bind - unexpected RCODE (SERVFAIL)

[Maaz]

rpm -q bind
bind-9.3.4-1.23

this is caching dns server, and working(resolving queries) fine.

from /etc/named.conf

forward first;
forwarders { ISP_NS1_IP; ISP_NS2_IP; 4.2.2.2; };

now
# tail -f /var/log/mesages
unexpected RCODE (SERVFAIL) resolving 'stats.surfaid.ihost.com/AAAA/IN': ISP_NS1_IP#53
unexpected RCODE (SERVFAIL) resolving 'stats.surfaid.ihost.com/AAAA/IN': 4.2.2.2#53
unexpected RCODE (SERVFAIL) resolving 'stats.surfaid.ihost.com/AAAA/IN': ISP_NS2_IP#53
FORMERR resolving 'stats.surfaid.ihost.com/AAAA/IN': 64.238.216.230#53
FORMERR resolving 'stats.surfaid.ihost.com/AAAA/IN': 209.235.30.142#53
FORMERR resolving 'stats.surfaid.ihost.com/AAAA/IN': 66.179.173.211#53
unexpected RCODE (SERVFAIL) resolving 'data.coremetrics.com/AAAA/IN': ISP_NS2_IP#53
unexpected RCODE (SERVFAIL) resolving 'data.coremetrics.com/AAAA/IN': 4.2.2.2#53
unexpected RCODE (SERVFAIL) resolving 'data.coremetrics.com/AAAA/IN': ISP_NS1_IP#53
FORMERR resolving 'data.coremetrics.com/AAAA/IN': 64.238.216.230#53
FORMERR resolving 'data.coremetrics.com/AAAA/IN': 209.235.30.142#53
lame server resolving 'data.coremetrics.com' (in 'data.coremetrics.com'?): 66.179.173.211#53

whats "unexpected RCODE (SERVFAIL)" means ?
whats "FORMERR resolving" means ?

Regards

[Ragu_3]

Search for DNSSEC in the BIND documentation.

[Jeeshan]

you have probably disabled queries from the world and only allowed from your
local network. you can:

- allow queries to the zone in the zone "data.coremetrics.com" statement (allow_query)

- allow queries from the whole world to your nameserver and allow recuesion only from your lan

- run authoritative-only nameserver on different IP that knows this zone and has recursion disabled

I recommend the last option. For the option 2, don't forget to disable recursion from the internet - it may cause you problems.

[Ivan Ferreira]

It seems that your server had problems contacting the DNS server for tats.surfaid.ihost.com or resolving it's IPV6 (AAAA) address. I saw messages like this on mail servers with IPV6 enabled for the MTA.

See also RFC 4074:

http://www.ietf.org/rfc/rfc4074.txt