<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=koi8-r">
</head>
<body>
Thanks Wouter, I've found issue.<br>
Shame on me, there was rough/lost DNS server in network. <br>
<br>
Thank you once more.
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>От:</b> Wouter Wijngaards <wouter@nlnetlabs.nl><br>
<b>Отправлено:</b> 17 апреля 2020 г. 16:19:14<br>
<b>Кому:</b> Юрий Иванов <format_hub@outlook.com>; unbound-users@lists.nlnetlabs.nl <unbound-users@lists.nlnetlabs.nl><br>
<b>Тема:</b> Re: Unbound returns incorrect results</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">Hi,<br>
<br>
So your server has the correct .159 answer for mysite.net. But unbound<br>
must have had this lookup value from somewhere. That returned .203 and<br>
is also a name server for mysite.net.<br>
<br>
You can check the other nameservers for mysite.net for their response.<br>
Or have unbound with verbosity 4 (or more) and that prints the<br>
individual answers as unbound receives it. Start unbound again to make<br>
it perform a new lookup and get the logs, then search for the .203<br>
address and see where unbound got it from. (which is then one of the<br>
nameservers for mysite.net).<br>
<br>
Best regards, Wouter<br>
<br>
On 17/04/2020 15:13, Юрий Иванов wrote:<br>
> Thanks for reply.<br>
> I see but this how looks query to mysite.net:<br>
> <br>
> :~$ dig @1.204.196.130 mysite.net <br>
> <br>
> ; <<>> DiG 9.11.5-P4-5.1ubuntu2.1-Ubuntu <<>> @1.204.196.130 mysite.net<br>
> ; (1 server found)<br>
> ;; global options: +cmd<br>
> ;; Got answer:<br>
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4437<br>
> ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 4<br>
> <br>
> ;; OPT PSEUDOSECTION:<br>
> ; EDNS: version: 0, flags:; udp: 4096<br>
> ;; QUESTION SECTION:<br>
> ;mysite.net. IN A<br>
> <br>
> ;; ANSWER SECTION:<br>
> mysite.net. 10800 IN A 1.2.25.159<br>
> <br>
> ;; AUTHORITY SECTION:<br>
> mysite.net. 10800 IN NS ns2.mysite.net.<br>
> mysite.net. 10800 IN NS ns4.mysite.net.<br>
> mysite.net. 10800 IN NS ns1.mysite.net.<br>
> <br>
> ;; ADDITIONAL SECTION:<br>
> ns1.mysite.net. 10800 IN A 1.204.196.130<br>
> ns2.mysite.net. 10800 IN A 1.2.25.199<br>
> ns4.mysite.net. 10800 IN A 1.204.196.200<br>
> <br>
> ;; Query time: 0 msec<br>
> ;; SERVER: 1.204.196.130#53(1.204.196.130)<br>
> ;; WHEN: Птн апр 17 15:59:26 EEST 2020<br>
> ;; MSG SIZE rcvd: 160<br>
> <br>
> cache returns<br>
> :~$ dig @1.204.196.202 mysite.net <br>
> <br>
> ; <<>> DiG 9.11.5-P4-5.1ubuntu2.1-Ubuntu <<>> @1.204.196.202 mysite.net<br>
> ; (1 server found)<br>
> ;; global options: +cmd<br>
> ;; Got answer:<br>
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2039<br>
> ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1<br>
> <br>
> ;; OPT PSEUDOSECTION:<br>
> ; EDNS: version: 0, flags:; udp: 4096<br>
> ;; QUESTION SECTION:<br>
> ;mysite.net. IN A<br>
> <br>
> ;; ANSWER SECTION:<br>
> mysite.net. 2298 IN A 1.204.196.203<br>
> <br>
> ;; Query time: 0 msec<br>
> ;; SERVER: 1.204.196.202#53(1.204.196.202)<br>
> ;; WHEN: Птн апр 17 16:11:35 EEST 2020<br>
> ;; MSG SIZE rcvd: 58<br>
> <br>
> My zone doesnt have this IP binded to 203<br>
> <br>
> [root@ns1 named]# grep 203 mysite.net <br>
> forum IN A 1.204.196.203<br>
> lang IN A 1.204.196.203<br>
> <br>
> Thanks in advance.<br>
> ------------------------------------------------------------------------<br>
> *От:* Unbound-users <unbound-users-bounces@lists.nlnetlabs.nl> от имени<br>
> Wouter Wijngaards via Unbound-users <unbound-users@lists.nlnetlabs.nl><br>
> *Отправлено:* 17 апреля 2020 г. 15:46<br>
> *Кому:* unbound-users@lists.nlnetlabs.nl <unbound-users@lists.nlnetlabs.nl><br>
> *Тема:* Re: Unbound returns incorrect results<br>
> <br>
> Hi,<br>
> <br>
> On 17/04/2020 14:34, Юрий Иванов via Unbound-users wrote:<br>
>> Hi<br>
>> My unbound returns incorrect results<br>
>> <br>
>> Unboud returns .203 IP<br>
> <br>
> Unbound looks up the target of the CNAME by itself, this is necessary<br>
> for security reasons for caching the correct data for that name. The<br>
> lookup for that returned the .203 IP. So that is the correct answer.<br>
> <br>
> The original server was not returning the correct information. It must<br>
> return the same IP address for 'mysite.net' as when the DNS is queried<br>
> directly for the name. For security reasons, unbound queries for all<br>
> CNAME answers for the target name, to look it up directly, to make sure<br>
> it gets the correct information in cache.<br>
> <br>
> In the print out you are missing a direct dig query for the 'mysite.net'<br>
> record, that would (apparantly because unbound finds it) return the .203<br>
> IP address. If I query for the names over here I get different results.<br>
> Since you say it was half a year ago .203, perhaps the .203 is still<br>
> there and returned for direct lookups for 'mysite.net' and this causes<br>
> it. If so, fix it so that the authoritative servers for 'mysite.net'<br>
> return the .203 answer for the name mysite.net.<br>
> <br>
> Best regards, Wouter<br>
> <br>
>> suser@gong:~$ dig @1.204.196.202 <a href="http://www.mysite.net">www.mysite.net</a> <<a href="http://www.mysite.net">http://www.mysite.net</a>><br>
>> <br>
>> ; <<>> DiG 9.11.5-P4-5.1ubuntu2.1-Ubuntu <<>> @1.204.196.202 <a href="http://www.mysite.net">
www.mysite.net</a> <<a href="http://www.mysite.net">http://www.mysite.net</a>><br>
>> ; (1 server found)<br>
>> ;; global options: +cmd<br>
>> ;; Got answer:<br>
>> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2722<br>
>> ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1<br>
>> <br>
>> ;; OPT PSEUDOSECTION:<br>
>> ; EDNS: version: 0, flags:; udp: 4096<br>
>> ;; QUESTION SECTION:<br>
>> ;www.mysite.net. IN A<br>
>> <br>
>> ;; ANSWER SECTION:<br>
>> <a href="http://www.mysite.net">www.mysite.net</a> <<a href="http://www.mysite.net">http://www.mysite.net</a>>. 4275 IN CNAME <br>
> mysite.net.<br>
>> mysite.net. 5048 IN A 1.204.196.203<br>
>> <br>
>> <br>
>> But my authoritative DNS server returns:<br>
>> <br>
>> suser@gong:~$ dig @1.204.196.130 <a href="http://www.mysite.net">www.mysite.net</a> <<a href="http://www.mysite.net">http://www.mysite.net</a>> <br>
>> <br>
>> ; <<>> DiG 9.11.5-P4-5.1ubuntu2.1-Ubuntu <<>> @1.204.196.130 <a href="http://www.mysite.net">
www.mysite.net</a> <<a href="http://www.mysite.net">http://www.mysite.net</a>><br>
>> ; (1 server found)<br>
>> ;; global options: +cmd<br>
>> ;; Got answer:<br>
>> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58582<br>
>> ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 3, ADDITIONAL: 4<br>
>> <br>
>> ;; OPT PSEUDOSECTION:<br>
>> ; EDNS: version: 0, flags:; udp: 4096<br>
>> ;; QUESTION SECTION:<br>
>> ;www.mysite.net. IN A<br>
>> <br>
>> ;; ANSWER SECTION:<br>
>> <a href="http://www.mysite.net">www.mysite.net</a> <<a href="http://www.mysite.net">http://www.mysite.net</a>>. 10800 IN CNAME <br>
> mysite.net.<br>
>> mysite.net. 10800 IN A 1.2.25.159<br>
>> <br>
>> ;; AUTHORITY SECTION:<br>
>> mysite.net. 10800 IN NS ns4.mysite.net.<br>
>> mysite.net. 10800 IN NS ns1.mysite.net.<br>
>> mysite.net. 10800 IN NS ns2.mysite.net.<br>
>> <br>
>> ;; ADDITIONAL SECTION:<br>
>> ns1.mysite.net. 10800 IN A 1.204.196.130<br>
>> ns2.mysite.net. 10800 IN A 1.2.25.199<br>
>> ns4.mysite.net. 10800 IN A 1.204.196.200<br>
>> <br>
>> ;; Query time: 0 msec<br>
>> ;; SERVER: 1.204.196.130#53(1.204.196.130)<br>
>> ;; WHEN: Птн апр 17 15:30:39 EEST 2020<br>
>> ;; MSG SIZE rcvd: 178<br>
>> <br>
>> and google returns correct records:<br>
>> <br>
>> suser@gong:~$ dig @8.8.8.8 <a href="http://www.mysite.net">www.mysite.net</a> <<a href="http://www.mysite.net">http://www.mysite.net</a>> <br>
>> <br>
>> ; <<>> DiG 9.11.5-P4-5.1ubuntu2.1-Ubuntu <<>> @8.8.8.8 <a href="http://www.mysite.net">
www.mysite.net</a> <<a href="http://www.mysite.net">http://www.mysite.net</a>><br>
>> ; (1 server found)<br>
>> ;; global options: +cmd<br>
>> ;; Got answer:<br>
>> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6220<br>
>> ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1<br>
>> <br>
>> ;; OPT PSEUDOSECTION:<br>
>> ; EDNS: version: 0, flags:; udp: 512<br>
>> ;; QUESTION SECTION:<br>
>> ;www.mysite.net. IN A<br>
>> <br>
>> ;; ANSWER SECTION:<br>
>> <a href="http://www.mysite.net">www.mysite.net</a> <<a href="http://www.mysite.net">http://www.mysite.net</a>>. 1842 IN CNAME <br>
> mysite.net.<br>
>> mysite.net. 1842 IN A 1.2.25.159<br>
>> <br>
>> ;; Query time: 46 msec<br>
>> ;; SERVER: 8.8.8.8#53(8.8.8.8)<br>
>> ;; WHEN: Птн апр 17 15:30:05 EEST 2020<br>
>> ;; MSG SIZE rcvd: 76<br>
>> <br>
>> <br>
>> This 1.204.196.203 was valid IP about half a year ago.<br>
>> Can't find where it comes from.<br>
>> This is new clean unbound setup installed two days ago.<br>
</div>
</span></font></div>
</body>
</html>