Hi Wouter, <br><br>I am extremely happy with the way unbound works and thank-you very much for the work that you <br>have done. <br><br>I'm just not looking forward to the customer queries about why "no dns servers could be reached" <br>
and other odd error messages. Trying to explain to Joe Public about how name servers are <br>in fact broken and that is why they don't get the response they expect is always challenging. <br>Their reply is usually "but if I use opendns or googledns it answers" (never mind the fact that they <br>
are still answering with a servfail.)<br><br>An example I am seeing on one of the unbound caches is as follows. <br><br>The nameservers for 233.165.in-addr.arpa are broken<br><br><snip><br><br>233.165.in-addr.arpa. 59408 IN NS <a href="http://dbndns1.ifusion.co.za">dbndns1.ifusion.co.za</a>.<br>
233.165.in-addr.arpa. 59408 IN NS <a href="http://jhbdns1.ifusion.co.za">jhbdns1.ifusion.co.za</a>.<br>;; BAD (HORIZONTAL) REFERRAL<br>;; Received 133 bytes from 165.233.48.99#53(<a href="http://jhbdns1.ifusion.co.za">jhbdns1.ifusion.co.za</a>) in 21 ms<br>
<br>233.165.in-addr.arpa. 82036 IN NS <a href="http://jhbdns1.ifusion.co.za">jhbdns1.ifusion.co.za</a>.<br>233.165.in-addr.arpa. 82036 IN NS <a href="http://dbndns1.ifusion.co.za">dbndns1.ifusion.co.za</a>.<br>
;; BAD (HORIZONTAL) REFERRAL<br>;; Received 133 bytes from 165.233.152.114#53(<a href="http://dbndns1.ifusion.co.za">dbndns1.ifusion.co.za</a>) in 35 ms<br><br>233.165.in-addr.arpa. 59408 IN NS <a href="http://dbndns1.ifusion.co.za">dbndns1.ifusion.co.za</a>.<br>
233.165.in-addr.arpa. 59408 IN NS <a href="http://jhbdns1.ifusion.co.za">jhbdns1.ifusion.co.za</a>.<br>;; BAD (HORIZONTAL) REFERRAL<br>;; Received 133 bytes from 165.233.48.99#53(<a href="http://jhbdns1.ifusion.co.za">jhbdns1.ifusion.co.za</a>) in 20 ms<br>
<br>233.165.in-addr.arpa. 82036 IN NS <a href="http://jhbdns1.ifusion.co.za">jhbdns1.ifusion.co.za</a>.<br>233.165.in-addr.arpa. 82036 IN NS <a href="http://dbndns1.ifusion.co.za">dbndns1.ifusion.co.za</a>.<br>
;; BAD (HORIZONTAL) REFERRAL<br>;; Received 133 bytes from 165.233.152.114#53(<a href="http://dbndns1.ifusion.co.za">dbndns1.ifusion.co.za</a>) in 33 ms<br><br>233.165.in-addr.arpa. 59408 IN NS <a href="http://dbndns1.ifusion.co.za">dbndns1.ifusion.co.za</a>.<br>
233.165.in-addr.arpa. 59408 IN NS <a href="http://jhbdns1.ifusion.co.za">jhbdns1.ifusion.co.za</a>.<br>;; BAD (HORIZONTAL) REFERRAL<br>;; Received 133 bytes from 165.233.48.99#53(<a href="http://jhbdns1.ifusion.co.za">jhbdns1.ifusion.co.za</a>) in 21 ms<br>
<br></snip><br><br>A unbound-control dump_requestlist shows the following. <br><br>232 PTR IN 17.75.233.165.in-addr.arpa. 117.590562 iterator wait for 165.233.48.99<br>233 PTR IN 18.75.233.165.in-addr.arpa. 106.083322 iterator wait for 165.233.48.99<br>
234 PTR IN 19.75.233.165.in-addr.arpa. 110.606661 iterator wait for 165.233.48.99<br>235 PTR IN 20.75.233.165.in-addr.arpa. 116.093442 iterator wait for 165.233.48.99<br>236 PTR IN 21.67.233.165.in-addr.arpa. 105.611471 iterator wait for 165.233.48.99<br>
237 PTR IN 21.75.233.165.in-addr.arpa. 115.076346 iterator wait for 165.233.48.99<br>238 PTR IN 22.75.233.165.in-addr.arpa. 114.074878 iterator wait for 165.233.48.99<br>239 PTR IN 23.75.233.165.in-addr.arpa. 113.083954 iterator wait for 165.233.48.99<br>
240 PTR IN 24.75.233.165.in-addr.arpa. 112.056811 iterator wait for 165.233.48.99<br>241 PTR IN 25.75.233.165.in-addr.arpa. 111.071265 iterator wait for 165.233.48.99<br>242 PTR IN 26.75.233.165.in-addr.arpa. 110.086471 iterator wait for 165.233.48.99<br>
243 PTR IN 27.75.233.165.in-addr.arpa. 109.110294 iterator wait for 165.233.48.99<br>244 PTR IN 28.74.233.165.in-addr.arpa. 60.251117 iterator wait for 165.233.48.99<br>245 PTR IN 28.75.233.165.in-addr.arpa. 108.101261 iterator wait for 165.233.48.99<br>
246 PTR IN 29.75.233.165.in-addr.arpa. 107.636158 iterator wait for 165.233.48.99<br><br>Would it be possible to get unbound to send a servfail if all nameservers give a bad referral ? The above<br>seems to indicate it will continue trying until it gets the data it is looking for, but in this case it never will and<br>
the query times out. The same query against google dns gives a servfail. <br><br>unbound cache<br><br># time dig 24.75.233.165.in-addr.arpa PTR @<a href="http://dnscache1-ctn.is.co.za">dnscache1-ctn.is.co.za</a><br><br>; <<>> DiG 9.6.1-P2 <<>> 24.75.233.165.in-addr.arpa PTR @<a href="http://dnscache1-ctn.is.co.za">dnscache1-ctn.is.co.za</a><br>
;; global options: +cmd<br>;; connection timed out; no servers could be reached<br><br>real 0m15.285s<br>user 0m0.000s<br>sys 0m0.012s<br><br>google cache<br><br># time dig 24.75.233.165.in-addr.arpa PTR @<a href="http://8.8.8.8">8.8.8.8</a><br>
<br>; <<>> DiG 9.6.1-P2 <<>> 24.75.233.165.in-addr.arpa PTR @<a href="http://8.8.8.8">8.8.8.8</a><br>;; global options: +cmd<br>;; Got answer:<br>;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 33284<br>
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0<br><br>;; QUESTION SECTION:<br>;24.75.233.165.in-addr.arpa. IN PTR<br><br>;; Query time: 577 msec<br>;; SERVER: 8.8.8.8#53(8.8.8.8)<br>;; WHEN: Mon Jan 18 18:32:30 2010<br>
;; MSG SIZE rcvd: 44<br><br><br>real 0m0.585s<br>user 0m0.008s<br>sys 0m0.001s<br><br>Thanks again<br><br>Cheers<br><br>Gareth<br><br><div class="gmail_quote">On Fri, Jan 15, 2010 at 8:06 PM, W.C.A. Wijngaards <span dir="ltr"><<a href="mailto:wouter@nlnetlabs.nl">wouter@nlnetlabs.nl</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div class="im">-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA1<br>
<br>
</div>Hi Gareth,<br>
<br>
The lookup is really taking very long and unbound assumes that you<br>
should keep waiting for the answer. Unbound does not know what the<br>
timeout of the client is, so cannot tell it servfail.<br>
<br>
Perhaps the clients should have longer timeouts? Or how else can they<br>
insist on an answer within some time? This is not part of the DNS<br>
protocol? They are obviously broken.<br>
<br>
Now, to step back from ranting about broken other stuff, in reality, you<br>
want stuff to work. Right now unbound does not do what you want. What<br>
would work well?<br>
<br>
Best regards,<br>
Wouter<br>
<div class="im"><br>
On 01/15/2010 03:07 PM, Gareth Hopkins wrote:<br>
> Hi,<br>
><br>
> I am in the process of moving a number of caching boxes to unbound.<br>
><br>
> One thing I have noticed is the time it takes for a servfail to get<br>
> generated should a domain not be available/visible.<br>
><br>
> Example.<br>
><br>
> With unbound I get a timeout (which some clients see as the dns server<br>
> failing and not answering)<br>
><br>
</div>> # dig <a href="http://bagmail.com" target="_blank">bagmail.com</a> <<a href="http://bagmail.com" target="_blank">http://bagmail.com</a>> mx @<a href="http://dnscache1-ctn.is.co.za" target="_blank">dnscache1-ctn.is.co.za</a><br>
> <<a href="http://dnscache1-ctn.is.co.za" target="_blank">http://dnscache1-ctn.is.co.za</a>><br>
><br>
> ; <<>> DiG 9.6.1-P2 <<>> <a href="http://bagmail.com" target="_blank">bagmail.com</a> <<a href="http://bagmail.com" target="_blank">http://bagmail.com</a>> mx @unbound_server<br>
<div class="im">> ;; global options: +cmd<br>
> ;; connection timed out; no servers could be reached<br>
><br>
> With our current product I get a servfail.<br>
><br>
</div>> # dig <a href="http://bagmail.com" target="_blank">bagmail.com</a> <<a href="http://bagmail.com" target="_blank">http://bagmail.com</a>> mx @current_cache<br>
><br>
> ; <<>> DiG 9.6.1-P2 <<>> <a href="http://bagmail.com" target="_blank">bagmail.com</a> <<a href="http://bagmail.com" target="_blank">http://bagmail.com</a>> mx<br>
> @<a href="http://dnscache2-ctn.is.co.za" target="_blank">dnscache2-ctn.is.co.za</a> <<a href="http://dnscache2-ctn.is.co.za" target="_blank">http://dnscache2-ctn.is.co.za</a>><br>
<div class="im">> ;; global options: +cmd<br>
> ;; Got answer:<br>
> ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 35397<br>
> ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0<br>
><br>
> ;; QUESTION SECTION:<br>
</div>> ;<a href="http://bagmail.com" target="_blank">bagmail.com</a> <<a href="http://bagmail.com" target="_blank">http://bagmail.com</a>>. IN MX<br>
<div class="im">><br>
> ;; Query time: 5000 msec<br>
><br>
> ;; WHEN: Fri Jan 15 16:00:17 2010<br>
> ;; MSG SIZE rcvd: 29<br>
><br>
> The issue with this specific domain is the NS servers, ns1 and<br>
</div>> <a href="http://ns2.goldkey.com" target="_blank">ns2.goldkey.com</a> <<a href="http://ns2.goldkey.com" target="_blank">http://ns2.goldkey.com</a>> don't exist<br>
><br>
> <a href="http://bagmail.com" target="_blank">bagmail.com</a> <<a href="http://bagmail.com" target="_blank">http://bagmail.com</a>>. 172800 IN NS<br>
> <a href="http://ns1.goldkey.com" target="_blank">ns1.goldkey.com</a> <<a href="http://ns1.goldkey.com" target="_blank">http://ns1.goldkey.com</a>>.<br>
> <a href="http://bagmail.com" target="_blank">bagmail.com</a> <<a href="http://bagmail.com" target="_blank">http://bagmail.com</a>>. 172800 IN NS<br>
> <a href="http://ns2.goldkey.com" target="_blank">ns2.goldkey.com</a> <<a href="http://ns2.goldkey.com" target="_blank">http://ns2.goldkey.com</a>>.<br>
<div class="im">><br>
> unbound-control lookup on that domain shows the following<br>
><br>
</div>> # unbound-control lookup <a href="http://bagmail.com" target="_blank">bagmail.com</a> <<a href="http://bagmail.com" target="_blank">http://bagmail.com</a>><br>
<div class="im">> The following name servers are used for lookup of <a href="http://bagmail.com" target="_blank">bagmail.com</a><br>
</div>> <<a href="http://bagmail.com" target="_blank">http://bagmail.com</a>>.<br>
<div class="im">> ;rrset 84946 2 0 2 0<br>
</div>> <a href="http://bagmail.com" target="_blank">bagmail.com</a> <<a href="http://bagmail.com" target="_blank">http://bagmail.com</a>>. 171346 IN NS<br>
> <a href="http://ns1.goldkey.com" target="_blank">ns1.goldkey.com</a> <<a href="http://ns1.goldkey.com" target="_blank">http://ns1.goldkey.com</a>>.<br>
> <a href="http://bagmail.com" target="_blank">bagmail.com</a> <<a href="http://bagmail.com" target="_blank">http://bagmail.com</a>>. 171346 IN NS<br>
> <a href="http://ns2.goldkey.com" target="_blank">ns2.goldkey.com</a> <<a href="http://ns2.goldkey.com" target="_blank">http://ns2.goldkey.com</a>>.<br>
<div class="im">> ;rrset 84946 1 0 1 0<br>
</div>> <a href="http://ns2.goldkey.com" target="_blank">ns2.goldkey.com</a> <<a href="http://ns2.goldkey.com" target="_blank">http://ns2.goldkey.com</a>>. 171346 IN A<br>
<div class="im">> 206.83.79.29<br>
> ;rrset 84946 1 0 1 0<br>
</div>> <a href="http://ns1.goldkey.com" target="_blank">ns1.goldkey.com</a> <<a href="http://ns1.goldkey.com" target="_blank">http://ns1.goldkey.com</a>>. 171346 IN A<br>
<div class="im">> 64.95.64.222<br>
> Delegation with 2 names, of which 2 can be examined to query further<br>
> addresses.<br>
> It provides 2 IP addresses.<br>
> 64.95.64.222 rtt 120000 msec, 12 lost. noEDNS probed.<br>
> 206.83.79.29 rtt 120000 msec, 17 lost. noEDNS probed.<br>
><br>
> Is there anyway to get unbound to return a servfail straight away ?<br>
><br>
> Thanks<br>
><br>
> Gareth<br>
><br>
><br>
><br>
</div><div class="im">> _______________________________________________<br>
> Unbound-users mailing list<br>
> <a href="mailto:Unbound-users@unbound.net">Unbound-users@unbound.net</a><br>
> <a href="http://unbound.nlnetlabs.nl/mailman/listinfo/unbound-users" target="_blank">http://unbound.nlnetlabs.nl/mailman/listinfo/unbound-users</a><br>
<br>
</div><div class="im">-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v1.4.9 (GNU/Linux)<br>
Comment: Using GnuPG with Fedora - <a href="http://enigmail.mozdev.org/" target="_blank">http://enigmail.mozdev.org/</a><br>
<br>
</div>iEYEARECAAYFAktQrrAACgkQkDLqNwOhpPiVZACdGriPMzrMz8B33NbPqlCpLWu0<br>
x54Ani+tQFPNMip878rnwrjWKmMbDioS<br>
=c0s1<br>
-----END PGP SIGNATURE-----<br>
<div><div></div><div class="h5">_______________________________________________<br>
Unbound-users mailing list<br>
<a href="mailto:Unbound-users@unbound.net">Unbound-users@unbound.net</a><br>
<a href="http://unbound.nlnetlabs.nl/mailman/listinfo/unbound-users" target="_blank">http://unbound.nlnetlabs.nl/mailman/listinfo/unbound-users</a><br>
</div></div></blockquote></div><br>