Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I’ve been struggling with understanding DNS with BIND9.

I’ve used two machines, A and B, connected by a LAN and not for global use.

A is running a name server managing “example” domain and web server named “www”.

B is running a name server managing “sub.example” domain as subdomain with delegation from A and web server named “www” too.

Configuration files are bellow.

"named.conf" for "example" at machine A.

options {
            directory "C:\dns\etc"; 
            recursion yes; 
            version "XXX DNS Server 1.0X";

};
logging {
        channel my_file {
        file "c:\dns\etc\named.run" versions 5 size 1m;
        severity debug 0;
        print-category yes;
        print-severity yes;
        print-time yes;
        };
        category default {my_file;};
        category queries {my_file;};
        category lame-servers {my_file;};
        category config {my_file;};
};


zone "." {
            type hint; 
            file "named.root";
};

zone "localhost" {
            type master;
            file "localhost/fwd";
            allow-update { none; };

};
zone "0.0.127.in-addr.arpa" {
            type master;
            file "localhost/rev";
            allow-update { none; };
};
zone "example" {
            type master;
            file "example/fwd";
            allow-update { none; };  

};
zone "72.11.16.172.in-addr.arpa" {
            type master;
            file "example/rev";
            allow-update { none; };
};

"zone file" for "example" at machine A.

$TTL 1H
@ 1H    IN SOA example. postmaster.example. (
    200508291  ; Serial
          15M  ; Refresh
           5M  ; Retry
           1D  ; Expire
          15M) ; TTL

        IN  NS  ns.example.
        IN  A   172.16.11.72
ns      IN  A   172.16.11.72
www     IN  A   172.16.11.72

sub     IN  NS  ns.sub.example.
ns.sub.example. IN  A   172.16.10.37

"named.conf" for "example" at machine B.

options {
            directory "C:\dns\etc"; 
            recursion yes; 
            version "unknown";
            allow-transfer {172.16.11.72; };

};
logging {
        channel my_file {
        file "c:\dns\etc\named.run" versions 5 size 1m;
        severity debug 0;
        print-category yes;
        print-severity yes;
        print-time yes;
        };
        category default {my_file;};
        category queries {my_file;};
        category lame-servers {my_file;};
        category config {my_file;};
};



zone "." {
            type hint; 
            file "named.root";
};

zone "localhost" {
            type master;
            file "localhost/fwd";
            allow-update { none; };

};
zone "0.0.127.in-addr.arpa" {
            type master;
            file "localhost/rev";
            allow-update { none; };
};
zone "sub.example" {
            type master;
            file "example/fwd";
            allow-update { none; };
};
zone "37.10.16.172.in-addr.arpa" {
            type master;
            file "example/rev";
            allow-update { none; };
}; 
zone "example" {
    type forward;
    forward only;
    forwarders {
        172.16.11.72;
    };
};

"zone file" for "sub.example" at machine B.

$TTL 1H
@ 1H    IN SOA sub.example. postmaster.sub.example. (
    200508291  ; Serial
          15M  ; Refresh
           5M  ; Retry
           1D  ; Expire
          15M) ; TTL

        IN  NS  ns.sub.example.
        IN  A   172.16.10.37
ns      IN  A   172.16.10.37
www     IN  A   172.16.10.37

Now I have four servers in two machines like below.

"ns.example"  and "www.example"   in machine A.

"ns.sub.example" and  "www.sub.example" in machine B.

I can resolve “www.example” from A and “www.sub.example” from B.

But I can’t resolve “www.sub.example” from A and “www.example” from B.

The messages dig command shows and being written in BIND's log are the bottom.

Both A and B are respond "SERVFAIL" or "connection timed out; no servers could be reached" but there are no error message in BIND's log.

Actually they are Windows2008 servers and I’ve changed windows firewall filter to accept UPD 53 port each other.

Strangely there are no DROP message, even ALLOW message too, in firewall log both A and B.

I mean if I dig "www.example" from A I can see ALLOW message but if I dig "www.sub.exaple" I can’t see ALLOW and DROP message.

I think I have to classify this problem into BIND caused or Windows firewall caused.

What do I have to do first?

For example, I guess DNS query can't be sent to another machine of name server. That's why dig showed message "no servers could be reached".

How can I check DNS query is sent or NOT and why if it’s not sent?

dig at machine A.

C:\dns\bin>dig www.sub.example

; <<>> DiG 9.9.2-P1 <<>> www.sub.example
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 1777
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.sub.example.               IN      A

;; Query time: 0 msec
;; SERVER: 172.16.11.72#53(172.16.11.72)
;; WHEN: Wed Mar 13 08:42:04 2013
;; MSG SIZE  rcvd: 44

C:\dns\bin>dig @172.16.10.37 www.sub.example. a

; <<>> DiG 9.9.2-P1 <<>> @172.16.10.37 www.sub.example. a
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

dig at machine B.

C:\dns\bin>dig www.example

; <<>> DiG 9.9.2-P1 <<>> www.example
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 39790
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096

;; QUESTION SECTION:
;www.example.                   IN      A

;; Query time: 4015 msec
;; SERVER: 172.16.10.37#53(172.16.10.37)
;; WHEN: Wed Mar 13 09:40:31 2013
;; MSG SIZE  rcvd: 40

C:\dns\bin>dig @172.16.11.72 www.example. a

; <<>> DiG 9.9.2-P1 <<>> @172.16.11.72 www.example
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

BIND's log at A.

13-Mar-2013 14:43:22.624 general: info: managed-keys-zone: loaded serial 0
13-Mar-2013 14:43:22.624 general: info: zone 72.11.16.172.in-addr.arpa/IN: loaded serial 200508291
13-Mar-2013 14:43:22.624 general: info: zone 0.0.127.in-addr.arpa/IN: loaded serial 200508291
13-Mar-2013 14:43:22.624 general: info: zone example/IN: loaded serial 200508291
13-Mar-2013 14:43:22.624 general: info: zone localhost/IN: loaded serial 200508291
13-Mar-2013 14:43:22.624 general: notice: all zones loaded
13-Mar-2013 14:43:22.624 general: notice: running
13-Mar-2013 14:43:22.624 notify: info: zone example/IN: sending notifies (serial 200508291)
13-Mar-2013 14:43:22.624 notify: info: zone 72.11.16.172.in-addr.arpa/IN: sending notifies (serial 200508291)
13-Mar-2013 14:44:34.515 queries: info: client 172.16.11.72#58221 (www.sub.example): query: www.sub.example IN A +E (172.16.11.72)
13-Mar-2013 14:44:39.515 queries: info: client 172.16.11.72#58221 (www.sub.example): query: www.sub.example IN A +E (172.16.11.72)
13-Mar-2013 14:44:44.515 queries: info: client 172.16.11.72#58221 (www.sub.example): query: www.sub.example IN A +E (172.16.11.72)

BIND's log at B

13-Mar-2013 14:38:27.281 general: info: managed-keys-zone: loaded serial 0
13-Mar-2013 14:38:27.281 general: info: zone 0.0.127.in-addr.arpa/IN: loaded serial 200508291
13-Mar-2013 14:38:27.281 general: info: zone 37.10.16.172.in-addr.arpa/IN: loaded serial 200508291
13-Mar-2013 14:38:27.281 general: info: zone sub.example/IN: loaded serial 200508291
13-Mar-2013 14:38:27.281 general: info: zone localhost/IN: loaded serial 200508291
13-Mar-2013 14:38:27.296 general: notice: all zones loaded
13-Mar-2013 14:38:27.296 general: notice: running
13-Mar-2013 14:38:27.296 notify: info: zone sub.example/IN: sending notifies (serial 200508291)
13-Mar-2013 14:38:27.296 notify: info: zone 37.10.16.172.in-addr.arpa/IN: sending notifies (serial 200508291)
13-Mar-2013 14:46:08.984 queries: info: client 172.16.10.37#58326 (www.sub.example): query: www.sub.example IN A +E (172.16.10.37)
13-Mar-2013 14:46:11.250 queries: info: client 172.16.10.37#58330 (www.example): query: www.example IN A +E (172.16.10.37)
13-Mar-2013 14:46:17.250 queries: info: client 172.16.10.37#58330 (www.example): query: www.example IN A +E (172.16.10.37)
share|improve this question
add comment

2 Answers

up vote 0 down vote accepted

There are a couple of things I can think to suggest.

The first is that the return code you are getting in the failed digs is SERVFAIL. There can be several reasons for that, but one that you want to rule out first is that something is preventing name queries between machines. I recognize that you say you have turned off the Windows firewall rule for port 53 UDP, but I would suggest you demonstrate (to yourself, at least) that Machine B can do a "dig @machine-a www.example. a" and get the answer you expect. Then check that Machine A can query the server at Machine B.

Apart from that, it would be very helpful to see your named.conf and any messages named is logging. Showing us named.conf would allow us to check that your zones are specified correctly (most of the RRs in your zone files are relative to the zone origin so it's important to see how the zone is loaded so we can see what the origin really is..) and will help us figure out if either of the machines, or both, are supposed to be performing recursion.

Please provide more information; it will make it much easier to determine what is going on.

EDIT:

The dig output you have provided certainly makes it sound like the servers are not receiving requests from other machines:

; <<>> DiG 9.9.2-P1 <<>> @172.16.10.37 www.sub.example. a
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

and

; <<>> DiG 9.9.2-P1 <<>> @172.16.11.72 www.example
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

that would seem significant, wouldn't you agree?

share|improve this answer
    
I add result of "dig@machine-a www.example. a" from A and from B. And up named.comf.See edited. –  user1345414 Mar 13 '13 at 5:35
    
Yes, I would. And there is no messaged in BIND's log.I think query packet isn't sent anywhere out of machine. –  user1345414 Mar 13 '13 at 7:36
    
Well, something's not getting through anyway.. –  Michael McNally Mar 13 '13 at 7:39
    
See edited quetion. –  user1345414 Mar 13 '13 at 8:54
    
"How can I check DNS query is sent or NOT and why if it’s not sent?" Sometimes there's no substitute for a packet sniffer. Wireshark is free, very capable, and pretty easy to use. –  Michael McNally Mar 13 '13 at 16:41
show 1 more comment

Assuming that both domais aren't properly registered, since you said they aren't for "global use", I would say that your servers doesn't know each other, and they also don't have information about domain and sub domain.

You have to create a delegation clause on A to tell where the DNS for sub.example is. And a forward clause on B to redirect the queries to example.

share|improve this answer
    
I add my zone file ,see edited.I think "sub.example" already has been delegated . –  user1345414 Mar 13 '13 at 4:09
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.