SBS Unable to resolve domain but Bind can?
A> The domain is 'southbank.blackboard.net'.
No it isn't. The domain name was
"southbank.blackboard.net.MRH.local.", because you didn't use a fully
qualified domain name when you invoked the tool. The output of the
tool in fact told you that this was the domain name:
A> QUESTIONS:
A> southbank.blackboard.net.MRH.local, type = A, class = IN
It's unlikely that you intended such a domain name to exist, so the
fact that it doesn't isn't a problem. The tool then tried another,
simpler, variation on turning the non-fully-qualified name that you
supplied into a fully qualified domain name:
A> QUESTIONS:
A> southbank.blackboard.net, type = A, class = IN
The "server failure" answer, that you received in turn for that, is
because the people who publish the DNS data for "blackboard.net." have
supplied a client-side alias for "southbank.blackboard.net.", pointing
to "southbank.blackboard.com.", that has a time to live of zero
seconds:
> southbank.blackboard.net. 0 IN CNAME southbank.blackboard.com.
> southbank.blackboard.com. 3600 IN A 209.133.75.134
The alias data are expiring from your resolving proxy DNS server's
cache whilst it is trying to obtain the DNS data for the target of the
alias. This only happens the first time that your resolving proxy DNS
server attempts query resolution. The second time (presuming that it
is no longer than 3600 seconds later), your resolving proxy DNS server
will have the target data already cached, it will have no need to
perform additional back-end queries to obtain those data, and so the
alias won't have the opportunity to expire.
This is not your problem. It is theirs. A zero TTL on a client-side
alias is a well-known cause of such difficulties. To quote Mark
Andrews, "Zero is a good way to inflict a DoS on yourself."; and this
is precisely what the people who publish the DNS data for
"blackboard.net." have done to themselves. You might care to tell
them.
|