Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 6 replies
  • Subscribers 1 subscriber
  • Views 10838 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

unexpected RCODE (REFUSED)

techuser
Hi 
what is the meaning of  these messages in the DNS log file
unexpected RCODE (REFUSED) resolving 'www-google-analytics.l.google.com/A/IN': ip address#53
unexpected RCODE (REFUSED) resolving 'cffs09.astaro.com/A/IN': ip address#53
unexpected RCODE (REFUSED) resolving 'cffs04.astaro.com/AAAA/IN': ip address#53

the ip address is the ISP proxy
the problem is when this message appears we can't access the internet 

Thanks


This thread was automatically locked due to age.
  • 0
    I haven't seen this.  Normally, I only see "RCODE (REFUSED) resolving" messages where the SMTP Proxy rejected an email because the sender's domain failed the RDNS test.  I'll guess that your 'Content Filter (HTTP)' log shows blocked surf requests at the same time.

    Have you tried using other DNS services?  We use OpenDNS (208.67.220.220 & 208.67.222.222).  You also might try the Google public servers (8.8.8.8 & 8.8.4.4).

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Have you tried using other DNS services?  We use OpenDNS (208.67.220.220 & 208.67.222.222).  You also might try the Google public servers (8.8.8.8 & 8.8.4.4).
    Cheers - Bob


    yes I tried openDNS but still the same problem
    I searched this error and it seems that if the size of the udp packet is bigger than 512 bytes the firewall or proxy can't handle it
    but I don't know how to fix it
  • 0
    I'd be surprised to learn if that's the problem as I haven't seen this before when using the HTTP Proxy.  If you suspect that it's this type of issue, is it possible you have an MTU mismatch?  Maybe you have a NIC that's dying?
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0
    I had the same problem on my Astaro server and found that my problem was the MTU value on my interface.  This article helped me figure it out -- Fixing "unexpected RCODE (SERVFAIL)" and "unexpected RCODE (REFUSED)" - Ansuz - mskala's home page
  • 0 in reply to crum66
    All-

    DNS UDP packet size may be a factor in some of the rcode refused messages. Please see enclosed link. However exceedig the size is apparently common.

    RFC 5966 - DNS Transport over TCP - Implementation Requirements

    Thanks,
    Jim
  • 0 in reply to scottj_01
    I receive that error code for what I think is a Sophos up2date site because it occurs amongst the other successful up2date lookups. This group repeats regularly.

    50.43.174.0


    2012:08:26-08:47:05 cats-kingdom named[4218]: unexpected RCODE (SERVFAIL) resolving '0.174.43.50.in-addr.arpa/PTR/IN': 66.133.150.11#53
    2012:08:26-08:47:06 cats-kingdom named[4218]: unexpected RCODE (SERVFAIL) resolving '0.174.43.50.in-addr.arpa/PTR/IN': 66.133.183.132#53
    2012:08:26-08:47:08 cats-kingdom named[4218]: unexpected RCODE (SERVFAIL) resolving '0.174.43.50.in-addr.arpa/PTR/IN': 66.133.150.11#53 
    2012:08:26-08:47:09 cats-kingdom named[4218]: unexpected RCODE (SERVFAIL) resolving '0.174.43.50.in-addr.arpa/PTR/IN': 66.133.183.132#53 
    Ian
Unfiltered HTML