[Outages-discussion] AT&T DNS problems?

[Frank Bulk]

Yes, three out 15 queried in this random list point to the incorrect IP:

http://www.mob.net/~ted/tools/dns.php3?domain=www.ben.edu

http://www.mob.net/~ted/tools/dns.php3?domain=ns1.bobbroadband.com

http://www.mob.net/~ted/tools/dns.php3?domain=ns2.bobbroadband.com

Fortunately the highest TTL seems to be less than 7050 at this time, so
hopefully in two hours everything has cleared up.

 

Frank

 

From: outages-discussion-bounces at outages.org
[mailto:outages-discussion-bounces at outages.org] On Behalf Of Frank Bulk
Sent: Friday, October 26, 2012 8:29 PM
To: 'Tim Huffman'
Cc: outages-discussion at outages.org
Subject: Re: [Outages-discussion] AT&T DNS problems?

 

(Moving off the outages list to discuss):

 

Something is not healthy for the ben.edu when I look at our DNS server
(96.31.0.5):

 

nagios:/# dig NS ben.edu +short 

ns2432.ztomy.com.

ns1432.ztomy.com.

nagios:/#

 

But querying them at Google show good results:

 

nagios:/# dig NS ben.edu +short @8.8.8.8

ns2.bobbroadband.com.

ns1.bobbroadband.com.

nagios:/#

 

Same when I quote ns1.bobbroadband.com:

nagios:/# dig A ns1.bobbroadband.com +short

208.91.197.132

nagios:/# dig A ns2.bobbroadband.com +short

208.91.197.132

 

Good when I look at Google:

nagios:/# dig A ns1.bobbroadband.com +short @8.8.8.8

63.250.224.50

nagios:/# dig A ns2.bobbroadband.com +short @8.8.8.8

63.250.224.66

nagios:/#

 

I'm guessing there was some hijacking or poisoning happened somewhere.

 

Frank

 

From: outages-bounces at outages.org <mailto:outages-bounces at outages.org>
[mailto:outages-bounces at outages.org] On Behalf Of Tim Huffman
Sent: Friday, October 26, 2012 8:04 PM
To: outages at outages.org <mailto:outages at outages.org> 
Subject: [outages] AT&T DNS problems?

 

We are the primary DNS servers for the ben.edu domain. We seem to be having
an issue with an AT&T server that is responding  with incorrect A records
for www.ben.edu <http://www.ben.edu>  and ben.edu.

 

What it SHOULD be the response:

nslookup www.ben.edu <http://www.ben.edu> 

Server:         63.250.224.66

Address:        63.250.224.66#53

 

www.ben.edu <http://www.ben.edu>      canonical name = ben.edu.

Name:   ben.edu

Address: 38.100.120.100

 

What 12.127.17.83 is responding with:

> www.ben.edu <http://www.ben.edu> 

Server:  tbru.br.rs.els-gms.att.net

Address:  12.127.17.83

 

Non-authoritative answer:

Name:    www.ben.edu <http://www.ben.edu> 

Address:  208.91.197.132

 

This appears to be affecting only iPhones and iPads on the AT&T network. Is
anybody else having problems with this? Are there any AT&T people on this
list that can help?

 

 

Tim Huffman
Business Only Broadband
777 Oakmont Lane, Suite 2000, Westmont, IL 60559
Direct: 630.590.6012 | Main: 630.590.6000 | Fax: 630.986.2496 
thuffman at bobbroadband.com <mailto:thuffman at bobbroadband.com>   |
<http://www.bobbroadband.com/> http://www.bobbroadband.com/

Cell:  630.340.1925 | Toll-Free Customer Support:  877.262.4553

   <http://www.linkedin.com/company/business-only-broadband> Follow Us on
LinkedIn  |     <https://twitter.com/#%21/BOBbroadband> Follow Us on Twitter

P please consider the environment prior to printing

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/outages-discussion/attachments/20121026/675fc5b4/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 2480 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/outages-discussion/attachments/20121026/675fc5b4/attachment-0001.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.gif
Type: image/gif
Size: 1287 bytes
Desc: not available
URL: <https://puck.nether.net/pipermail/outages-discussion/attachments/20121026/675fc5b4/attachment-0001.gif>