Squid failed to query DNS

romeo_tango · 08-29-2008, 02:12 AM

Hi, I use Squid Version 2.6.STABLE6 in my server.

I have encountered many pages like this :

Code:

The requested URL could not be retrieved
-----------------------------------------------------------------------------
While trying to retrieve the URL: http://www.google.com/search?

The following error was encountered:

Unable to determine IP address from host name for www.google.com

The dnsserver returned:

Refused: The name server refuses to perform the specified operation.

This means that:

 The cache was not able to resolve the hostname presented in the URL. 

 Check if the address is correct. 

Your cache administrator is root.
-------------------------------------------------------------------------
(squid/2.6.STABLE6)

If I reloaded the page using CTRL + F5, the page will then loading normally. Does somebody already know what is going on here?

Thanks.

salasi · 08-29-2008, 03:40 AM

Quote:

Originally Posted by romeo_tango

The dnsserver returned:
Refused: The name server refuses to perform the specified operation.
This means that:
[FONT="Fixedsys"] The cache was not able to resolve the hostname presented in the URL.

Given that I am tempted to believe that the error message (although it may just be a mis-statement of the condition) means what it says, that sounds like the problem is with the nameserver, or just possibly the interaction between squid and the nameserver.

Have you anyway of observing what the nameserver thinks about this (logs, dig)? What is the nameserver (bind?).

Have you tried with, e.g., wireshark, to see whether the messages suggest that there is a timeout occuring (perhaps the timeout is occuring on the internet side or perhaps it is occuring between the nameserver and squid)?

chort · 08-29-2008, 03:43 AM

What are the contents of /etc/resolv.conf on your proxy server?

romeo_tango · 08-29-2008, 04:19 AM

here are the /etc/resolv.conf contents :

Code:

# cat /etc/resolv.conf 
nameserver 202.x.x.x 
nameserver 202.x.x.x

the DNS is on ISP-side, not local. I have use their DNS in other box which is not behind a proxy and such thing never happened so i do believe that it's not the DNS, perhaps there is a misconfiguration in my firewall or the squid.. hmm..

what made me confused is that thing happening only few times, maybe when peak-traffic times that made things harder to be analyzed.

chort · 08-29-2008, 04:27 AM

For a machine that is going to generate as many DNS requests as a proxy server, it's probably a good idea to run a local caching-only nameserver to increase performance.

As for the error, since the recent patches to BIND, performance has gone down quite a bit. It's not uncommon now for a DNS server to be overloaded with too many recursive queries and not be able to answer new queries. Also due to the port randomization being used, some firewalls are closing the temporary rule to allow UDP responses before the reply actually comes back, but that would result in a time-out error instead of a refused error.

romeo_tango · 08-29-2008, 04:46 AM

hmm.. okay, i'm gonna try to add the local dns first

thanks for your explanation sir..