Hi, we started noticing DNS issues today with the bell.ca domain. From our troubleshooting, it looks like Bell might have turned on EDNS? Is anyone from Bell Canada on this list and can comment? I did tests from our network here at McGill University and all my lookups fail. I also tried on my home connection (Videotron) and that works fine.
From our DNS server:
$ dig +trace www.bell.ca ; <<>> DiG 9.3.6-P1-RedHat-9.3.6-25.P1.el5_11.8 <<>> +trace www.bell.ca ;; global options: printcmd . 513345 IN NS g.root-servers.net. . 513345 IN NS e.root-servers.net. . 513345 IN NS h.root-servers.net. . 513345 IN NS i.root-servers.net. . 513345 IN NS k.root-servers.net. . 513345 IN NS d.root-servers.net. . 513345 IN NS c.root-servers.net. . 513345 IN NS f.root-servers.net. . 513345 IN NS a.root-servers.net. . 513345 IN NS l.root-servers.net. . 513345 IN NS j.root-servers.net. . 513345 IN NS m.root-servers.net. . 513345 IN NS b.root-servers.net. ;; Received 508 bytes from 132.206.44.21#53(132.206.44.21) in 1 ms ca. 172800 IN NS j.ca-servers.ca. ca. 172800 IN NS any.ca-servers.ca. ca. 172800 IN NS c.ca-servers.ca. ca. 172800 IN NS d.ca-servers.ca. ;; Received 254 bytes from 192.203.230.10#53(e.root-servers.net) in 111 ms bell.ca. 86400 IN NS toroon63nszp01.srvr.bell.ca. bell.ca. 86400 IN NS dmog2a.bell.ca. bell.ca. 86400 IN NS dmog1a.bell.ca. bell.ca. 86400 IN NS dcoczd.bell.ca. bell.ca. 86400 IN NS toroondcnszs01.srvr.bell.ca. ;; Received 235 bytes from 192.228.28.9#53(c.ca-servers.ca) in 72 ms www.bell.ca. 86400 IN NS dcosla-b.bell.ca. www.bell.ca. 86400 IN NS dmosla-b.bell.ca. ;; Received 125 bytes from 207.236.176.30#53(toroondcnszs01.srvr.bell.ca) in 8 ms ;; connection timed out; no servers could be reached
From my home connection:
# dig +trace www.bell.ca ; <<>> DiG 9.9.5-9+deb8u7-Raspbian <<>> +trace www.bell.ca ;; global options: +cmd . 3600 IN NS j.root-servers.net. . 3600 IN NS l.root-servers.net. . 3600 IN NS b.root-servers.net. . 3600 IN NS d.root-servers.net. . 3600 IN NS a.root-servers.net. . 3600 IN NS i.root-servers.net. . 3600 IN NS k.root-servers.net. . 3600 IN NS f.root-servers.net. . 3600 IN NS m.root-servers.net. . 3600 IN NS g.root-servers.net. . 3600 IN NS e.root-servers.net. . 3600 IN NS c.root-servers.net. . 3600 IN NS h.root-servers.net. ;; Received 796 bytes from 192.168.0.25#53(192.168.0.25) in 62 ms ca. 172800 IN NS j.ca-servers.ca. ca. 172800 IN NS d.ca-servers.ca. ca. 172800 IN NS c.ca-servers.ca. ca. 172800 IN NS any.ca-servers.ca. ca. 86400 IN DS 35519 8 2 B4542DE49C052EBFB1E6B31AF7B986AF9797484E50A1C96ABEA3523F 83DC134B ca. 86400 IN RRSIG DS 8 1 86400 20161020180000 20161007170000 39291 . AC7rvwO7eGm9QteNXY70YAoR4Zm81oYrPKSVYjktfbpxKLCT6C1UjxUC ladCIcyaRJbFr7Mk91/TGhRhCfGE1Ehlwlib8IB88L302HfB7PhW3fJ1 BGMN2zrAd2QeNpnxqbqZqWNnQuClBWQSzZeTKrI3ahUwvDIg8MwzkzyL pdtn64AryALv3lsduQZ/PsdU+Md25oypKyAOEwCuLKTKt6Vh/lnoR+FS Qd3qJsxqyGl4uImBRwe3ccazkgChiqV/jYLVTYtm2mzd1QALZy0tbiZh a9kbg/b0P0UVPXHPOm2+Y0mglrQVCkk7mMFC9hBP1QNSjpJAVPMC2ESB tC2NPg== ;; Received 600 bytes from 192.5.5.241#53(f.root-servers.net) in 189 ms bell.ca. 86400 IN NS dcoczd.bell.ca. bell.ca. 86400 IN NS toroon63nszp01.srvr.bell.ca. bell.ca. 86400 IN NS dmog2a.bell.ca. bell.ca. 86400 IN NS dmog1a.bell.ca. bell.ca. 86400 IN NS toroondcnszs01.srvr.bell.ca. T8K75I4TJ36JF102O518IR5Q4L99KMQM.ca. 3600 IN NSEC3 1 1 5 - T8L1S50MS4DCSCLENSOVSRENDTDNDGSE NS SOA RRSIG DNSKEY NSEC3PARAM T8K75I4TJ36JF102O518IR5Q4L99KMQM.ca. 3600 IN RRSIG NSEC3 8 2 3600 20161014011525 20161007011525 12748 ca. gHbF719rKQe7BllVjCZuHquJ63g++kyDhssVedbAeyk5rfnEv+aRn2ez m7jmGNOLxqwd89gYPbMAyGCobEfMgtX6/NsnGaAlPem4UGfJtK6kJZR9 EYufP96xqmoRonueaF3+JSVCKMVld9Uq4eGOv8vY2ewfd6CpSsaVAp1z 2zM= MIACHHQ87495D0CEDMSJHA082QKASLAV.ca. 3600 IN NSEC3 1 1 5 - MQ62BD1KAFFAMA1B2OQ3LROF4SRUPR5M NS DS RRSIG MIACHHQ87495D0CEDMSJHA082QKASLAV.ca. 3600 IN RRSIG NSEC3 8 2 3600 20161010161525 20161003161525 12748 ca. UgZ/MQL9BmG90IXUmRNMLBR3kPvsF+F5ZlcFwKNy2CtT3FGKTVNkQikH CQRxfS7+OqrR51WoEWt9fUwjAwVBt39Ld9VLXp7w7ORdpkwl4Z6dx+Ds r6nZfhf0tuaV85s0Yy76AzUNo78Rlf+PYZV6SuoTz21E1SfBTKoJxdLV fTU= ;; Received 729 bytes from 192.228.28.9#53(c.ca-servers.ca) in 67 ms www.bell.ca. 86400 IN NS dmosla-b.bell.ca. www.bell.ca. 86400 IN NS dcosla-b.bell.ca. ;; Received 118 bytes from 198.235.69.155#53(dmog1a.bell.ca) in 24 ms www.bell.ca. 15 IN A 184.150.211.7 ;; Received 45 bytes from 184.150.210.254#53(dmosla-b.bell.ca) in 18 ms
On Oct 7, 2016, at 4:05 PM, Zachary McGibbon via Outages <outages@outages.org> wrote:
Hi, we started noticing DNS issues today with the bell.ca domain. From our troubleshooting, it looks like Bell might have turned on EDNS?
What do you mean, the handling of EDNS 0, or EDNS > 0 ?
Is anyone from Bell Canada on this list and can comment?
I did tests from our network here at McGill University and all my lookups fail. I also tried on my home connection (Videotron) and that works fine.
From our DNS server:
$ dig +trace www.bell.ca
; <<>> DiG 9.3.6-P1-RedHat-9.3.6-25.P1.el5_11.8 <<>> +trace www.bell.ca ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
While RedHat does a lot of back porting of fixes and makes their version numbers often meaningless as a result. Do you know what that translates to for equivalency? Can you use something a bit more modern? Bind 9.3 went EOL in January 2009, so I would try with something else. If you’re on RHEL5 support may have already ended unless you’re out to the March 2017 date. Due to this, please try with something else perhaps? also, consider posting on dns-operations list, you may find a few more insights there. https://ednscomp.isc.org/ednscomp/8a3e3c1092 - Jared
* Jared Mauch via Outages:
; <<>> DiG 9.3.6-P1-RedHat-9.3.6-25.P1.el5_11.8 <<>> +trace www.bell.ca ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
While RedHat does a lot of back porting of fixes and makes their version numbers often meaningless as a result. Do you know what that translates to for equivalency? Can you use something a bit more modern?
Bind 9.3 went EOL in January 2009, so I would try with something else.
It's still supported by Red Hat, but the latest version is bind-9.3.6-25.P1.el5_11.9.
If you’re on RHEL5 support may have already ended unless you’re out to the March 2017 date.
Even on Red Hat Enterprise Linux 5, you can install the bind97-utils package, which will give you a less ancient version. (Obviously, moving to a newer version of the operating system is strongly recommended at this point.)
Due to this, please try with something else perhaps?
Or at least use more realistic dig flags, such as “+norecurse +dnssec +trace +all”. In older versions, dig emulated stub resolver behavior even with “+trace”, so the default flags were pretty useless for testing.
participants (3)
-
Florian Weimer -
Jared Mauch -
Zachary McGibbon