I have a caching bind server on my local network, with the below entry:
zone "." IN {
type hint;
file "root.hint";
};
The root.hint file is
ftp://ftp.internic.net/domain/named.root
Everything works fine and has been working fine for a long time. But suddenly, within the past day, it returns SERVFAIL for the one doimain archives.gov (e.g.
www.archives.gov).
Lookups of all the other domains and servers work fine. It's just this one that causes a SERVFAIL. If I direct nslookup to use my ISP-provided name server (75.75.75.75) directly, things work. But they should work with my own name server, because everything else works.
Let me re-iterate: lookups of ALL OTHER SERVER NAMES that I've tried work just fine. It's just this one, specific server (or domain?) that is returning SERVFAIL.
Below is some troubleshooting output, but I don't know enough about DNS to make use of the information:
$ dig
www.archives.gov IN
; <<>> DiG 9.11.0-P3 <<>>
www.archives.gov IN
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 63313
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: ff2e05631e7d9753b457eefb58e861c3f5675b5c5ff03058 (good)
;; QUESTION SECTION:
;
www.archives.gov. IN A
;; Query time: 0 msec
;; SERVER: 192.168.2.8#53(192.168.2.8)
;; WHEN: Sat Apr 08 00:06:27 EDT 2017
;; MSG SIZE rcvd: 73
$ dig @75.75.75.75
www.archives.gov IN
; <<>> DiG 9.11.0-P3 <<>> @75.75.75.75
www.archives.gov IN
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 165
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;
www.archives.gov. IN A
;; ANSWER SECTION:
www.archives.gov. 300 IN CNAME dualstack.archives-gov-prod-publicelb-938503165.us-east-1.elb.amazonaws.com.
dualstack.archives-gov-prod-publicelb-938503165.us-east-1.elb.amazonaws.com. 60IN A 34.204.154.234
dualstack.archives-gov-prod-publicelb-938503165.us-east-1.elb.amazonaws.com. 60IN A 34.192.218.114
;; Query time: 48 msec
;; SERVER: 75.75.75.75#53(75.75.75.75)
;; WHEN: Sat Apr 08 00:07:12 EDT 2017
;; MSG SIZE rcvd: 166
The log output of named looks like this:
Apr 08 00:10:44 peter named[2739]: DNS format error from 208.44.130.121#53 resolving
www.archives.gov/A for client 192.168.2.8#54480: too many questions
Apr 08 00:10:44 peter named[2739]: network unreachable resolving 'www.archives.gov/A/IN': 2001:428::7#53
Apr 08 00:10:44 peter named[2739]: network unreachable resolving 'www.archives.gov/A/IN': 2001:428::8#53
Apr 08 00:10:44 peter named[2739]: DNS format error from 63.150.72.5#53 resolving
www.archives.gov/A for client 192.168.2.8#54480: too many questions
Apr 08 00:10:45 peter named[2739]: DNS format error from 208.44.130.121#53 resolving
www.archives.gov/A for client 192.168.2.8#54480: too many questions
Apr 08 00:10:46 peter named[2739]: DNS format error from 63.150.72.5#53 resolving
www.archives.gov/A for client 192.168.2.8#54480: too many questions
Apr 08 00:10:47 peter named[2739]: DNS format error from 208.44.130.121#53 resolving
www.archives.gov/DS: too many questions
Apr 08 00:10:48 peter named[2739]: network unreachable resolving 'www.archives.gov/DS/IN': 2001:428::7#53
Apr 08 00:10:48 peter named[2739]: network unreachable resolving 'www.archives.gov/DS/IN': 2001:428::8#53
Apr 08 00:10:48 peter named[2739]: DNS format error from 63.150.72.5#53 resolving
www.archives.gov/DS: too many questions
Apr 08 00:10:49 peter named[2739]: DNS format error from 208.44.130.121#53 resolving
www.archives.gov/DS: too many questions
Apr 08 00:10:50 peter named[2739]: DNS format error from 63.150.72.5#53 resolving
www.archives.gov/DS: too many questions
Apr 08 00:10:57 peter named[2739]: no valid DS resolving 'www.archives.gov/DS/IN': 208.44.130.121#53
Thank you in advance for taking a look. Can anybody make sense of this?
Let me state once more (because it really is puzzling for me): All other lookups work, except for this one site (which is the National Archives, by the way).
