<div dir="ltr"><div>Hi Simon, thank you so much for getting back to me.</div><div><br></div>I continued to see errors, but I tried switching away from Google DNS, and instead I used <a href="http://www.censurfridns.dk/">http://www.censurfridns.dk/</a> (censorship free dns), and the error have been resolved. I don't know if it is an issue with their service, or an issue between my hosting (Linode) and Googles service, but I haven't seen any issues since the change.<br><div class="gmail_extra"><br></div><div class="gmail_extra"><br></div><div class="gmail_extra">Thanks again.<br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr">--<br><div>Kasper Grubbe<br><br>Phone: (+45) 42 42 42 74</div><div>Skype: kasper.grubbe<br>Mail: <a href="mailto:kaspergrubbe@gmail.com" target="_blank">kaspergrubbe@gmail.com</a></div><div>Web: <a href="http://kaspergrubbe.com" target="_blank">http://kaspergrubbe.com</a></div></div></div></div></div></div>
<br><div class="gmail_quote">On Wed, Aug 17, 2016 at 8:27 PM, Simon Kelley <span dir="ltr"><<a href="mailto:simon@thekelleys.org.uk" target="_blank">simon@thekelleys.org.uk</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA256<br>
<br>
Hi,<br>
<br>
I just rand the same query and got this answer<br>
<br>
srk@julia:~$ dig @<a href="http://127.0.0.1" rel="noreferrer" target="_blank">127.0.0.1</a> -p 10000 <a href="http://login.salesforce.com" rel="noreferrer" target="_blank">login.salesforce.com</a><br>
<br>
; <<>> DiG 9.9.5-3ubuntu0.8-Ubuntu <<>> @<a href="http://127.0.0.1" rel="noreferrer" target="_blank">127.0.0.1</a> -p 10000<br>
<a href="http://login.salesforce.com" rel="noreferrer" target="_blank">login.salesforce.com</a><br>
; (1 server found)<br>
;; global options: +cmd<br>
;; Got answer:<br>
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2237<br>
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1<br>
<br>
;; OPT PSEUDOSECTION:<br>
; EDNS: version: 0, flags:; udp: 512<br>
;; QUESTION SECTION:<br>
;<a href="http://login.salesforce.com" rel="noreferrer" target="_blank">login.salesforce.com</a>. IN A<br>
<br>
;; ANSWER SECTION:<br>
<a href="http://login.salesforce.com" rel="noreferrer" target="_blank">login.salesforce.com</a>. 3577 IN CNAME <a href="http://login.gslb2.salesforce.com" rel="noreferrer" target="_blank">login.gslb2.salesforce.com</a>.<br>
<a href="http://login.gslb2.salesforce.com" rel="noreferrer" target="_blank">login.gslb2.salesforce.com</a>. 100 IN A 85.222.132.2<br>
<br>
;; Query time: 418 msec<br>
;; SERVER: 127.0.0.1#10000(127.0.0.1)<br>
;; WHEN: Wed Aug 17 20:24:51 BST 2016<br>
;; MSG SIZE rcvd: 91<br>
<br>
<br>
<br>
<br>
So <a href="http://login.salesforce.com" rel="noreferrer" target="_blank">login.salesforce.com</a>. is a CNAME for <a href="http://login.gslb2.salesforce.com" rel="noreferrer" target="_blank">login.gslb2.salesforce.com</a>.<br>
and there's a IP address at <a href="http://login.gslb2.salesforce.com" rel="noreferrer" target="_blank">login.gslb2.salesforce.com</a><br>
<br>
My guess is that this was a transient fault where the A record for<br>
<a href="http://login.gslb2.salesforce.com" rel="noreferrer" target="_blank">login.gslb2.salesforce.com</a> was missing. It certainly doesn't look like<br>
a dnsmasq bug.<br>
<br>
Cheers,<br>
<br>
Simon.<br>
<div><div class="h5"><br>
<br>
On 15/08/16 16:40, Kasper Grubbe wrote:<br>
> One of my users is getting some errors talking to Salesforce, as a<br>
> replication step she has provided me with the following piece of<br>
> Python code:<br>
><br>
> import socket print(socket.gethostbyname('<wbr>localhost'))<br>
> print(socket.gethostbyname('<a href="http://google.com" rel="noreferrer" target="_blank">go<wbr>ogle.com</a>'))<br>
> print(socket.gethostbyname('<a href="http://login.salesforce.com" rel="noreferrer" target="_blank">lo<wbr>gin.salesforce.com</a>'))<br>
><br>
> And it prints the following:<br>
><br>
> 127.0.0.1 <a href="tel:216.58.211.14" value="+12165821114">216.58.211.14</a> Traceback (most recent call last): File<br>
> "dns.py", line 4, in <module><br>
> print(socket.gethostbyname('<a href="http://login.salesforce.com" rel="noreferrer" target="_blank">lo<wbr>gin.salesforce.com</a>'))<br>
> socket.gaierror: [Errno 8] nodename nor servname provided, or not<br>
> known<br>
><br>
> In my logs I see the following:<br>
><br>
> Aug 15 14:54:32 dnsmasq[28405]: query[A]<br>
> <a href="http://login.gslb2.salesforce.com" rel="noreferrer" target="_blank">login.gslb2.salesforce.com</a> from 10.8.0.3 Aug 15 14:54:32<br>
> dnsmasq[28405]: forwarded <a href="http://login.gslb2.salesforce.com" rel="noreferrer" target="_blank">login.gslb2.salesforce.com</a> to 8.8.8.8 Aug<br>
> 15 14:54:32 dnsmasq[28405]: forwarded <a href="http://login.gslb2.salesforce.com" rel="noreferrer" target="_blank">login.gslb2.salesforce.com</a><br>
> to 8.8.4.4 Aug 15 14:54:32 dnsmasq[28405]: dnssec-query[DS] com to<br>
> 8.8.8.8 Aug 15 14:54:32 dnsmasq[28405]: dnssec-query[DNSKEY] . to<br>
> 8.8.8.8 Aug 15 14:54:32 dnsmasq[28405]: reply . is DNSKEY keytag<br>
> 46551 Aug 15 14:54:32 dnsmasq[28405]: reply . is DNSKEY keytag<br>
> 19036 Aug 15 14:54:32 dnsmasq[28405]: reply com is DS keytag 30909<br>
> Aug 15 14:54:32 dnsmasq[28405]: dnssec-query[DS] <a href="http://salesforce.com" rel="noreferrer" target="_blank">salesforce.com</a> to<br>
> 8.8.8.8 Aug 15 14:54:32 dnsmasq[28405]: dnssec-query[DNSKEY] com to<br>
> 8.8.8.8 Aug 15 14:54:32 dnsmasq[28405]: reply com is DNSKEY keytag<br>
> 27452 Aug 15 14:54:32 dnsmasq[28405]: reply com is DNSKEY keytag<br>
> 30909 Aug 15 14:54:32 dnsmasq[28405]: reply <a href="http://salesforce.com" rel="noreferrer" target="_blank">salesforce.com</a> is no<br>
> DS Aug 15 14:54:32 dnsmasq[28405]: validation result is INSECURE<br>
> Aug 15 14:54:32 dnsmasq[28405]: reply <a href="http://login.gslb2.salesforce.com" rel="noreferrer" target="_blank">login.gslb2.salesforce.com</a><br>
> is NODATA-IPv4<br>
><br>
> My Dnsmasq is configured like this:<br>
><br>
> dnssec<br>
><br>
> trust-anchor=.,19036,8,2,<wbr>49AAC11D7B6F6446702E54A1607371<wbr>607A1A41855200F<br>
D2CE1CDDE32F24E8FB5<br>
><br>
><br>
dnssec-check-unsigned<br>
><br>
> interface=tun0 local-ttl=360<br>
><br>
> log-queries log-facility=/var/log/dnsmasq.<wbr>log log-async=20<br>
><br>
> resolv-file=/etc/dnsmasq-<wbr>resolv.conf<br>
><br>
> And dnsmasq-resolv.conf contains this:<br>
><br>
> nameserver 8.8.8.8 nameserver 8.8.4.4<br>
><br>
> Any ideas why this is?<br>
><br>
> Br. -- Kasper Grubbe<br>
><br>
> Phone: (+45) 42 42 42 74 Skype: kasper.grubbe Mail:<br>
> <a href="mailto:kaspergrubbe@gmail.com">kaspergrubbe@gmail.com</a> Web: <a href="http://kaspergrubbe.com" rel="noreferrer" target="_blank">http://kaspergrubbe.com</a><br>
><br>
><br>
><br>
</div></div>> ______________________________<wbr>_________________ Dnsmasq-discuss<br>
> mailing list <a href="mailto:Dnsmasq-discuss@lists.thekelleys.org.uk">Dnsmasq-discuss@lists.<wbr>thekelleys.org.uk</a><br>
> <a href="http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss" rel="noreferrer" target="_blank">http://lists.thekelleys.org.<wbr>uk/mailman/listinfo/dnsmasq-<wbr>discuss</a><br>
><br>
-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v2.0.22 (GNU/Linux)<br>
<br>
iQIcBAEBCAAGBQJXtLqxAAoJEBXN2m<wbr>rhkTWiRGoP/<wbr>RWGIeYrZNBHKdMrGHoHLUmn<br>
waeLBojUuk0dpuIMqJss0K7gjIeeNH<wbr>e8xWfJxYf7Q5rYxiEEYZMGhzlIDEO3<wbr>1wSl<br>
09rTFLqnz4jVdWvbJYnQ0dx9RCGgrZ<wbr>hE3SJJR4Nyq1eAyQ6x7OdTilpcGvrj<wbr>mvk2<br>
yA98w+O6zvAeusCJ9XUPHp//<wbr>O3x2RBYJIJPZ5WB99KPpqq9jN1h/<wbr>jk0qqkmhved2<br>
jYk6oh5oW3Va1lNK2iFgLM/<wbr>jEvYBKlJUl/<wbr>uGBXdGo6KXD9D19UBElgsztXeE0yXk<br>
2xrmaVljs24KMozjytesKSqEk0hYLc<wbr>vFxCFabRyo4RybOq0+44YnrpeR+<wbr>SXui5E8<br>
6ZDZj4Ub9NHtXHUcTyzNISl/J3Xfy/<wbr>kOm2AGaSAJIzRPczG99zfze7C3uzpr<wbr>fe7A<br>
H0YWNzh12XhZEI9LBvlOTaHdnI3Nkz<wbr>/qG82NU638vYr2WoiS+<wbr>OZZjeTNmUfmmis8<br>
pVh1Wp+tftNpGQxV68OagnWj/<wbr>4xZL96wdEBouznx0LzfYjDZhhKWjtT<wbr>D7Mv/LJUZ<br>
+<wbr>3iIIcmf2gCNBnmEDeqW4imMkSBTmun<wbr>3pd3nkInAc5bnLqU26VQQXN2FE3G80<wbr>ge7<br>
GeVVkxDu9PBHZ79JfzfCxT+<wbr>ygzEmbRiQtw+<wbr>QfIdMlGGfs1ugtLxy0pcSZdEtzPmn<br>
4oHeXXbcUxO+8A39tZHS<br>
=QgWx<br>
-----END PGP SIGNATURE-----<br>
<br>
______________________________<wbr>_________________<br>
Dnsmasq-discuss mailing list<br>
<a href="mailto:Dnsmasq-discuss@lists.thekelleys.org.uk">Dnsmasq-discuss@lists.<wbr>thekelleys.org.uk</a><br>
<a href="http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss" rel="noreferrer" target="_blank">http://lists.thekelleys.org.<wbr>uk/mailman/listinfo/dnsmasq-<wbr>discuss</a><br>
</blockquote></div><br></div></div>