I have a VPS with BIND set up. It works well for several months.
Recently I want to set up another DNS program to manage foo.example.org
subdomain on this VPS. I've setup these in dns.he.net:
foo.example.org. IN NS vps.exmaple.org. vps.example.org. IN A xx.xx.xx.xx
Since BIND listens on 53/udp, I configured it to listen on port 5353 and in named.conf
:
zone "foo.example.org" { type forward; forwarders{ 127.0.0.1 port 5353; }; };
I think this configuration will forward all queries for *.foo.example.org
to the second DNS program. But when I test it...
On the VPS itself:
dig bar.foo.example.org @127.0.0.1 -p5353
works good.
dig bar.foo.example.org @127.0.0.1
works good.
On my laptop:
dig bar.foo.example.org @vps.example.org -p5353
works good.
dig bar.foo.example.org @vps.example.org
works good.
dig foo.example.org @8.8.8.8 -t ns
works good.
dig bar.foo.example.org @8.8.8.8
returns SERVFAIL
.
Replacing 8.8.8.8 with other DNS servers gets same results and there is nothing wrong with TTL.
Is there anyone knows what's wrong with my configuration? Here is more info:
Other BIND9 configuration:
options { directory "/var/cache/bind"; notify yes; allow-transfer { xx.xx.xx.xx; }; dnssec-enable yes; dnssec-validation auto; auth-nxdomain no; # conform to RFC1035 listen-on-v6 { any; }; recursion yes; allow-recursion { any; }; };
And, specifically, the "second DNS program" is iodine, which tunnels IP over DNS queries. I followed this guide to set it up behind BIND9: http://dev.kryo.se/iodine/wiki/TipsAndTricks#RunningiodinebehindBIND9
PS: I've tried another server with dnsmasq set up and use server=/foo.example.org/127.0.0.1#5353
to test. Still gets errors.
Could anyone help? Thanks in advance.