You are viewing a plain text version of this content. The canonical link for it is here.
Posted to sysadmins@spamassassin.apache.org by John Hardin <jh...@impsec.org> on 2026/04/23 14:31:29 UTC
Occasional DNS failures on sa-vm
sa-vm is experiencing occasional DNS errors, _potentially_ IPv6-related.
Per my earlier email I turned IPv6 in Postfix off, but we're also seeing
system-level lookups fail:
svn: E170013: Unable to connect to a repository at URL 'http://svn.apache.org/repos/asf/spamassassin/site/updates'
svn: E670003: Temporary failure in name resolution
/etc/resolv.conf is currently going direct-to-google.
I tried reconfiguring name resolution to go via the local NS to leverage
caching but this configuration is being managed via Puppet (presumably by
Apache infra) and my change was reverted.
I was getting REFUSED while working on this so the local NS config also
needs attention:
> root@sa-vm:~# dig svn.apache.org
>
> ; <<>> DiG 9.18.30-0ubuntu0.20.04.2-Ubuntu <<>> svn.apache.org
> ;; global options: +cmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 50581
> ;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
> ;; WARNING: recursion requested but not available
>
> ;; OPT PSEUDOSECTION:
> ; EDNS: version: 0, flags:; udp: 1232
> ;; QUESTION SECTION:
> ;svn.apache.org. IN A
>
> ;; Query time: 0 msec
> ;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
> ;; WHEN: Thu Apr 23 14:11:53 UTC 2026
> ;; MSG SIZE rcvd: 43
...but the change to /etc/resolv.conf to use the local NS got reverted by
Puppet so I didn't pursue that any further.
Can someone open an Apache Infra ticket regarding occasional name
resolution errors on sa-vm and ask them to reconfigure it to use the local
caching NS first, and ensure that the local caching NS is properly
configured? I haven't done that and don't know the process.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Are you a mildly tech-literate politico horrified by the level of
ignorance demonstrated by lawmakers gearing up to regulate online
technology they don't even begin to grasp? Cool. Now you have a
tiny glimpse into a day in the life of a gun owner. -- Sean Davis
-----------------------------------------------------------------------
Today: Max Planck's 168th birthday
Re: Occasional DNS failures on sa-vm
Posted by John Hardin <jh...@impsec.org>.
On Thu, 23 Apr 2026, John Hardin wrote:
> Can someone open an Apache Infra ticket regarding occasional name resolution
> errors on sa-vm and ask them to reconfigure it to use the local caching NS
> first, and ensure that the local caching NS is properly configured? I haven't
> done that and don't know the process.
sa-vm is apparently a "hidden master" for the rule update DNS, so
configuring it to cache and recurse for local queries may be a little more
complex than I first assumed...
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Today: Max Planck's 168th birthday