[kwlug disc.] www.google.ca does not resolve

[Paul Nijjar]

We are having the weirdest problems accessing Glenn's favourite
non-evil search engine. As far as I know it is only affecting google.
The DNS entries for www.google.ca are not resolving properly. The
problem is intermittent: yesterday Google stopped resolving, and then
later in the evening it worked, and then it has been failing again
today. 

The setup is as follows: we have an IPCop box (version 1.4.21 with an
IP of 192.168.1.2) which sits between Rogers DNS (64.71.255.198) and
our local intranet (we have Windows 2003 servers that point to IPCop
for resolution, but I think they are not relevant here). I think
something is broken with IPCop.  The DNS entries for www.google.ca are
not resolving properly. Here is some output. First I look up Google on
the IPCop box, and then I use Rogers:


==================== 

pnijjar at 66bf-pauln2:~$ dig www.google.ca

; <<>> DiG 9.5.0-P1 <<>> www.google.ca
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5526
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;www.google.ca.                 IN      A

;; ANSWER SECTION:
www.google.ca.          12518   IN      CNAME   www.google.com.
www.google.com.         85027   IN      CNAME   www.l.google.com.

;; Query time: 5 msec
;; SERVER: 192.168.1.5#53(192.168.1.5)
;; WHEN: Sat Aug 16 15:27:45 2008
;; MSG SIZE  rcvd: 79




==================== 

pnijjar at 66bf-pauln2:~$ dig @64.71.255.198 www.google.ca

; <<>> DiG 9.5.0-P1 <<>> @64.71.255.198 www.google.ca
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46963
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 7, ADDITIONAL: 7

;; QUESTION SECTION:
;www.google.ca.                 IN      A

;; ANSWER SECTION:
www.google.ca.          12502   IN      CNAME   www.google.com.
www.google.com.         444490  IN      CNAME   www.l.google.com.
www.l.google.com.       297     IN      A       72.14.205.147
www.l.google.com.       297     IN      A       72.14.205.99
www.l.google.com.       297     IN      A       72.14.205.103
www.l.google.com.       297     IN      A       72.14.205.104

;; AUTHORITY SECTION:
l.google.com.           86358   IN      NS      c.l.google.com.
l.google.com.           86358   IN      NS      d.l.google.com.
l.google.com.           86358   IN      NS      e.l.google.com.
l.google.com.           86358   IN      NS      f.l.google.com.
l.google.com.           86358   IN      NS      g.l.google.com.
l.google.com.           86358   IN      NS      a.l.google.com.
l.google.com.           86358   IN      NS      b.l.google.com.

;; ADDITIONAL SECTION:
c.l.google.com.         86358   IN      A       64.233.161.9
d.l.google.com.         86358   IN      A       66.249.93.9
e.l.google.com.         86358   IN      A       209.85.137.9
f.l.google.com.         86358   IN      A       72.14.235.9
g.l.google.com.         86358   IN      A       64.233.167.9
a.l.google.com.         86358   IN      A       209.85.139.9
b.l.google.com.         86358   IN      A       64.233.179.9

;; Query time: 20 msec
;; SERVER: 64.71.255.198#53(64.71.255.198)
;; WHEN: Sat Aug 16 15:25:06 2008
;; MSG SIZE  rcvd: 367


==================== 

What am I doing wrong (other than having no business administrating a
network in the first place)? 

I imagine that there is something weird going on with the DNS caching
in the IPCop box, but I am not sure what I should be looking for.
The IPCop web interface is not so useful. I guess I will have to SSH
in and poke around, but this is all pretty deep magic to me
(especially if IPCop is running BIND). Do you have any quick fixes or
advice for me?

- Paul




      __________________________________________________________________
Instant Messaging, free SMS, sharing photos and more... Try the new Yahoo! Canada Messenger at http://ca.beta.messenger.yahoo.com/