<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div></div><div><br></div><div><br></div><div><div><b># dig 158.24.39.46.<a href="http://zen.spamhaus.org">zen.spamhaus.org</a>. @<a href="http://a.ns.spamhaus.org">a.ns.spamhaus.org</a>.</b></div><div><br></div><div>; <<>> DiG 9.9.4-rpz2.13269.14-P2 <<>> 158.24.39.46.<a href="http://zen.spamhaus.org">zen.spamhaus.org</a>. @<a href="http://a.ns.spamhaus.org">a.ns.spamhaus.org</a>.</div><div>;; global options: +cmd</div><div>;; Got answer:</div><div>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46513</div><div>;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0</div><div>;; WARNING: recursion requested but not available</div><div><br></div><div>;; QUESTION SECTION:</div><div>;158.24.39.46.<a href="http://zen.spamhaus.org">zen.spamhaus.org</a>.<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre"> </span>A</div><div><br></div><div>;; ANSWER SECTION:</div><div>158.24.39.46.<a href="http://zen.spamhaus.org">zen.spamhaus.org</a>. 900 IN<span class="Apple-tab-span" style="white-space:pre"> </span>A<span class="Apple-tab-span" style="white-space:pre"> </span>127.0.0.11</div><div>158.24.39.46.<a href="http://zen.spamhaus.org">zen.spamhaus.org</a>. 900 IN<span class="Apple-tab-span" style="white-space:pre"> </span>A<span class="Apple-tab-span" style="white-space:pre"> </span>127.0.0.4</div><div><br></div><div>;; Query time: 25 msec</div><div>;; SERVER: 217.149.192.170#53(217.149.192.170)</div><div>;; WHEN: Sun Jul 27 20:22:08 CEST 2014</div><div>;; MSG SIZE rcvd: 79</div><div><br></div><div><br></div><div><b># dig 158.24.39.46.<a href="http://zen.spamhaus.org">zen.spamhaus.org</a></b></div><div><br></div><div>; <<>> DiG 9.9.4-rpz2.13269.14-P2 <<>> 158.24.39.46.<a href="http://zen.spamhaus.org">zen.spamhaus.org</a></div><div>;; global options: +cmd</div><div>;; Got answer:</div><div>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1310</div><div>;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1</div><div><br></div><div>;; OPT PSEUDOSECTION:</div><div>; EDNS: version: 0, flags:; udp: 4096</div><div>;; QUESTION SECTION:</div><div>;158.24.39.46.<a href="http://zen.spamhaus.org">zen.spamhaus.org</a>.<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre"> </span>A</div><div><br></div><div>;; ANSWER SECTION:</div><div>158.24.39.46.<a href="http://zen.spamhaus.org">zen.spamhaus.org</a>. 3408 IN<span class="Apple-tab-span" style="white-space:pre"> </span>A<span class="Apple-tab-span" style="white-space:pre"> </span>127.0.0.11</div><div>158.24.39.46.<a href="http://zen.spamhaus.org">zen.spamhaus.org</a>. 3408 IN<span class="Apple-tab-span" style="white-space:pre"> </span>A<span class="Apple-tab-span" style="white-space:pre"> </span>127.0.0.4</div><div><br></div><div>;; Query time: 0 msec</div><div>;; SERVER: 127.0.0.1#53(127.0.0.1)</div><div>;; WHEN: Sun Jul 27 20:22:19 CEST 2014</div><div>;; MSG SIZE rcvd: 90</div><div><br></div></div><div><br></div><div><br></div><div><br></div><br>
<br><div><div>On Jul 27, 2014, at 10:36 AM, Carsten Strotmann <<a href="mailto:unbound@strotmann.de">unbound@strotmann.de</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><br>Hello Patrick,<br><br>pcl-associates writes:<br><br><blockquote type="cite">Hi Carsten,<br><br>Unfortunately, the issue is not limited to nslookup. Here's what I<br>get when I run the same dig command you did below.<br></blockquote><br>Yes do not get what you've expected, but the dig output gives much<br>better information (see below).<br><br><blockquote type="cite"> Evidently<br>something isn't right because my results should match yours. <br></blockquote><br><blockquote type="cite">In a<br>separate email, Chris asked if I was using this as a forwarder or<br>resolver. I am using it as an authoritative, validating, recursive<br>caching dns server as described here:<br><a href="https://calomel.org/unbound_dns.html">https://calomel.org/unbound_dns.html</a>.<br><br></blockquote><br>That page is a little outdated (covers Unbound 1.4.9, current is<br>1.4.22). Also, you are probably running Unbound as a validating,<br>recursive caching DNS server, as Unbound is not designed to be an<br>authoritative server (that would be a NSD or BIND 9 or PowerDNS<br>...). The <a href="http://calomel.org">calomel.org</a> websites just defines these DNS terms.<br><br>Could you share your "unbound.conf" with this list?<br><br>You have a forwarding server if you have configuration lines with<br>"forward-zone:" in your configuration. Usually it is recommended *NOT*<br>to use forwarding (instead, let your Unbound talk directly to the<br>authoritative DNS servers in the Internet), unless you have a good<br>reason to do so (network topology or firewall-policy).<br><br><blockquote type="cite"># dig 158.24.39.46.<a href="http://zen.spamhaus.org">zen.spamhaus.org</a>.<br><br>; <<>> DiG 9.9.4-rpz2.13269.14-P2 <<>> 158.24.39.46.<a href="http://zen.spamhaus.org">zen.spamhaus.org</a>.<br>;; global options: +cmd<br>;; Got answer:<br>;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 22741<br>;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1<br><br>;; OPT PSEUDOSECTION:<br>; EDNS: version: 0, flags:; udp: 4096<br>;; QUESTION SECTION:<br>;158.24.39.46.<a href="http://zen.spamhaus.org">zen.spamhaus.org</a>.<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre"> </span>A<br><br>;; AUTHORITY SECTION:<br><a href="http://zen.spamhaus.org">zen.spamhaus.org</a>.<span class="Apple-tab-span" style="white-space:pre"> </span>3546<span class="Apple-tab-span" style="white-space:pre"> </span>IN<span class="Apple-tab-span" style="white-space:pre"> </span>SOA<span class="Apple-tab-span" style="white-space:pre"> </span>need.to.know.only. <a href="http://hostmaster.spamhaus.org">hostmaster.spamhaus.org</a>. 1407271350 3600 600 432000 150<br><br>;; Query time: 39 msec<br>;; SERVER: 127.0.0.1#53(127.0.0.1)<br>;; WHEN: Sun Jul 27 15:52:37 CEST 2014<br>;; MSG SIZE rcvd: 122<br><br></blockquote><br>Unlike with your nslookup response, which gave an IPv4 address record<br>back, this response is actually a response saying that the requested<br>domain name does not exist (NXDOMAIN). A very different response.<br><br>Let's try to ask on the the authoritative DNS servers for<br>"<a href="http://zen.spamhaus.org">zen.spamhaus.org</a>". I see:<br><br>% dig 158.24.39.46.<a href="http://zen.spamhaus.org">zen.spamhaus.org</a>. @<a href="http://a.ns.spamhaus.org">a.ns.spamhaus.org</a>. <br><br>; <<>> DiG 9.10.0-P1 <<>><br> 158.24.39.46.<a href="http://zen.spamhaus.org">zen.spamhaus.org</a>. @<a href="http://a.ns.spamhaus.org">a.ns.spamhaus.org</a>.<br>;; global options: +cmd<br>;; Got answer:<br>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22021<br>;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0<br>;; WARNING: recursion requested but not available<br><br>;; QUESTION SECTION:<br>;158.24.39.46.<a href="http://zen.spamhaus.org">zen.spamhaus.org</a>. IN A<br><br>;; ANSWER SECTION:<br>158.24.39.46.<a href="http://zen.spamhaus.org">zen.spamhaus.org</a>. 900 IN A 127.0.0.11<br>158.24.39.46.<a href="http://zen.spamhaus.org">zen.spamhaus.org</a>. 900 IN A 127.0.0.4<br><br>;; Query time: 26 msec<br>;; SERVER: 2001:7b8:3:1f:0:2:53:1#53(2001:7b8:3:1f:0:2:53:1)<br>;; WHEN: Sun Jul 27 19:33:46 CEST 2014<br>;; MSG SIZE rcvd: 79<br><br><br>-- <br>Carsten Strotmann<br>Email: <a href="mailto:cas@strotmann.de">cas@strotmann.de</a><br>Blog: <a href="http://strotmann.de">strotmann.de</a><br><br></blockquote></div><br></body></html>