Troubleshooting REFUSED DNS message in NIOS (3516)

Scenario

User reports that she tried to look up www.techblue.net but received a REFUSED error message. The dig output is attached below. Please diagnose the issue.

$ dig @10.100.0.105 www.techblu.net. 

; <<>> DiG 9.18.12-0ubuntu0.22.04.2-Ubuntu <<>> @10.100.0.105 www.techblu.net.
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 64700
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1220
; COOKIE: fe4cc82f2914d71a9443360464c4319580b9f7e79182b7f5 (good)
;; QUESTION SECTION:
;www.techblu.net.		IN	A

;; Query time: 4 msec
;; SERVER: 10.100.0.105#53(10.100.0.105) (UDP)
;; WHEN: Fri Jul 28 21:22:29 UTC 2023
;; MSG SIZE  rcvd: 72

Estimate Completion Time

• 15 to 20 minutes

Credentials

Requirements

• Administrative access to the Grid

Course References

• 3011: DNS Troubleshooting Methodology

Lab Initiation

Access jump-desktop

Once the lab is deployed, you can access the virtual machines required to complete this lab activity. To initiate the lab, click on the jump-desktop tile and login to the Linux UI:

Username: training

Password: infoblox

Initiate lab

To initiate the lab, double-click the Launch Lab icon on the Desktop.

Choose the lab number from the list and click OK.

After clicking OK, you will see a pop-up message with a brief description of the lab task. If the description looks correct, click Yes to continue lab initiation.

Lab initiation will take a couple of minutes to finish.

Once complete, you will see another pop-up message with the login credentials and the URL for the Grid Manager’s User Interface. Note that the credentials may differ from those from prior labs.

Tasks

Task 1: Troubleshooting REFUSED message

Investigate resolution issue with the help of dig tool and resolve the issue after finding root cause.

Examine the output sent by the user closely.

Solutions

Task 1 Solution: Troubleshooting REFUSED message

Look closely at the first line of the output sent by the user. The FQDN is misspelled as techblu.net (missing the letter e).

Detailed Analysis

• Line 1: We query the name server 10.100.0.105 directly.

• Line 7: The status code REFUSED indicates that the server 10.100.0.105 refused service (details on the next 2 lines).

• Line 8: We see only qr and rd flags, missing ra (recursion available) and aa (authoritative answer). This means the server is unable to provide the answer locally (not authoritative), and unable to ask others (cannot perform recursion).

• Line 9: This line provides the clear error message that the server 10.100.0.105 is unable to perform recursion.

With all of this information combined, this is what happened: the DNS server 10.100.0.105 is not configured to allow recursion (indicated by lines 8 and 9). We can check the Grid and see that the server ibns1 (10.100.0.105) does have an authoritative zone configured, but it is spelled differently than the one the user queried. The one configured on the Grid is spelled techblue.net, while the user queried for techblu.net (without e).