something on our internal servers and we can't seem to figure it out. Any ideas or suggestions would be appreciated.

Re: DNS forwarding randomly fails for random sites

Frank417 — Fri, 22 Jan 2010 18:13:14 GMT

Below is an example of the response...

>nslookup google.com
Server: my_server_name
Address: my_server_IP

Non-authoritative answer:
Name: google.com

Re: DNS forwarding randomly fails for random sites

Steven E. Protter — Fri, 22 Jan 2010 19:05:31 GMT

Shalom,

I have seen this before with DNS.

Normally this is casued by intermittent network issues.

This could be an issue of pass through on the firewall. Port 53 needs to pass through UPP and TCP for accurate DNS answers.

Also note, the measures some sites take to prevent DoS and DNS poison attacks can casue issues as well.

SEP

Re: DNS forwarding randomly fails for random sites

Frank417 — Fri, 22 Jan 2010 19:15:41 GMT

I thought about that, but while that site is failing, others work fine. Then at other times, google.com will work fine and finance.yahoo.com or nissan.com will not. Plus if it was a network issue, I think I would get timeouts on the response.

Re: DNS forwarding randomly fails for random sites

Frank417 — Fri, 22 Jan 2010 19:19:31 GMT

Also, running dig on the query actually shows me that the DNS server is returning a CNAME to the same name. So google.com returns a cname to google.com and its not showing me the authoritative servers or IP address. While its failing if I run dig on the servers its forwarding to, they all come back properly and so to queries to other domains on the internal server. This is just strange.

Re: DNS forwarding randomly fails for random sites

Frank417 — Fri, 22 Jan 2010 19:26:50 GMT

; <<>> DiG 9.3.2 <<>> yahoo.com
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1964
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;yahoo.com. IN A

;; ANSWER SECTION:
yahoo.com. 21015 IN CNAME yahoo.com.

;; Query time: 0 msec

Re: DNS forwarding randomly fails for random sites

cnb — Fri, 22 Jan 2010 20:09:52 GMT

Maybe set swtrace on in nslookup to trace sources?

> set swtrace (default is noswtrace)
> google.com

Re: DNS forwarding randomly fails for random sites

Frank417 — Fri, 22 Jan 2010 21:20:32 GMT

> google.com
Name Server: MyNameServer
Address: NameServerIP

lookup source is DNS
Name Server: MyNameServer
Address: NameServerIP

Trying DNS
Non-authoritative answer:
*** MyNameServer can't find google.com: Non-existent domain

Switching to next source in the policy
lookup source is NIS
Default NIS Server:

Trying NIS
*** No address information is available for "google.com"

Switching to next source in the policy
lookup source is FILES
Using /etc/hosts on: MyNameServer

looking up FILES
*** No address information is available for "google.com"