I found an odd problem with a Ubuntu 12.04 server. It seems that multiple domains are being appended to each DNS query, resulting in our bind server bind being flooded.
For example, we have the following domains:
alpha.foo.com beta.foo.com gamma.foo.com
When we look up a domain bar.alpha.foo.com, we start seeing domains in the BIND log with the following:
bar.alpha.foo.com bar.alpha.foo.com.beta.foo.com bar.alpha.foo.com.gamma.foo.com
And which we confirm in tcpdump
> bar.alpha.foo.com.42005 > REDACTED.domain: [bad udp cksum 0xab50 -> > 0x9c3e!] 6895+ AAAA? bar.alpha.foo.com.beta.foo.com. (59) > 22:57:19.368831 IP (tos 0x0, ttl 63, id 19082, offset 0, flags [none], > proto UDP (17), length 156) > REDACTED.domain > bar.alpha.foo.com.42005: [udp sum ok] 6895 NXDomain q: AAAA? bar.alpha.foo.com.beta.foo.com. 0/1/0 ns: foo.com. > [21m58s] SOA REDACTED. dnsadmins.foo.com. 89013 900 600 86400 3600 > (128)
What is curious that I do have another 12.04 server which is not exhibiting the same behavior. The difference being that this server was built manually, where as the problem server was created via an automated build.
EDIT: I was wrong. The domains on the "working" 12.04 server were explicitly set in the host file. Once I commented out the entries, I see the problem there as well