named is not resolving without resolv.conf

Question

I have next files

/etc/named.conf

options {
    listen-on port 53 { 10.11.22.16; };
    directory   "/var/named";
    dump-file   "/var/named/data/cache_dump.db";
    statistics-file "/var/named/data/named_stats.txt";
    memstatistics-file "/var/named/data/named_mem_stats.txt";
    allow-query     { localhost; 10.11.22.0/24; };
    forwarders      { 10.11.22.2; };
    allow-transfer  { 10.11.22.2; };

    recursion yes;
    allow-recursion { 10.11.22.0/24;  localhost; };

    dnssec-enable yes;
    dnssec-validation no;
    dnssec-lookaside auto;
    empty-zones-enable no;

    bindkeys-file "/etc/named.iscdlv.key";

    managed-keys-directory "/var/named/dynamic";

    pid-file "/run/named/named.pid";
    session-keyfile "/run/named/session.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
    type hint;
    file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

zone "domen.lan" IN {
    type  master;
    file  "domen.lan";
    allow-update  { none; };
};

zone "22.11.10.in-addr.arpa" IN {
    type master;
    file "10.11.22.zone";
    allow-update { none; };
};

/var/named/domen.lan

$TTL 1D
@   IN  SOA     domen.lan.      admin.domen.lan. (
        2015031413  ; serial
        1D          ; refresh
        1H          ; retry
        1W          ; expire
        3H          ; minimum
)
;@               IN  NS      centos7s.domen.lan.
                    NS      centos7s.domen.lan.
gateway         IN  A       10.11.22.2

domen.lan.      IN  A       10.11.22.16
centos7s        IN  A       10.11.22.16
centos7c        IN  A       10.11.22.17
centos7d        IN  A       10.11.22.18
www.centos7s    IN  CNAME   centos7s.domen.lan.
www             IN  CNAME   centos7s
domen           IN  CNAME   centos7s.domen.lan.
domen1          IN  CNAME   centos7s.domen.lan.
domen2          IN  CNAME   centos7s.domen.lan.
domen2.lan      IN  CNAME   centos7s.domen.lan.
ldap            IN  CNAME   centos7s.domen.lan.
ldaps           IN  CNAME   centos7s.domen.lan.
ldap.centos7s   IN  CNAME   centos7s.domen.lan.

/etc/resolv.conf

search domen.lan
nameserver 10.11.22.16

/etc/sysconfig/network-scripts/ifcfg-eno16777736

TYPE=Ethernet
BOOTPROTO=none
DEFROUTE=yes
PEERDNS=no
PEERROUTES=yes
IPV4_FAILURE_FATAL=no
IPV6INIT=yes
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=yes
IPV6_PEERDNS=yes
IPV6_PEERROUTES=yes
IPV6_FAILURE_FATAL=no
NAME=eno16777736
UUID=b6e9c673-e7bd-41b5-946b-cb2c37bb56ff
DEVICE=eno16777736
ONBOOT=yes
NM_CONTROLLED=no

IPADDR=10.11.22.16
NETMASK=255.255.255.0
NETWORK=10.11.22.0
GATEWAY=10.11.22.2
DNS1=127.0.0.1
DNS2=10.11.22.16

If I do

dig www.oracle.com

I do not get an answer

; <<>> DiG 9.9.4-RedHat-9.9.4-18.el7_1.1 <<>> www.oracle.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 47205
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.oracle.com.                        IN      A

;; Query time: 3994 msec
;; SERVER: 10.11.22.16#53(10.11.22.16)
;; WHEN: Tue Sep 15 08:59:48 CEST 2015
;; MSG SIZE  rcvd: 43

But if I put

nameserver 10.11.22.2

in

/etc/resolv.conf

I works. Is there a way to put nameserver 10.11.22.2 in named ? I am using centos 7.1

/var/log/messages

Sep 11 10:51:28 centos7s named[1287]: error (network unreachable) resolving './NS/IN': 2001:503:ba3e::2:30#53
Sep 11 10:51:28 centos7s named[1287]: error (network unreachable) resolving 'www.oracle.com/A/IN': 2001:503:ba3e::2:30#53
Sep 11 10:51:31 centos7s named[1287]: error (network unreachable) resolving 'www.oracle.com/A/IN': 2001:500:2f::f#53
Sep 11 10:51:31 centos7s named[1287]: error (network unreachable) resolving 'www.oracle.com/A/IN': 2001:500:1::803f:235#53
Sep 11 10:51:31 centos7s named[1287]: error (network unreachable) resolving 'www.oracle.com/A/IN': 2001:7fe::53#53
Sep 11 10:51:31 centos7s named[1287]: error (network unreachable) resolving './NS/IN': 2001:500:2f::f#53
Sep 11 10:51:31 centos7s named[1287]: error (network unreachable) resolving './NS/IN': 2001:500:1::803f:235#53
Sep 11 10:51:31 centos7s named[1287]: error (network unreachable) resolving './NS/IN': 2001:7fe::53#53

/var/named/data/named.run

error (network unreachable) resolving 'centos7s/A/IN': 2001:7fd::1#53
error (network unreachable) resolving 'centos7s/AAAA/IN': 2001:7fd::1#53
error (network unreachable) resolving './NS/IN': 2001:503:ba3e::2:30#53
error (network unreachable) resolving 'www.oracle.com/A/IN': 2001:503:ba3e::2:30#53
error (network unreachable) resolving 'www.oracle.com/A/IN': 2001:500:2f::f#53
error (network unreachable) resolving 'www.oracle.com/A/IN': 2001:500:1::803f:235#53
error (network unreachable) resolving 'www.oracle.com/A/IN': 2001:7fe::53#53
error (network unreachable) resolving './NS/IN': 2001:500:2f::f#53
error (network unreachable) resolving './NS/IN': 2001:500:1::803f:235#53
error (network unreachable) resolving './NS/IN': 2001:7fe::53#53

ifconfig eno16777736

eno16777736: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.11.22.16  netmask 255.255.255.0  broadcast 10.11.22.255
        inet6 fe80::250:56ff:fe37:6df3  prefixlen 64  scopeid 0x20<link>
        ether 00:50:56:37:6d:f3  txqueuelen 1000  (Ethernet)
        RX packets 43  bytes 5476 (5.3 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 173  bytes 17448 (17.0 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

dig @10.11.22.16 www.oracle.com

; <<>> DiG 9.9.4-RedHat-9.9.4-18.el7_1.1 <<>> @10.11.22.16 www.oracle.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 11700
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.oracle.com.                        IN      A

;; Query time: 0 msec
;; SERVER: 10.11.22.16#53(10.11.22.16)
;; WHEN: Tue Sep 15 08:57:26 CEST 2015
;; MSG SIZE  rcvd: 43

Isn't it similar if I have forwarder or nameserver in resolv.conf, why second works and first not ?

Jacob Evans · Accepted Answer · 2015-09-09 20:22:05Z

Make sure your eth0 configuration has dns-nameservers 10.11.22.16 or whatever you want to use, /etc/resolv.conf is generated from the interface configuration.

Then tell the OS to use bind (10.11.22.16) to resolve DNS.

confirm bind is working with nslookup google.com 10.11.22.16

Here's an example from my system.

First, configure the interface properties to look at localhost.

[root@zbx ~]# cat /etc/sysconfig/network-scripts/ifcfg-em1
HWADDR=00:00:00:00:00:00
TYPE=Ethernet
BOOTPROTO=none
IPADDR=10.0.0.100
NETMASK=255.255.255.0
NETWORK=10.0.0.0
GATEWAY=10.0.0.1
DNS1=127.0.0.1
DEFROUTE=yes
UUID=16785e5b-185d-4375-9b6e-7ed87f872d85
ONBOOT=yes

And here's the basic named config

[root@zbx ~]# cat /etc/named.conf
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//

options {
        listen-on port 53 { 127.0.0.1; };
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        allow-query     { localhost; };

        /*
         - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
         - If you are building a RECURSIVE (caching) DNS server, you need to enable
           recursion.
         - If your recursive DNS server has a public IP address, you MUST enable access
           control to limit queries to your legitimate users. Failing to do so will
           cause your server to become part of large scale DNS amplification
           attacks. Implementing BCP38 within your network would greatly
           reduce such attack surface
        */
        recursion yes;

        dnssec-enable yes;
        dnssec-validation yes;
        dnssec-lookaside auto;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.iscdlv.key";

        managed-keys-directory "/var/named/dynamic";

        pid-file "/run/named/named.pid";
        session-keyfile "/run/named/session.key";
};
logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};
zone "." IN {type hint; file "named.ca"; };
include "/etc/named.root.key";

See how my DNS1 entry matches my listen-on IP.

And in-case you were curious:

[root@zbx ~]# cat /etc/resolv.conf
# Generated by NetworkManager
nameserver 127.0.0.1

with Point resolv to the listen IP you mean I shuld have /etc/resolv.conf as stated in my question? — andrej, Sep 9, 2015 at 17:15
That's depends on your operating system, centos 7 you need to put a line like DNS="10.11.22.16" inside network-scripts/ifcfg-eth0 (or whatever your interface is from ifconfig) — Jacob Evans, Sep 9, 2015 at 17:18

Brandon Xavier · Accepted Answer · 2015-09-11 13:13:37Z

First, and apologies if this sounds ridiculously simplistic, make sure eno16777736 is configured correctly. The fact you had both BOOTPROTO=dhcp and a static configuration is a little suspicious. Not sure which one Centos is going to use. "ifconfig eno16777736" will help you here.

You may want to consider listening on the localhost (if for no other reason than to aid in troubleshooting):

listen-on port 53 { localhost; 10.11.22.16; };

Check this blurb from the dig man page:

Unless it is told to query a specific name server, dig will try each of the servers listed in /etc/resolv.conf. If no usable server addreses are found, dig will send the query to the local host.

Did you notice in your log files you're trying to resolve www.oracle.com rather than forwarding it to 10.11.22.2 as your named.conf seems to suggest you want? To make this (the forwarders) work, you also need a 'forward' (either "first" or "only") statement:

forward only;
forwarders { 10.11.22.2; };

This may not be what you really want though as you're also trying to serve the "domen.lan" zone. You could try configuring as a caching name server which would mean getting rid of the "forwarders" and "forward" statements and letting your server intentionally do the recursive queries (see http://www.zytrax.com/books/dns/ch4/#caching )

You can get rid of the annoying IPv6 related messages in the logs by only using IPv4 protocol. Just add a "-4" (unless of course you think IPv6 should be working) to whatever options you already have in /etc/sysconfig/named :

OPTIONS="-4 <whatever existing options you had here>"

Good luck!

BOOTPROTO is now none, I have added ifconfig eno16777736 to the question, but I do not know how you can see BOOTPROTO in it. I have forwarders in now also. As I understand, I am trying to configure as a caching name server but also want to resolve internet addresses so I need forwarders? — andrej, Sep 15, 2015 at 6:53

Stack Exchange Network

named is not resolving without resolv.conf

/etc/named.conf

/var/named/domen.lan

/etc/resolv.conf

/etc/sysconfig/network-scripts/ifcfg-eno16777736

2 Answers 2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged
centos
bind
.

Hot Network Questions

named is not resolving without resolv.conf

/etc/named.conf

/var/named/domen.lan

/etc/resolv.conf

/etc/sysconfig/network-scripts/ifcfg-eno16777736

2 Answers 2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged centosbind.

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
centos
bind
.