#StackBounty: #linux #domain-name-system #bind Caching, forwarding Bind 9.9.4 server works for weeks, suddenly SERVFAIL on all queries …

Bounty: 50

I have bind 9.9.5 running on two servers (CentOS 6 and 7), for caching and forwarding DNS queries for a mail server. The servers run fine for weeks, then suddenly respond to all queries with SERVFAIL. The first time it happened, both servers started failing on the same day. Now, a week later, it happened again, but only on one server. Restarting named makes the problem go away.

Here is the important bits of /etc/named.conf (full file with irrelevant bits here):

acl "trusted" {
options {
    listen-on port 53 {;; };
    listen-on-v6 port 53 { ::1; };
    directory               "/var/named";
    dump-file               "/var/named/data/cache_dump.db";
    statistics-file         "/var/named/data/named_stats.txt";
    memstatistics-file      "/var/named/data/named_mem_stats.txt";
    bindkeys-file           "/etc/named.iscdlv.key";
    managed-keys-directory  "/var/named/dynamic";
    auth-nxdomain no;
    version "asdf";

    dnssec-enable       yes;
    dnssec-validation   yes;
    dnssec-lookaside    auto;

    recursion yes;
    forward only;
    forwarders {; };

    allow-query     { trusted; };
    allow-recursion { trusted; };

When the server is in a failing state, a dig query response:

[q@oak3] dig @ apple.com a

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.68.rc1.el6_10.1 <<>> @ apple.com a
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 44811
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;apple.com.         IN  A

;; Query time: 3 msec
;; WHEN: Fri Mar 15 19:22:06 2019
;; MSG SIZE  rcvd: 27

These log entries appear:

==> /var/named/chroot/var/log/queries.log <==
15-Mar-2019 19:22:06.983 client (apple.com): query: apple.com IN A + (

==> /var/named/chroot/var/log/dnssec.log <==
15-Mar-2019 19:22:06.984 validating apple.com/A: bad cache hit (com/DS)

==> /var/named/chroot/var/log/lame-servers.log <==
15-Mar-2019 19:22:06.984 broken trust chain resolving 'apple.com/A/IN':

After restarting named, running the same query (dig @ apple.com a) responds correctly, and there are no errors in the log.

There is nothing relevant logged at the time that queries began failing under /var/logs. The server hasn’t rebooted recently, no updates were installed recently.

Is there any issue with my configuration? What may cause a normally-functioning bind server to suddenly start failing?

Get this bounty!!!

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.