From: Yves-Eric Date: 2009-03-01T13:23:56+09:00 Subject: Re: DNS MX lookup issue: local machine returned as MX for an non-existant domain! On Feb 23, 9:53 pm, Brian Candler wrote: > Also try "dig i-dont-exist-iutjdfuyoxfugy.com mx" - dig is a bit > lower-level than nslookup. > > If you still see the difference between Ruby and dig, then I suggest you > run tcpdump (on both your loopback interface and your external > interface) for udp port 53. > > I suspect this will show something different in the queries, e.g. they > are being sent to different nameservers. Perhaps there is a wildcard MX > record floating around. I tried with dig, but I still see the difference: dig gives me a Non- Existent Domain (NXDOMAIN) status, while Resolv::DNS still wrongly returns my server as valid MX. But I have gather some interesting data, thanks to your suggestion of using tcpdump. Indeed, I can see a difference in activity (see dump pasted below), but I am not quite sure what to make of it... It looks like Resolv::DNS does proceed properly at first, sending an MX query and getting an NXDOMAIN response. But apparently, it is not satisfied by that NXDOMAIN reply, and from there, Resolv::DNS continues with 3 other queries: PTR, [|domain], and another PTR. Have we stumbled upon a bug in Resolv::DNS? I can feel we are getting a little closer to the answer, but I am still quite puzzled by this strange behaviour... Please find below the tcpdump of both the dig and Resolv::DNS queries. Any help with interpreting these results and getting to the root of the issue will be greatly appreciated. --- BEGIN TCPDUMP LOG --- [root@www ~]# tcpdump -ni any port 53 tcpdump: WARNING: Promiscuous mode not supported on the "any" device tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on any, link-type LINUX_SLL (Linux cooked), capture size 96 bytes # dump of dig activity: 12:52:13.186912 IP 119.18.243.83.39721 > 202.45.161.161.domain: 53442+ MX? i-dont-exist-iutjdfuyoxfugy.com. (49) 12:52:13.186916 IP 119.18.243.83.39721 > 202.45.161.161.domain: 53442+ MX? i-dont-exist-iutjdfuyoxfugy.com. (49) 12:52:13.187338 IP 202.45.161.161.domain > 119.18.243.83.39721: 53442 NXDomain 0/1/0 (122) # dump of Resolv::DNS activity: 12:51:57.398419 IP 119.18.243.83.39720 > 202.45.161.161.domain: 0+ MX? i-dont-exist-iutjdfuyoxfugy.com. (49) 12:51:57.398512 IP 119.18.243.83.39720 > 202.45.161.161.domain: 0+ MX? i-dont-exist-iutjdfuyoxfugy.com. (49) 12:51:57.399497 IP 202.45.161.161.domain > 119.18.243.83.39720: 0 NXDomain 0/1/0 (122) 12:51:57.399615 IP 119.18.243.83.39721 > 202.45.161.161.domain: 31798+ PTR? 161.161.45.202.in-addr.arpa. (45) 12:51:57.399616 IP 119.18.243.83.39721 > 202.45.161.161.domain: 31798+ PTR? 161.161.45.202.in-addr.arpa. (45) 12:51:57.400471 IP 202.45.161.161.domain > 119.18.243.83.39721: 31798 1/5/5 (253) 12:51:57.401140 IP 119.18.243.83.39720 > 202.45.161.161.domain: 1+[| domain] 12:51:57.401142 IP 119.18.243.83.39720 > 202.45.161.161.domain: 1+[| domain] 12:51:57.401648 IP 202.45.161.161.domain > 119.18.243.83.39720: 1[| domain] 12:51:57.401742 IP 119.18.243.83.39721 > 202.45.161.161.domain: 32336+ PTR? 161.161.45.202.in-addr.arpa. (45) 12:51:57.401745 IP 119.18.243.83.39721 > 202.45.161.161.domain: 32336+ PTR? 161.161.45.202.in-addr.arpa. (45) 12:51:57.402261 IP 202.45.161.161.domain > 119.18.243.83.39721: 32336 1/5/5 (253) 15 packets captured 19 packets received by filter 0 packets dropped by kernel [root@www ~]# --- END TCPDUMP LOG --- Best regards, -- Yves-Eric