Hi, the relevant things I find are on aun.uninett.no (nothing much interesting): $ORIGIN ROOT-SERVERS.net. ;@ 548 IN A NXDOMAIN ;-$ ;[193.0.0.193] A 38874 IN A 198.41.0.4 ;NT=112 Cr=auth [193.0.0.193] B 444608 IN A 128.9.0.107 ;NT=136 Cr=auth [193.0.0.193] C 445485 IN A 192.33.4.12 ;NT=1361 Cr=auth [193.0.0.193] D 451625 IN A 128.8.10.90 ;NT=245 Cr=auth [193.0.0.193] E 574845 IN A 192.203.230.10 ;NT=483 Cr=auth [193.0.0.193] F 156088 IN A 192.5.5.241 ;NT=245 Cr=auth [198.41.0.5] G 477455 IN A 192.112.36.4 ;NT=92 Cr=auth [193.0.0.193] H 437295 IN A 128.63.2.53 ;NT=225 Cr=auth [193.0.0.193] I 442643 IN A 192.36.148.17 ;NT=71 Cr=auth [193.0.0.193] However, on runix.runit.sintef.no I find: COM 461985 IN NS B.ROOT-SERVERS.NET. ;Cr=addtnl [198.6.197.1] 461985 IN NS C.ROOT-SERVERS.NET. ;Cr=addtnl [198.6.197.1] 461985 IN NS D.ROOT-SERVERS.NET. ;Cr=addtnl [198.6.197.1] 461985 IN NS E.ROOT-SERVERS.NET. ;Cr=addtnl [198.6.197.1] 461985 IN NS I.ROOT-SERVERS.NET. ;Cr=addtnl [198.6.197.1] 461985 IN NS F.ROOT-SERVERS.NET. ;Cr=addtnl [198.6.197.1] 461985 IN NS G.ROOT-SERVERS.NET. ;Cr=addtnl [198.6.197.1] 461985 IN NS A.ROOT-SERVERS.NET. ;Cr=addtnl [198.6.197.1] 461985 IN NS H.ROOT-SERVERS.NET. ;Cr=addtnl [198.6.197.1] 202438 IN NS @.ROOT-SERVERS.NET. ;Cr=addtnl [204.96.68.1] 77368 IN SOA A.ROOT-SERVERS.NET. HOSTMASTER.INTERNIC.NET. ( 1996032200 10800 900 604800 86400 ) ;Cr=addtnl [192.36.148.17] 296566 IN NS F.I.ROOT-SERVERS.net. ;Cr=addtnl [198.6.197.1] 336242 IN NS I.ROOT-SERVERS.LET. ;Cr=addtnl [198.6.197.1] 336242 IN NS F.ROOT-SERVERS.LET. ;Cr=addtnl [198.6.197.1] 336242 IN NS G.ROOT-SERVERS.LET. ;Cr=addtnl [198.6.197.1] 336242 IN NS A.ROOT-SERVERS.LET. ;Cr=addtnl [198.6.197.1] Not good at all. 204.96.68.1 is olympic.pacificrim.net. It appears to be running 4.9.3, and does not appear to be the source of the bad data. 198.6.197.1 is unregistered (it's located somewhere behind net99.net and cais.net). It also appears to be running a recent version of BIND and does also not appear to be the source of the bad data. This looks suspiciuosly like the ns.uu.net fun, and my bet is that it will be real difficult to track down the real source of this bogus information. - Havard