OK, so I have narrowed this down.
- If I set System > General Setup > DNS Servers to just 8.8.8.8 or 8.8.4.4, it works (by which I mean I get only the A record not the AAAA record, but no junk)
- If I set System > General Setup > DNS Servers to 10.19.1.1 - which is the firewall itself, running the unbound package as a caching nameserver - I get the junk.
The difference:
- dig @10.19.1.1 psg.com includes the "authority" and "additional" sections
- dig @8.8.8.8 psg.com does not include these
I can make the first behave like the second in this way:
# dig +noauthority +noadditional @10.19.1.1 psg.com
So, this patch seems to do the trick:
--- ../diag_dns.php.orig 2014-02-06 10:09:35.000000000 +0000
+++ diag_dns.php 2014-02-06 10:10:18.000000000 +0000
@@ -47,7 +47,7 @@
$resolved = gethostbyname($host);
if($resolved) {
$host = trim($_POST['host']);
- $dig=`dig "$host" A | grep "$host" | grep -v ";" | awk '{ print $5 }'`;
+ $dig=`dig +noauthority +noadditional "$host" A | grep "$host" | grep -v ";" | awk '{ print $5 }'`;
$resolved = explode("\n", $dig);
$isfirst = true;
foreach($resolved as $re) {
@@ -104,7 +104,7 @@
$resolvconf_servers = `grep nameserver /etc/resolv.conf | cut -f2 -d' '`;
$dns_servers = explode("\n", trim($resolvconf_servers));
foreach ($dns_servers as $dns_server) {
- $query_time = `dig {$host_esc} @{$dns_server} | grep Query | cut -d':' -f2`;
+ $query_time = `dig +noauthority +noadditional {$host_esc} @{$dns_server} | grep Query | cut -d':' -f2`;
if($query_time == "")
$query_time = gettext("No response");
$new_qt = array();
@@ -130,7 +130,7 @@
$type = "hostname";
$resolved = gethostbyname($host);
if($resolved) {
- $dig=`dig $host_esc A | grep $host_esc | grep -v ";" | awk '{ print $5 }'`;
+ $dig=`dig +noauthority +noadditional $host_esc A | grep $host_esc | grep -v ";" | awk '{ print $5 }'`;
$resolved = explode("\n", $dig);
}
$hostname = $host;
I'm not sure that "dig $host_esc | grep $host|esc" is particularly good logic. It's quite possible that a hostname is delegated to a host which is a subdomain of itself or even to itself. In this case psg.com is delegated to psg.com and rip.psg.com (as well as nlns.globnix.net).
Anyway, that still leaves the question of whether it should include IPv6 (AAAA) records or not :-)
Regards,
Brian.
Updated by 
Updated by 