Hi All,
I'm getting hostname resolution failures from docker containers for local DNS records; they seem unable to handle a rather strange response from the Sophos Firewall DNS service.
As far as I can tell, the problem is that the DNS server returns a correct, non-authoritative answer but then also says 'NXDOMAIN'! I'm stumped as to why it would say 'non-existent domain' when it has just successfully resolved the name from an internal DNS record.
I see the same response pattern from other systems, so it's not a docker issue.
The Sophos Firewall is the sole DNS server on the LAN and its domain is the same one as the smtp server being looked up here. Any internal host with a DNS record set up in the Firewall will get the same result - a correct response, followed by 'NXDOMAIN'.
netadmin@adminserver:~$ nslookup smtp.b****e.net
Server: 192.168.11.1
Address: 192.168.11.1#53
Non-authoritative answer:
Name: smtp.b****e.net
Address: 192.168.11.1
** server can't find smtp.b****e.net: NXDOMAIN
Even on the XG console, I get same strange combo of answers:
console> dnslookup host smtp.b****e.net
Domain Name Server# 127.0.0.1
Domain Name # smtp.b****e.net
Resolved Address 1# 192.168.11.1
Total query time # 0.11 msec
can't resolve 'smtp.b****e.net'
The DNS record looks like this:
smtp.b****e.net 192.168.11.1 TTL 60 weight 1 publish to WAN No reverse DNS No
Some of the others have reverse DNS lookup on; makes no difference.
The only internal host I can query without getting 'NXDOMAIN', is the firewall's primary name:
netadmin@adminserver:~$ nslookup gateway
Server: 192.168.11.1
Address: 192.168.11.1#53
Non-authoritative answer:
Name: gateway.b****e.net
Address: 192.168.8.1
Name: gateway.b****e.net
Address: 192.168.11.1
If I look up something that forces it to go to an upstream DNS server, it's fine:
netadmin@adminserver:~$ nslookup ns1.google.com
Server: 192.168.11.1
Address: 192.168.11.1#53
Non-authoritative answer:
Name: ns1.google.com
Address: 216.239.32.10
Name: ns1.google.com
Address: 2001:4860:4802:32::a
Why the NXDOMAIN? Can I stop that happening?
Thanks!
This thread was automatically locked due to age.
