named - Malformed response out of data in final pass

[David S. Bell]

It was just brought to my attention that we are getting these messages in the syslog.log

named Malformed response from (FireWall-Address).53 (out of data in final pass)

The firewall vendor says that all the firewall does is pass the request to an external DNS.

I am receiving these messages on all internal (local) DNS servers.

I am running named 4.9.7 Thu May 21 10:55:40 GMT 1998 PHNE_14617

[Steve Steel · Accepted solution]

Hi

1)Load the latest patch
Patch Name: PHNE_23277

Patch Description: s700_800 10.01-[12]0 BIND 4.9.7 components

Creation Date: 01/02/15

Post Date: 01/02/23

Hardware Platforms - OS Releases:
s700: 10.01 10.10 10.20
s800: 10.01 10.10 10.20

Products: N/A

Filesets:
InternetSrvcs.INETSVCS-RUN InternetSrvcs.INET-ENG-A-MAN

Automatic Reboot?: No

Status: General Release

Critical: No

Path Name: /hp-ux_patches/s700_800/10.X/PHNE_23277

Symptoms:
PHNE_23277:
1. JAGad38231/8606168953:
Disable version query feature on BIND 4.9.7

2. JAGad41828/8606172568:
named loops with some record queries.

3. JAGad48072/8606178847:
Incorrect error messages generated by named for
malformed DNS queries.

2)Read
www.acmebw.com/askmrdns/bind-messages.htm
invalid RR type 'SOA' in additional section (name = 'occ.cc.mi.us') from [198.108.130.5].53
or
invalid RR type 'A' in authority section (name = 'dns0.doc.ic.ac.uk') from [146.169.2.2].53
CATEGORY: response-checks
SEVERITY: info
PAGE:
FURTHER INFO:

The first message indicates that your name server received an SOA record for occ.cc.mi.us in the additional data section of a response from the name server at the IP address 198.108.130.5.Since SOA records should never appear in the additional data section, this is an error.

The second message indicates that your name server received an A record for dns0.doc.ic.ac.uk in the authority section of a response from the name server at the IP address 146.169.2.2.Since A records should never appear in the authority section, this is an error.

Both of these messages indicate a flaw in the implementation (not the configuration) of the remote name server.

Sometimes this message will occur as one of a pair of messages:

invalid RR type 'A' in authority section (name = 'xaymaca.uwimona.edu.jm') from [200.9.115.2].53
Malformed response from [200.9.115.2].53 (out of data in final pass)


Steve Steel HP-Brussels