Skip to main content
Skip table of contents

3516 - Troubleshooting REFUSED DNS message in NIOS


User reports that she tried to look up but received a REFUSED error message. The dig output is attached below. Please diagnose the issue.

$ dig @ 

; <<>> DiG 9.18.12-0ubuntu0.22.04.2-Ubuntu <<>> @
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 64700
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

; EDNS: version: 0, flags:; udp: 1220
; COOKIE: fe4cc82f2914d71a9443360464c4319580b9f7e79182b7f5 (good)
;		IN	A

;; Query time: 4 msec
;; WHEN: Fri Jul 28 21:22:29 UTC 2023
;; MSG SIZE  rcvd: 72

Estimate Completion Time

  • 15 to 20 minutes






Grid Manager UI




  • Administrative access to the Grid

Course References

  • 3011: DNS Troubleshooting Methodology

Lab Initiation

Access jump-desktop

Once the lab is deployed, you can access the virtual machines required to complete this lab activity. To initiate the lab, click on the jump-desktop tile and login to the Linux UI:

Username: training

Password: infoblox

Initiate lab

To initiate the lab, double-click the Launch Lab icon on the Desktop.

Launch Lab

Launch Lab

Choose the lab number from the list and click OK.

After clicking OK, you will see a pop-up message with a brief description of the lab task. If the description looks correct, click Yes to continue lab initiation.

Lab initiation will take a couple of minutes to finish.

Once complete, you will see another pop-up message with the login credentials and the URL for the Grid Manager’s User Interface. Note that the credentials may differ from those from prior labs.

Screenshot 2024-05-06 at 3.16.57 PM.png


Task 1: Troubleshooting REFUSED message

Investigate resolution issue with the help of dig tool and resolve the issue after finding root cause.

Examine the output sent by the user closely.


Task 1 Solution: Troubleshooting REFUSED message

Look closely at the first line of the output sent by the user. The FQDN is misspelled as (missing the letter e).

Detailed Analysis

  • Line 1: We query the name server directly.

  • Line 7: The status code REFUSED indicates that the server refused service (details on the next 2 lines).

  • Line 8: We see only qr and rd flags, missing ra (recursion available) and aa (authoritative answer). This means the server is unable to provide the answer locally (not authoritative), and unable to ask others (cannot perform recursion).

  • Line 9: This line provides the clear error message that the server is unable to perform recursion.

With all of this information combined, this is what happened: the DNS server is not configured to allow recursion (indicated by lines 8 and 9). We can check the Grid and see that the server ibns1 ( does have an authoritative zone configured, but it is spelled differently than the one the user queried. The one configured on the Grid is spelled, while the user queried for (without e).

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.