-1

I'm setting up domain-lookaside validation. I think I got mostly everything correct. I followed the directions here: https://dlv.isc.org/about/using. I registered my domain and uploaded the key signing key, signed my zone with -l dlv.isc.org option, added dlv.isc.org as a foreign name server for my domain in the zone files. named fails silently. I even changed /dev/null to /var/log/named.log to squeeze some info out of named. I checked the changes were made but it didn't work I don't know what to check or try.

I'm asking 2 questions:

  1. Strategies to glean info from named when it fails silently like its doing
  2. Is the configuration correct. My limited understanding of DNS and DNSSEC tell me this should work

forward file:

$TTL 3600;

@ IN SOA ns1.sub.db.archives.net. dlv.isc.org. (
2014112100  ; serial
4h      ; refresh
1h      ; retry
7d      ; expiration
1h      ; minimum
)
$INCLUDE Ksub.db.archives.net.+008+07374.key
$INCLUDE Ksub.db.archives.net.+008+24586.key

        IN  NS  ns1.sub.db.archives.net.
        IN  NS  ns1.db.archives.net.
        IN  NS  dlv.isc.org.

dlv.isc.org.    IN  A   149.20.1.5
ns1.db.archives.net.    IN  A   10.103.35.66
ns1     IN  A   10.103.35.64
luke        IN  A   10.103.35.64
bo      IN  A   10.103.35.65
daisy       IN  A   10.103.35.66
sheriff     IN  A   10.103.35.67
boss        IN  A   10.103.35.68
dlv.sub.db.archives.net. 0 IN TXT "DLV:1:blablabla"

dlv.isc.org. IN DNSKEY 257 3 5 BEAAAAPHMu ...TDN0YUuWrBNh

reverse file:

$TTL 3600

@ IN SOA ns1.sub.db.archives.net. dlv.isc.org. (
2014112100  ; serial #
4h              ; refresh
1h              ; retry
7d              ; expiration
1h              ; minimum
)

                IN      NS  ns1.sub.db.archives.net.
                IN      NS  ns1.db.archives.net.
        IN  NS  dlv.isc.org.

5.1.20.149  IN  PTR dlv.isc.org.
66.35.103.10    IN  PTR ns1.db.archives.net.
64  IN  PTR ns1.sub.db.archives.net.
64  IN  PTR luke.sub.db.archives.net.
65  IN  PTR bo.sub.db.archives.net.
66  IN  PTR daisy.sub.db.archives.net.
67  IN  PTR sheriff.sub.db.archives.net.
68  IN  PTR boss.sub.db.archives.net.

dnssec-signzone command:

dnssec-signzone -l dlv.isc.org -o sub.db.archives.net -k Ksub.db.archives.net.+008+24586.key sub.db.archives.net.fwd Ksub.db.archives.net.+008+07374.key

named:

[root@test master]# service named start
Starting named:                                            [FAILED]
8
  • Downvoters how can I improve the question? Nov 24, 2014 at 6:08
  • I am not one of the downvoters, but I would expect it to be because there are multiple file not found errors in your log output. Those errors are self-explanatory and they have not been addressed.
    – Andrew B
    Nov 24, 2014 at 13:48
  • ah. sorry. I forgot to mention the files in question exist and I can confirm this Nov 24, 2014 at 15:18
  • They don't, trust me. Or at least not in the directory that you think they do. All file paths are relative to the directory statement in your options {}; block. If applicable, make sure you're considering the chroot as well. These files are definitely not being found.
    – Andrew B
    Nov 24, 2014 at 15:38
  • 1
    @jasondancks The main problem I have with the edit is that there's no longer any clear question. Nov 24, 2014 at 19:59

2 Answers 2

2
  1. Strategies for seeing why named fails to start:
    • Check named-checkconf -zj output. (named-checkconf as well as named-checkzone should probably be part of your regular workflow, not only for troubleshooting)
    • Check the logs. (named logs to syslog by default, see your named.conf for any logging configuration you have have that may override this)
    • If none of the above helps (unlikely), there is also the option to check which parameters you normally have in your named command line and start it manually with -g added to your normal set of parameters (this forces named to stay in the foreground and log to stderr).


  1. There are numerous obvious problems with the zone data included in the question that are not in any way specific to DNSSEC or DLV. To be quite frank, I would recommend that you read up on DNS fundamentals as a first step.
    Some problems that I spotted were the following, please consult the logs and/or named-check{conf,zone}} output as well.

    • The SOA records have very unlikely RNAME values ([email protected])
    • dlv.isc.org is listed as a nameserver but I very much doubt it hosts your zones.
    • dlv.isc.org. IN A ... doesn't look like it belongs in this zone.
    • ns1.db.archives.net. IN A ... doesn't look like it belongs in this zone.
    • dlv.isc.org. IN DNSKEY ... doesn't look like it belongs in this zone.
    • 5.1.20.149 IN PTR dlv.isc.org. - Ignoring that it's written incorrectly, this is yet another record that doesn't belong.
    • 66.35.103.10 IN PTR ns1.db.archives.net. probably belongs but is written incorrectly.


(My impression from the question is that the two zones are sub.db.archives.net and 35.103.10.in-addr.arpa, which is what I've based the out-of-zone statements on. Seeing the actual configuration in addition to the zone data would confirm this.)

1
  • Thanks so much. Something strange is definitely going on. named-checkzone didn't like the out-of-zone data but said the zone was valid. /usr/sbin/named actually ran and loaded the conf and zone files (again warning about the out of zone data). So its the init.d script thats failing technically a correctly defined zone. Nov 25, 2014 at 0:50
2

The actual file not found errors come across as fairly self-explanatory (no such files exist, I suppose?).

However, DS records live in the parent zone, alternatively DLV records live at the DLV server.

This means that your step 4 does not exist (as per the guide you linked).

Can you really not get the DS records into the parent zone instead? DLV was mostly a stopgap measure early on and should not be the first choice.

Also see In-line signing (and auto-dnssec maintain), that is generally a better option for zone signing and key management compared to calling dnssec-signzone manually.

1
  • As far as DLV is concerned its my only real choice Nov 24, 2014 at 15:39

Not the answer you're looking for? Browse other questions tagged .