LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Server (https://www.linuxquestions.org/questions/linux-server-73/)
-   -   unexpected RCODE (REFUSED) & (SERVFAIL) (https://www.linuxquestions.org/questions/linux-server-73/unexpected-rcode-refused-and-servfail-915631/)

deathsfriend99 11-26-2011 09:16 AM

unexpected RCODE (REFUSED) & (SERVFAIL)
 
I run a mail server with a caching DNS. The server is debian and BIND9. I am getting a ton of these in my logwatch:

Code:


Query form disallowed client:
    unexpected RCODE (REFUSED) resolving '247.250.236.209.in-addr.arpa/PTR/IN': 209.236.251.114#53: 4 Time(s)
    unexpected RCODE (REFUSED) resolving 'dnsglobal.mantraonline.com/A/IN': 202.56.240.5#53: 1 Time(s)
    unexpected RCODE (REFUSED) resolving '223.45.90.144.in-addr.arpa/PTR/IN': 144.90.136.254#53: 4 Time(s)
    unexpected RCODE (REFUSED) resolving '1.163.245.199.in-addr.arpa/PTR/IN': 139.78.100.1#53: 1 Time(s)
    unexpected RCODE (REFUSED) resolving '62.56.160.14.in-addr.arpa/PTR/IN': 203.162.0.11#53: 4 Time(s)
    unexpected RCODE (SERVFAIL) resolving 'ns01.wl-infra.net/AAAA/IN': 217.70.177.40#53: 4 Time(s)
    unexpected RCODE (REFUSED) resolving 'ns.t-mobile.cz/AAAA/IN': 77.48.254.253#53: 1 Time(s)
    unexpected RCODE (REFUSED) resolving '153.71.226.159.in-addr.arpa/PTR/IN': 159.226.8.28#53: 4 Time(s)
    unexpected RCODE (REFUSED) resolving 'ABTS-TN-dynamic-196.107.164.122.airtelbroadband.in/A/IN': 202.56.240.5#53: 1 Time(s)
    unexpected RCODE (REFUSED) resolving 'iwt.tv/NS/IN': 74.55.69.165#53: 1 Time(s)
    unexpected RCODE (REFUSED) resolving '199.57.102.66.in-addr.arpa/PTR/IN': 208.44.130.120#53: 1 Time(s)
    unexpected RCODE (SERVFAIL) resolving 'fibre.cablebahamas.com/A/IN': 198.6.1.82#53: 1 Time(s)

I suspect that these are spammers hitting my mail server with bogus domains and the DNS is trying to resolve the IP to the domain, it is coming back false, and my mail server drops the message as designed. Am I correct or do I have something misconfigured?

bathory 11-28-2011 02:43 AM

Quote:

I suspect that these are spammers hitting my mail server with bogus domains and the DNS is trying to resolve the IP to the domain, it is coming back false, and my mail server drops the message as designed. Am I correct or do I have something misconfigured?
You're correct. BTW you can stop them from appearing in your logs, by adding:
Code:

category lame-servers {null;};
in the logging section of your named.conf

Regards


All times are GMT -5. The time now is 11:18 PM.