Bug 1571059

Thanks for your report. I checked sources a bit and could not find any reason for such messages after 9.11.2. Are names of failed queries random? Could you tell if that errors happen short after or before restarts from logs?

The names appear random. I could not see a particular pattern.

It happens at any time, it seems.

Maybe some other compounent changed around that time, which caused this. Who knows. Haven't seen similar bug reports with this version of bind, so maybe it's something specific to my setup. First time I'm seeing it though...

Can you share more about your configuration? named-checkconf -p output would help.

Sent privately.

# Version with domains replaced
controls {
	inet 127.0.0.1 allow {
		127.0.0.1/32;
	} keys {
		"rndckey";
	};
};
logging {
	channel "default_syslog" {
		syslog "daemon";
		severity warning;
	};
	category "default" {
		"default_syslog";
	};
};
options {
	avoid-v4-udp-ports {
		range 0 32767;
		range 61000 65535;
	};
	avoid-v6-udp-ports {
		range 0 32767;
		range 61000 65535;
	};
	directory "/var/named";
	dump-file "/var/named/data/cache_dump.db";
	listen-on {
		127.0.0.1/32;
		10.1.1.1/32;
		10.1.1.2/32;
	};
	managed-keys-directory "/var/named/dynamic";
	memstatistics-file "/var/named/data/named_mem_stats.txt";
	pid-file "/run/named/named.pid";
	statistics-file "/var/named/data/named_stats.txt";
	version none;
	dnssec-enable yes;
	dnssec-validation auto;
	allow-transfer {
		"none";
	};
	allow-update {
		"none";
	};
	key-directory "/etc/pki/dnssec-keys";
};
view "internal" {
	match-clients {
		127.0.0.1/32;
		10.1.1.0/24;
		192.168.8.0/24;
	};
	zone "." IN {
		type hint;
		file "named.ca";
	};
	zone "localhost.localdomain" IN {
		type master;
		file "named.localhost";
		allow-update {
			"none";
		};
	};
	zone "localhost" IN {
		type master;
		file "named.localhost";
		allow-update {
			"none";
		};
	};
	zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN {
		type master;
		file "named.loopback";
		allow-update {
			"none";
		};
	};
	zone "1.0.0.127.in-addr.arpa" IN {
		type master;
		file "named.loopback";
		allow-update {
			"none";
		};
	};
	zone "0.in-addr.arpa" IN {
		type master;
		file "named.empty";
		allow-update {
			"none";
		};
	};
	zone "xy.com" {
		type master;
		file "data/internal/xy.com";
		update-policy {
			grant "dhcpkey" subdomain "xy.com." "A" "TXT";
		};
		auto-dnssec maintain;
		inline-signing yes;
	};
	zone "xy.net" {
		type master;
		file "data/internal/xy.net";
		auto-dnssec maintain;
		inline-signing yes;
	};
	zone "xy.org" {
		type master;
		file "data/internal/xy.org";
		auto-dnssec maintain;
		inline-signing yes;
	};
	zone "xy.com.au" {
		type master;
		file "data/internal/xy.com.au";
		auto-dnssec maintain;
		inline-signing yes;
	};
	zone "yz.com" {
		type master;
		file "data/internal/yz.com";
		auto-dnssec maintain;
		inline-signing yes;
	};
	zone "yz.net" {
		type master;
		file "data/internal/yz.net";
		auto-dnssec maintain;
		inline-signing yes;
	};
	zone "yz.org" {
		type master;
		file "data/internal/yz.org";
		auto-dnssec maintain;
		inline-signing yes;
	};
	zone "1.1.10.in-addr.arpa" {
		type master;
		file "data/internal/1.1.10.in-addr.arpa";
		update-policy {
			grant "dhcpkey" subdomain "1.1.10.in-addr.arpa." "PTR";
		};
	};
	zone "8.168.192.in-addr.arpa" {
		type master;
		file "data/internal/8.168.192.in-addr.arpa";
	};
	recursion yes;
};
view "external" {
	match-clients {
		"any";
	};
	zone "xy.com" {
		type master;
		file "data/external/xy.com";
		auto-dnssec maintain;
		inline-signing yes;
	};
	zone "xy.net" {
		type master;
		file "data/external/xy.net";
		auto-dnssec maintain;
		inline-signing yes;
	};
	zone "xy.org" {
		type master;
		file "data/external/xy.org";
		auto-dnssec maintain;
		inline-signing yes;
	};
	zone "xy.com.au" {
		type master;
		file "data/external/xy.com.au";
		auto-dnssec maintain;
		inline-signing yes;
	};
	zone "yz.com" {
		type master;
		file "data/external/yz.com";
		auto-dnssec maintain;
		inline-signing yes;
	};
	zone "yz.net" {
		type master;
		file "data/external/yz.net";
		auto-dnssec maintain;
		inline-signing yes;
	};
	zone "yz.org" {
		type master;
		file "data/external/yz.org";
		auto-dnssec maintain;
		inline-signing yes;
	};
	recursion no;
};

I have seen this just once in the last week or so, after I gave --transparent option to -m socket for the squid that's running in TPROXY mode on the same machine. No idea whether it's somehow related or maybe something else changed that made it better.

So, I'm going to close this for now. If it reappears, I'll reopen.