<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=koi8-r">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks for reply.</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I see but this how looks query to <span>mysite.net</span>:</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span>:~$ dig @1.204.196.130 mysite.net <br>
</span>
<div><br>
</div>
<div>; <<>> DiG 9.11.5-P4-5.1ubuntu2.1-Ubuntu <<>> @1.204.196.130 mysite.net<br>
</div>
<div>; (1 server found)<br>
</div>
<div>;; global options: +cmd<br>
</div>
<div>;; Got answer:<br>
</div>
<div>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4437<br>
</div>
<div>;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 4<br>
</div>
<div><br>
</div>
<div>;; OPT PSEUDOSECTION:<br>
</div>
<div>; EDNS: version: 0, flags:; udp: 4096<br>
</div>
<div>;; QUESTION SECTION:<br>
</div>
<div>;mysite.net. IN A<br>
</div>
<div><br>
</div>
<div>;; ANSWER SECTION:<br>
</div>
<div>mysite.net. 10800 IN A 1.2.25.159<br>
</div>
<div><br>
</div>
<div>;; AUTHORITY SECTION:<br>
</div>
<div>mysite.net. 10800 IN NS ns2.mysite.net.<br>
</div>
<div>mysite.net. 10800 IN NS ns4.mysite.net.<br>
</div>
<div>mysite.net. 10800 IN NS ns1.mysite.net.<br>
</div>
<div><br>
</div>
<div>;; ADDITIONAL SECTION:<br>
</div>
<div>ns1.mysite.net. 10800 IN A 1.204.196.130<br>
</div>
<div>ns2.mysite.net. 10800 IN A 1.2.25.199<br>
</div>
<div>ns4.mysite.net. 10800 IN A 1.204.196.200<br>
</div>
<div><br>
</div>
<div>;; Query time: 0 msec<br>
</div>
<div>;; SERVER: 1.204.196.130#53(1.204.196.130)<br>
</div>
<div>;; WHEN: Птн апр 17 15:59:26 EEST 2020<br>
</div>
<div>;; MSG SIZE rcvd: 160</div>
<div><br>
</div>
<div>cache returns</div>
<div><span>:~$ dig @1.204.196.202 mysite.net <br>
</span>
<div><br>
</div>
<div>; <<>> DiG 9.11.5-P4-5.1ubuntu2.1-Ubuntu <<>> @1.204.196.202 mysite.net<br>
</div>
<div>; (1 server found)<br>
</div>
<div>;; global options: +cmd<br>
</div>
<div>;; Got answer:<br>
</div>
<div>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2039<br>
</div>
<div>;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1<br>
</div>
<div><br>
</div>
<div>;; OPT PSEUDOSECTION:<br>
</div>
<div>; EDNS: version: 0, flags:; udp: 4096<br>
</div>
<div>;; QUESTION SECTION:<br>
</div>
<div>;mysite.net. IN A<br>
</div>
<div><br>
</div>
<div>;; ANSWER SECTION:<br>
</div>
<div>mysite.net. 2298 IN A 1.204.196.203<br>
</div>
<div><br>
</div>
<div>;; Query time: 0 msec<br>
</div>
<div>;; SERVER: 1.204.196.202#53(1.204.196.202)<br>
</div>
<div>;; WHEN: Птн апр 17 16:11:35 EEST 2020<br>
</div>
<span>;; MSG SIZE rcvd: 58</span><br>
</div>
<div><br>
</div>
<span></span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span>My zone doesnt have this IP binded to 203<br>
</span>
<div><br>
</div>
<div>[root@ns1 named]# grep 203 mysite.net <br>
</div>
<div>forum IN A 1.204.196.203<br>
</div>
<span>lang IN A 1.204.196.203</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span><br>
</span></div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span>Thanks in advance.</span><br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>От:</b> Unbound-users <unbound-users-bounces@lists.nlnetlabs.nl> от имени Wouter Wijngaards via Unbound-users <unbound-users@lists.nlnetlabs.nl><br>
<b>Отправлено:</b> 17 апреля 2020 г. 15:46<br>
<b>Кому:</b> unbound-users@lists.nlnetlabs.nl <unbound-users@lists.nlnetlabs.nl><br>
<b>Тема:</b> Re: Unbound returns incorrect results</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">Hi,<br>
<br>
On 17/04/2020 14:34, Юрий Иванов via Unbound-users wrote:<br>
> Hi<br>
> My unbound returns incorrect results<br>
> <br>
> Unboud returns .203 IP<br>
<br>
Unbound looks up the target of the CNAME by itself, this is necessary<br>
for security reasons for caching the correct data for that name. The<br>
lookup for that returned the .203 IP. So that is the correct answer.<br>
<br>
The original server was not returning the correct information. It must<br>
return the same IP address for 'mysite.net' as when the DNS is queried<br>
directly for the name. For security reasons, unbound queries for all<br>
CNAME answers for the target name, to look it up directly, to make sure<br>
it gets the correct information in cache.<br>
<br>
In the print out you are missing a direct dig query for the 'mysite.net'<br>
record, that would (apparantly because unbound finds it) return the .203<br>
IP address. If I query for the names over here I get different results.<br>
Since you say it was half a year ago .203, perhaps the .203 is still<br>
there and returned for direct lookups for 'mysite.net' and this causes<br>
it. If so, fix it so that the authoritative servers for 'mysite.net'<br>
return the .203 answer for the name mysite.net.<br>
<br>
Best regards, Wouter<br>
<br>
> suser@gong:~$ dig @1.204.196.202 <a href="http://www.mysite.net">www.mysite.net</a><br>
> <br>
> ; <<>> DiG 9.11.5-P4-5.1ubuntu2.1-Ubuntu <<>> @1.204.196.202 <a href="http://www.mysite.net">
www.mysite.net</a><br>
> ; (1 server found)<br>
> ;; global options: +cmd<br>
> ;; Got answer:<br>
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2722<br>
> ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1<br>
> <br>
> ;; OPT PSEUDOSECTION:<br>
> ; EDNS: version: 0, flags:; udp: 4096<br>
> ;; QUESTION SECTION:<br>
> ;www.mysite.net. IN A<br>
> <br>
> ;; ANSWER SECTION:<br>
> <a href="http://www.mysite.net">www.mysite.net</a>. 4275 IN CNAME mysite.net.<br>
> mysite.net. 5048 IN A 1.204.196.203<br>
> <br>
> <br>
> But my authoritative DNS server returns:<br>
> <br>
> suser@gong:~$ dig @1.204.196.130 <a href="http://www.mysite.net">www.mysite.net</a> <br>
> <br>
> ; <<>> DiG 9.11.5-P4-5.1ubuntu2.1-Ubuntu <<>> @1.204.196.130 <a href="http://www.mysite.net">
www.mysite.net</a><br>
> ; (1 server found)<br>
> ;; global options: +cmd<br>
> ;; Got answer:<br>
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58582<br>
> ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 3, ADDITIONAL: 4<br>
> <br>
> ;; OPT PSEUDOSECTION:<br>
> ; EDNS: version: 0, flags:; udp: 4096<br>
> ;; QUESTION SECTION:<br>
> ;www.mysite.net. IN A<br>
> <br>
> ;; ANSWER SECTION:<br>
> <a href="http://www.mysite.net">www.mysite.net</a>. 10800 IN CNAME mysite.net.<br>
> mysite.net. 10800 IN A 1.2.25.159<br>
> <br>
> ;; AUTHORITY SECTION:<br>
> mysite.net. 10800 IN NS ns4.mysite.net.<br>
> mysite.net. 10800 IN NS ns1.mysite.net.<br>
> mysite.net. 10800 IN NS ns2.mysite.net.<br>
> <br>
> ;; ADDITIONAL SECTION:<br>
> ns1.mysite.net. 10800 IN A 1.204.196.130<br>
> ns2.mysite.net. 10800 IN A 1.2.25.199<br>
> ns4.mysite.net. 10800 IN A 1.204.196.200<br>
> <br>
> ;; Query time: 0 msec<br>
> ;; SERVER: 1.204.196.130#53(1.204.196.130)<br>
> ;; WHEN: Птн апр 17 15:30:39 EEST 2020<br>
> ;; MSG SIZE rcvd: 178<br>
> <br>
> and google returns correct records:<br>
> <br>
> suser@gong:~$ dig @8.8.8.8 <a href="http://www.mysite.net">www.mysite.net</a> <br>
> <br>
> ; <<>> DiG 9.11.5-P4-5.1ubuntu2.1-Ubuntu <<>> @8.8.8.8 <a href="http://www.mysite.net">
www.mysite.net</a><br>
> ; (1 server found)<br>
> ;; global options: +cmd<br>
> ;; Got answer:<br>
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6220<br>
> ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1<br>
> <br>
> ;; OPT PSEUDOSECTION:<br>
> ; EDNS: version: 0, flags:; udp: 512<br>
> ;; QUESTION SECTION:<br>
> ;www.mysite.net. IN A<br>
> <br>
> ;; ANSWER SECTION:<br>
> <a href="http://www.mysite.net">www.mysite.net</a>. 1842 IN CNAME mysite.net.<br>
> mysite.net. 1842 IN A 1.2.25.159<br>
> <br>
> ;; Query time: 46 msec<br>
> ;; SERVER: 8.8.8.8#53(8.8.8.8)<br>
> ;; WHEN: Птн апр 17 15:30:05 EEST 2020<br>
> ;; MSG SIZE rcvd: 76<br>
> <br>
> <br>
> This 1.204.196.203 was valid IP about half a year ago.<br>
> Can't find where it comes from.<br>
> This is new clean unbound setup installed two days ago.<br>
</div>
</span></font></div>
</body>
</html>