DNS forwarding randomly fails for random sites

[Frank417]

Our topology consists of forwarding DNS servers in our DMZ and internal DNS servers that are authoritative for internal domains and forward to our forwarding DNS servers in the DMZ. All are running on HP-UX. For some reason, sites like google.com or finance.yahoo.com sometimes don't return an IP address on our internal DNS servers but every other query works fine. No error, just no IP address. Doing a query on the servers in our DMZ successfully returns an IP address. So there is something on our internal servers and we can't seem to figure it out. Any ideas or suggestions would be appreciated.

[Frank417]

Below is an example of the response...


>nslookup google.com
Server: my_server_name
Address: my_server_IP

Non-authoritative answer:
Name: google.com

[Steven E. Protter]

Shalom,

I have seen this before with DNS.

Normally this is casued by intermittent network issues.

This could be an issue of pass through on the firewall. Port 53 needs to pass through UPP and TCP for accurate DNS answers.

Also note, the measures some sites take to prevent DoS and DNS poison attacks can casue issues as well.

SEP

[Frank417]

I thought about that, but while that site is failing, others work fine. Then at other times, google.com will work fine and finance.yahoo.com or nissan.com will not. Plus if it was a network issue, I think I would get timeouts on the response.

[Frank417]

Also, running dig on the query actually shows me that the DNS server is returning a CNAME to the same name. So google.com returns a cname to google.com and its not showing me the authoritative servers or IP address. While its failing if I run dig on the servers its forwarding to, they all come back properly and so to queries to other domains on the internal server. This is just strange.

[Frank417]

; <<>> DiG 9.3.2 <<>> yahoo.com
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1964
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;yahoo.com. IN A

;; ANSWER SECTION:
yahoo.com. 21015 IN CNAME yahoo.com.

;; Query time: 0 msec

[cnb]

Maybe set swtrace on in nslookup to trace sources?

> set swtrace (default is noswtrace)
> google.com

[Frank417]

> google.com
Name Server: MyNameServer
Address: NameServerIP

lookup source is DNS
Name Server: MyNameServer
Address: NameServerIP

Trying DNS
Non-authoritative answer:
*** MyNameServer can't find google.com: Non-existent domain

Switching to next source in the policy
lookup source is NIS
Default NIS Server:

Trying NIS
*** No address information is available for "google.com"

Switching to next source in the policy
lookup source is FILES
Using /etc/hosts on: MyNameServer

looking up FILES
*** No address information is available for "google.com"