0

This is more of an experiment to learn and understand BIND/NAMED more but here is what I have.

I set my computers DNS to my linux server's IP. I have BIND9 running with the following entry:

$TTL    1 @     IN      SOA     1.2.3.4. google.com. (
                              2013041602                ; Serial
                              1         ; Refresh
                              1         ; Retry
                              10000             ; Expire
                              1 )       ; Negative Cac
home       14400   IN      A       1.2.3.4
*       14400   IN      A       2.2.2.2
space     14400   IN      A       1.2.3.4


1.2.3.4 = My Server IP

If I ping home.google.com I get nothing from my computer at home. If my DNS is pointed to a BIND9 server, shouldn't it take those DNS records?

This is on the server(does Windows have a dig?)

I edited /etc/resolv.conf to use my Linux server as the DNS.

dig home.google.com

; <<>> DiG 9.8.1-P1 <<>> home.google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 2032
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;home.google.com.     IN      A

;; Query time: 0 msec
;; SERVER: 1.2.3.4#53(1.2.3.4)
;; WHEN: Wed Apr 17 10:00:59 2013
;; MSG SIZE  rcvd: 43

NSLOOKUP:

Server:  UnKnown
Address:  1.2.3.4

*** UnKnown can't find home.google.com: Server failed

named.conf

include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";

named.conf.options:

options {
        directory "/var/cache/bind";

        // If there is a firewall between you and nameservers you want
        // to talk to, you may need to fix the firewall to allow multiple
        // ports to talk.  See http://www.kb.cert.org/vuls/id/800113

        // If your ISP provided one or more IP addresses for stable
        // nameservers, you probably want to use them as forwarders.
        // Uncomment the following block, and insert the addresses replacing
        // the all-0's placeholder.

         forwarders {
                75.75.75.75;
                75.75.76.76;
         };

        //========================================================================
        // If BIND logs error messages about the root key being expired,
        // you will need to update your keys.  See https://www.isc.org/bind-keys
        //========================================================================
        dnssec-validation auto;

        auth-nxdomain no;    # conform to RFC1035
        listen-on-v6 { any; };
};

named.conf.local

zone "google.com" {
        type master;
        file "/etc/bind/db.google.com";
};

zone "2.3.4.in-addr.arpa" {
        type master;
        notify no;
        file "/etc/bind/db.192";
};

/etc/bind/named.conf.default-zones

zone "localhost" {
        type master;
        file "/etc/bind/db.local";
};

zone "127.in-addr.arpa" {
        type master;
        file "/etc/bind/db.127";
};

zone "0.in-addr.arpa" {
        type master;
        file "/etc/bind/db.0";
};

zone "255.in-addr.arpa" {
        type master;
        file "/etc/bind/db.255";
};
10
  • 3
    ping is a horrible tool for troubleshooting DNS. Post the output of dig home.google.com.
    – EEAA
    Apr 17, 2013 at 5:46
  • Done. Does Windows have a dig? Apr 17, 2013 at 6:02
  • Windows has nslookup.
    – fuero
    Apr 17, 2013 at 6:03
  • Added with Windows. Apr 17, 2013 at 6:08
  • You can not use a wildcard on the root entry of your domain. Other than that, this is impossible to troubleshoot without seeing your BIND config.
    – pauska
    Apr 17, 2013 at 6:09

1 Answer 1

0

You are mixing two very different things: a DNS server can be a resolver (receiving names from all the possible domains and resolving them by asking the authoritative name servers of the world) or an authoritative server (serving data about your own zones to resolvers). I strongly advise to keep the two separate (on different machines). Otherwise, debugging is really painful.

You configuration seems OK for an authoritative server for the domain google.com except that dig's output show that recursion is available. You should disable it (recursion no;).

The next step is to check that the zone was indeed loaded by the name server. Remember, Unix system administration is looking at log files all the day. Check the log file for named startup messages, you will probably find an error message explaining why the zone was not loaded (alternatively, test the zone with named-checkzone).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .