<html><head></head><body>Sounds like a bug in host(1), which has been deprecated for several years now. Recommended solution: switch to "dig +short" instead.<br>
-Adam<br><br><div class="gmail_quote">On November 21, 2016 3:57:42 AM CST, Trevor Cordes <trevor@tecnopolis.ca> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail">I'm seeing some weird behaviour related to AAAA and delegation I'd like to <br />correct with a BIND DNS setup. I have no AAAA records anywhere. Some <br />lookup tools/libraries insist on looking up AAAA, I want them to fail <br />immediately. All servers/clients involved are run with the -4 option to <br />run all traffic over IPv4.<br /><br />The problem is that I'm seeing occassional lookup delays for AAAA records <br />on some boxes (the ones that delegate), but not other ones (every other <br />box).<br /><br />On my box (BOX1) I'm authoritative for <a href="http://foo.com">foo.com</a> (only for my internal <br />networks).<br />On the same box, I delegate <a href="http://sub.foo.com">sub.foo.com</a> to <a href="http://ns.com">ns.com</a> (BOX2).<br /><br />BOX2 is authoritative for <a href="http://foo.com">foo.com</a> and <a href="http://sub.foo.com">sub.foo.com</a>. I do this so BOX1 can <br />have local dynamic DNS for local Windows boxes, etc, on <a
href="http://foo.com">foo.com</a>. Whereas <br />the BOX2 view is for the whole world, to which I don't want to share the <br />existence of <a href="http://windows.foo.com">windows.foo.com</a>, etc. A bit messy, but this has worked for <br />me for 15 years.<br /><br />The problem symptoms:<br /><br />I run "host <a href="http://bar.sub.foo.com">bar.sub.foo.com</a> " on the boxes:<br /><br />BOX1:<br /><a href="http://bar.sub.foo.com">bar.sub.foo.com</a> has address <a href="http://1.2.3.4">1.2.3.4</a><br />Host <a href="http://bar.sub.foo.com">bar.sub.foo.com</a> not found: 2(SERVFAIL)<br /><a href="http://bar.sub.foo.com">bar.sub.foo.com</a> mail is handled by 5 <a href="http://bar.sub.foo.com">bar.sub.foo.com</a>.<br /><often delays 5-10sec before giving the SERVFAIL<br /><br />BOX2 (and every other box in the world except BOX1!!):<br /><a href="http://bar.sub.foo.com">bar.sub.foo.com</a> has address <a href="http://1.2.3.4">1.2.3.4</a><br /><a
href="http://bar.sub.foo.com">bar.sub.foo.com</a> mail is handled by 5 <a href="http://bar.sub.foo.com">bar.sub.foo.com</a>.<br /><br />I don't want the delay or the SERVFAIL on BOX1.<br /><br />The host command by default does a lookup of AA, AAAA and MX in that <br />order. That's fine. But I want them all to run without delay, and the <br />AAAA to be ignored like it is on BOX2. Again, there are no AAAA records <br />in any of these zone files.<br /><br />I think I'm seeing the precise bug discussed here:<br /><br /><a href="https://tools.ietf.org/html/draft-ietf-dnsop-misbehavior-against-aaaa-00">https://tools.ietf.org/html/draft-ietf-dnsop-misbehavior-against-aaaa-00</a><br />search to: 4.4 Make Lame Delegation<br /><br />That document doesn't seem to provide any solutions.<br /><br />I think the issue is when BOX2 (or any box but BOX1) does a lookup, it <br />checks only with BOX2, sees there's no AAAA and happily ignores AAAA. I <br />think in essence it's like "I'm
BOX2, I'm authoritative and I have no <br />AAAA". host is happy with this.<br /><br />With BOX1, it does a lookup with BOX1's named which recurses out to the <br />delegation on BOX2. BOX2 says the same as it did above, but this time <br />it's talking to BOX1 named, not the host command. BOX1 named must be <br />saying "I thought BOX2 was authoritative, but I find no AAAA so it's not <br />authoritative after all, and I don't know anyone who is so I'm spewing <br />this error SERVFAIL". I'm just guessing here.<br /><br />I want the host command on BOX1 to behave the same as BOX2. Can it be <br />done? I actually was seeing the exact same problem with the <br />nonexistent <a href="http://bar.sub.foo.com">bar.sub.foo.com</a> MX record and I solved it by adding an MX <br />record for it on BOX2. However, I don't want any AAAA record on any box, <br />as none of them have IPv6 addresses! Surely there must be a solution to <br />this weird problem.<br /><br />Possibly relevant
is how dig behaves with different usage:<br /><br /><br />BOX1#dig -tAAAA @localhost <a href="http://bar.sub.foo.com">bar.sub.foo.com</a><br />;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 2619<br />;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1<br /><br />;; QUESTION SECTION:<br />;<a href="http://bar.sub.foo.com">bar.sub.foo.com</a>. IN AAAA<br /><br /><br />BOX1#dig -tAAAA @ns.com <a href="http://bar.sub.foo.com">bar.sub.foo.com</a><br />;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5477<br />;; flags: qr aa <br />rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1<br />;; WARNING: recursion requested but not available<br /><br />;; QUESTION SECTION:<br />;<a href="http://bar.sub.foo.com">bar.sub.foo.com</a>. IN AAAA<br /><br />;; AUTHORITY SECTION:<br /><a href="http://foo.com">foo.com</a>. 86400 IN SOA <a href="http://ns.com">ns.com</a>. 17 1800 300 604800 86400<br /><br /><br />BOX2#dig -tAAAA @localhost <a
href="http://bar.sub.foo.com">bar.sub.foo.com</a><br />**pretty much the same output as above 2nd example, NOERROR**<br />BOX2#dig -tAAAA @ns.com <a href="http://bar.sub.foo.com">bar.sub.foo.com</a><br />**pretty much the same output as above 2nd example, NOERROR**<br /><br /><br />It's that SERVFAIL in example dig #1 above that I want to eliminate, and <br />thus also the SERVFAIL with host.<br /><br />Thanks!<br /><hr /><br />Roundtable mailing list<br />Roundtable@muug.ca<br /><a href="https://muug.ca/mailman/listinfo/roundtable">https://muug.ca/mailman/listinfo/roundtable</a><br /></pre></blockquote></div><br>
-- <br>
Sent from my Android device with K-9 Mail. Please excuse my brevity.</body></html>