named and syslog messages

[Fred Martin_1]

Jun 25 08:07:57 corp named[16551]: ns_forw: query(llnw4.radio.musicmatch.com) NS
points to CNAME (den-sns-01.inet.qwest.net:) learnt (CNAME=216.41.101.15:NS=216
.41.101.15)
Since going to HP-UX 11.0 from 10.20, I am getting a lot of messages like those above in the syslog from named.

Oddly, every single one is from musicmatch.com.

So is it my system, or the name server that I query when mine can't resolve?

[Jeff Schussele · Accepted solution]

Hi Fred,

Appears to me that llnw4.radio.musicmatch.com is resolving with a canonical name pointing to den-sns-01.inet.qwest.net & that your logging is picking this up.
Could be that the entry in the NS server is incorrect.
I'd try to resolve it manually & see what you get.
In nslookup, manually set the server to that which serves the outside & resolve
1) by original hostname - standard
2) by original hostname - canonical
3) by IP - 216.41.101.15
4) by CNAME hostname - std & canonical

Bet there's a problem somewhere in one of those entries.

Rgds,
Jeff

[Fred Martin_1]

My DNS server, when it can't resolve, queries a server outside my network. i.e. any host that's not mine, queries outside.

This particular domain, musicwatch.com, is the only one producing the message, even though I'm sure many queries are made throughout the day that should produce similar results if it were normal.

Also, I have many hosts with CNAMEs in my own local files, which do not create the log entry.

So I tend to think the problem is outside my network, is that a reasonable assumption?