Centos – Unexpected RCODE(SERVFAIL) causing bind to crash

bindcentosdomain-name-system

Every two days or so, my server stops responding entirely to its services. I can ping it, but I cannot use SSH so I have to go into my host's control panel and reset it.

When it comes back up, the last log entry before the crash in /var/log/messages are variations on the following:

named[3493]: unexpected RCODE (SERVFAIL) resolving '3.39.148.159.in-addr.arpa/PTR/IN': 193.0.0.193#53

Could this be a part of a DoS attack? I have not configured bind on this server and didn't think I'd need to (however naïve that may be).

Best Answer

Question first off: does it actually need the bind accessible to the outside world? If not, just block ingoing traffic on the DNS ports, and you're all set.

But yes, indirectly this is part of an 'attack', as your mail server is probably trying to bounce back "user not found" mails to bogus servers.

And do you have spamassassin running on your machine? If you're hit by a spamwave and the perl spamassassin is trying to handle all the mail, it might take down your system on unlucky configurations.