1

Debian 7 + Bind 9 - Fresh install

I bought elfoip.net (to exepriment, so it's mine, and it's only to learn about dns, so please don't accuse me of hidden advertising !)

My registrar told my elfoip.net domain is setup for be authoritative for any elfoip.net subdomains.

To start, I'm trying to simply have access to my www.

[cut]

Is it right? www.elfoip.net is NOT responding. How can I diagnose what's wrong ?

EDIT 1: Update files after all of your suggestion applied, but still not working:

root@elfoip:/etc/bind# cat named.conf.local 
zone "elfoip.net" {
    type master;
    file "/etc/bind/elfoip.net.db";
};

root@elfoip:/etc/bind# cat elfoip.net.db 
$TTL    2d
$ORIGIN elfoip.net.
@       IN      SOA     ns1.elfoip.net. hostmaster.elfoip.net. (
                                2003080801      ; se = serial number
                                12h             ; ref = refresh
                                15m             ; ret = update retry
                                3w              ; ex = expiry
                                2h              ; min = minimum
                        )

@        IN      NS      ns1.elfoip.net.
@        IN      NS      ns2.elfoip.net.

elfoip.net      IN      A       127.0.0.1
@               IN      A       109.168.99.6
www             IN      CNAME   elfoip.net.

Actually NOT WORKING

root@elfoip:/etc/bind# dig @localhost www.elfoip.net

; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> @localhost www.elfoip.net
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 18850
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;www.elfoip.net.            IN  A

;; Query time: 1 msec
;; SERVER: ::1#53(::1)
;; WHEN: Fri Jun 21 14:49:44 2013
;; MSG SIZE  rcvd: 32

Esit of whois: ispeed is where I bought elfoip.net

root@elfoip:/etc/bind# whois elfoip.net|grep 'Name Server'
   Name Server: NS01.ISPEED.IT
   Name Server: NS02.ISPEED.IT

Edit: add this simple ping test from the same machine running bind9

root@elfoip:/etc/bind# ping www.elfoip.net
ping: unknown host www.elfoip.net
root@elfoip:/etc/bind# ping elfoip.net
ping: unknown host elfoip.net

EDIT: Conclusion: I asked to my registar to create a nameserver for my domain on opensrs. Now all works ! Damn

BUT: My config file was really wrong when I posted, so I voted up all of your answers and choosen the most vote as the best. Thanks to everyone.

6
  • 1
    Does bind log anything about the SERVFAIL you receive?
    – arjarj
    Jun 21, 2013 at 12:58
  • I can't fint any log file. Where are they?
    – realtebo
    Jun 21, 2013 at 13:06
  • /var/log/daemon.log used to be the place.
    – arjarj
    Jun 21, 2013 at 13:25
  • In addition to all of the problems mentioned in the answers, your current config has NS records but the targets of those NS records don't have A records. This type of error may end up working for some people (who just use the glue IPs) and fail for others who only use the glue to find the authoritative servers.
    – Ladadadada
    Jun 21, 2013 at 13:31
  • @Ladadadada : can you provide an answer with and example, please ?
    – realtebo
    Jun 21, 2013 at 14:02

6 Answers 6

3

There still is "example.com" in you config, is that correct? Also, the .net nameservers tell me that ns01.ispeed.it and ns02.ispeed.it are configured by the registrar as the nameservers for your domain. These nameservers respond for elfoip.net, but not with the data you show, these seem to be the nameservers of an Italian provider and not yours.

Your registrar needs to change the NS records for your domain, or you need to start using their nameservers.

% whois elfoip.net|grep 'Name Server'
   Name Server: NS01.ISPEED.IT
   Name Server: NS02.ISPEED.IT
% dig  ns  elfoip.net @d.gtld-servers.net|grep '^elfoip'
elfoip.net.     172800  IN  NS  ns01.ispeed.it.
elfoip.net.     172800  IN  NS  ns02.ispeed.it.
% dig +short SOA  elfoip.net @ns01.ispeed.it.  
ns01.ispeed.it. postmaster.elfoip.net. 2013052402 43200 3600 1209600 3600
6
  • Yes, ispeed is where i bought elfoip.net. DNS of Ispeed 'must' point to my ip, so i can serve 3rd levels from my dns. How can I obtain this? And how do you discovered nameservers of ispeed?
    – realtebo
    Jun 21, 2013 at 12:42
  • Added ALL of suggestion, edited question, and executed bind restart, but not working !
    – realtebo
    Jun 21, 2013 at 12:46
  • 1
    I edited my answer to show the commands I used.
    – arjarj
    Jun 21, 2013 at 12:50
  • What does you mean by "Your registrar needs to change the NS records for your domain, or you need to start using their nameservers." What can I do? and what exactly must I ask to my registrar ?
    – realtebo
    Jun 21, 2013 at 12:58
  • 1
    Your domain is currently setup to be served by the nameservers of your registrar, Ispeed. You are now setting up your own nameserver. So either you need to tell Ispeed to change the nameservers of your domain to your IP (or IPs preferably), or you need to login to their control panel (if they have one) and start to manage your domain there. In the latter case you don't need to run your own nameserver.
    – arjarj
    Jun 21, 2013 at 13:03
3

Your current config has NS records but the targets of those NS records don't have A records. This type of error may end up working for some people (who just use the glue IPs) and fail for others who only use the glue to find the authoritative servers.

The records should look like this:

@        IN      NS      ns1.elfoip.net.
@        IN      NS      ns2.elfoip.net.
ns1      IN      A       109.168.99.6
ns2      IN      A       109.168.99.7

Also note that the RFC says that you should have between two and five nameservers and they should be as separated as possible (different networks, different continents, different service providers, etc.) to improve their availability. You can take this with a grain of salt but running just one nameserver on a single VPS is likely to cause more downtime than a more widely distributed setup.

1
  • Applied in production, but after modifying config at registrar side, all was working well.
    – realtebo
    Jun 21, 2013 at 18:34
2

You need to add a . to the end of a fqdn in dns. So make it. Also you need to add an A record so bind knows what the elfoip.net ip is supposed to be

@       IN      A       1.2.3.4
www     IN      CNAME   elfoip.net.

Without the period at the end bind makes the host www.elfoip.net.elfoip.net So the . terminates the hostname so it stops at www.elfoip.net

Also

zone "example.com" {

Should be

zone "elfoip.net" {
3
  • For the A record, must I use private or public IP ?
    – realtebo
    Jun 21, 2013 at 12:37
  • if you want the public to access the URL then public.. but if this is an internal zone that only people on the private LAN will visit.. a private IP is ok
    – Mike
    Jun 21, 2013 at 12:38
  • Added ALL of suggestion, edited question, and executed bind restart, but not working !
    – realtebo
    Jun 21, 2013 at 12:46
1

You are pointing www.elfoip.net to elfoip.net but elfoip.net does not exist. You need to add a A record for elfoip.net.

You also need to end the CNAME with a dot, like so:

www     IN      CNAME   elfoip.net.

And also you specify:

file "/etc/bind/zones/elfoip.net.db";

But from looking at your pwd in your prompt the zone file is:

/etc/bind/elfoip.net.db 

You'll need to correct that too.

3
  • Added ALL of suggestion, edited question, and executed bind restart, but not working !
    – realtebo
    Jun 21, 2013 at 12:46
  • 1
    It appears as if your DNS server is not authoritative for that zone, fix that. Also read the BIND logs to see why it responds with SERVFAIL.
    – faker
    Jun 21, 2013 at 13:05
  • 1) How do you know that .."[my] DNS server is not authoritative for that zone" ? 2) Where can I find log files ?
    – realtebo
    Jun 21, 2013 at 13:07
1

So it looks like there are a few things here.

As a previous post said after a cname you need to include .

www not going to work if you don't have a record for elfoip.net as well. You need an A record or if you are going to send it to a different domain you can use another CNAME.

 IN      A   127.0.0.1

Obviously please replace 127.0.0.1 with your real IP. You will notice that this entry has no prefix which tells DNS that this is an entry for the main domain elfoip.net.

Once you have your DNS entries correct you will need to change your nameservers to point to the server you are setting up with your registrar. Until then however you can test your settings using dig.

dig @localhost www.elfoip.net

4
  • I edited ahain, added dig responsense... please doesn't comment, modify your answer !
    – realtebo
    Jun 21, 2013 at 12:51
  • What does it mean "you will need to change your nameservers to point to the server you are setting up with your registrar." ? msut I edit something else in my VPS ?
    – realtebo
    Jun 21, 2013 at 12:53
  • No, when you lookup a domains whois you will see a nameserver specified. This information is from your registrar and in order for your domain to be pointed to the dns nameserver you are setting up you need to have your registrar (the company you got the domain from) to point to your nameserver.
    – madflojo
    Jun 23, 2013 at 0:50
  • I've obtained this change, now whois show my ns... but ... nothing changes, elfoip.net is a bad 404
    – realtebo
    Jun 23, 2013 at 6:48
0

It seems above discussion you have did all configuration.I have doubt on the zone file's owner and group.Please check It should be "named"

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .