Re: Strange behavior from resolvers?

["Eric A. Hall" <ehall@ehsco.com>]

> The ns1.obol-net.net is certainly not running bind, so the question
> remains which nameserver is doing wrong. As far as I can see, bind
> would return SOA in auhority section for an equevalent request.

This is a malformed NODATA response, and is being treated as a referral.

RFC 2308, 2.2 - No Data

  NODATA is indicated by an answer with the RCODE set to NOERROR and no
  relevant answers in the answer section.  The authority section will
  contain an SOA record, or there will be no NS records there.

You are returning NS RRs in the auth section. BIND sees this response
format as a referral and tries to query the listed servers. When all of
the servers respond with "referrals" then they are treated as lame and
BIND returns SERVFAIL.

-- 
Eric A. Hall                                        http://www.ehsco.com/
Internet Core Protocols          http://www.oreilly.com/catalog/coreprot/