DNS Record Occasional Query Failed

[zhaohong-ponyai]

Short description
I have a DNS record of CNAME, this value is the DNS address of a public network alb pointing to Alibaba Cloud, and then my local powerDNS also has the zone and record corresponding to this domain name on the cloud, and then in the intranet, when accessing this domain name, the occasional request fails, and the error log is as follows:

Environment
PowerDNS Recursor 4.5.7

Expected behaviour
query ok

Actual behaviour
query failed occasional

Can you help me explain why this is wrong and how to solve it? thanks!

[Habbie]

Please read https://blog.powerdns.com/2016/01/18/open-source-support-out-in-the-open

[omoerbeek]

To explain a bit more: show us your full and real configuration and trace file, not just a partial screendump.
Also: your recursor is very old and unsupported. Please upgrade, see repo.powerdns.com

[zhaohong-ponyai]

The information provided above is desensitized. Do you need any other information? By the way, I know the version is very old, but used in the production environment, can not upgrade easily, and then this problem is very occasional, these two days did not appear, so I would like to ask what triggered this error like blow?

my-domain.com: status=got a CNAME referral, starting over with my-doamin.com
my-domain.com: updating validation state with negative cache content for my-domain.com.cn to Indeterminate

And this domain record is like this, and this is a public dns in Alicloud
my-domain.com CNAME alb-exampleuuid.cn-shenzhen.alb.aliyuncs.com

[omoerbeek]

That log line is not an error.
Sorry, if you cannot give us real information we cannot help you. Read the blog post why.

[zhaohong-ponyai]

ok~the actual log like this, is it not an error?

[omoerbeek]

The recursor throttles authoritative severs that do not respond well, for example timeouts. Throttling means that it will not use those IPs to query for a while.

In this log the forwarding targets 100.100.2.158 and 100.100.2.158.136 are throttled by the recursor, because of poor performance that happened earlier. Try to find out why, it might be bad connectivity, rate limiting by the other side or just overloaded servers.

You can also try adding these addresses to https://docs.powerdns.com/recursor/settings.html#dont-throttle-netmasks, but that does not solve the actual issue, it might just work around it.

[omoerbeek]

What did you do exactly? Please show the configuration and the logs.

[zhaohong-ponyai]

the config like this

the log like this

[omoerbeek]

This is a case of the other side not answering, Recursor cannot do anything about that. As said above, it could for example be bad connectivity, rate limiting, or an overloaded other side.

On a side note: please don't paste images of logs, use text files. It's impossible to copy-paste from an image.

[zhaohong-ponyai]

ok, So in this case, is there no other solution?

[omoerbeek]

Maybe you can try to find out why the queries are timing out by contacting the admin of those servers and do diagnosis, but we cannot help you with that.