Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a VPS, which I'm trying to run a website on it and I want it to act as its own nameserver too. But so far, the domain doesn't resolve. Here's what I've done so far:

first of all, in my domain panel, I've set the nameservers to ns1.kpaste.ir, ns2.kpaste.ir and for both I've set the IP of the server.( I sould mention that a while back, I had installed Kloxo, on this same server, and everything was fine, but then I reinstalled my OS, and don't wanna install any control panel(free) no more.).

On the server, I've install bind and configured. Here's the configurations:

options {
   directory "/var/named";
   dump-file "/var/named/data/cache_dump.db";
   statistics-file "/var/named/data/named_stats.txt";

  query-source address * port 53;

controls {
 inet allow { localhost; } keys { rndckey; };

zone "localhost" IN {
   type master;
   file "localhost.zone";
   allow-update { none; };

zone "kpaste.ir" IN {
   type master;
   file "/var/named/kpaste.ir.zone";
   allow-update { none; };

zone "203.150.88.in-addr.arpa" IN {
   type master;
   file "/var/named/203.150.88.rev";
   allow-update { none; };

include "/etc/rndc.key";


$TTL    86400 ; 24 hours could have been written as 24h
$ORIGIN localhost.
; line below = localhost 1D IN SOA localhost root.localhost
@  1D  IN        SOA @  root (
                              2002022401 ; serial
                              3H ; refresh
                              15 ; retry
                              1w ; expire
                              3h ; minimum
@  1D  IN  NS @
   1D  IN  A


$TTL            86400
@                 IN SOA            kpaste.ir.  root.kpaste.ir. (
100     ; serial
1H  ; refresh
1M  ; retry
1W  ; expiry
1D )    ; minimum
@               IN NS           ns1.kpaste.ir.
@               IN NS           ns2.kpaste.ir.
@               IN A  
ns1             IN A  
ns2             IN A  
@               IN MX   10  mail.kpaste.ir.
mail            IN A  
WWW             IN A  


$TTL    86400
@                 IN SOA          kpaste.ir.  info.kpaste.ir. (
100     ; serial
1H  ; refresh
1M  ; retry
1W  ; expiry
1D)     ; minimum
@                IN NS            ns1.kpaste.ir.
1                 IN PTR          binggo.kpaste.ir.

When I run dig kpaste.ir on the server(through ssh), I get this:

; <<>> DiG 9.3.6-P1-RedHat-9.3.6-20.P1.el5_8.6 <<>> kpaste.ir
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 42162
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2

;kpaste.ir.         IN  A

kpaste.ir.      86400   IN  A

kpaste.ir.      86400   IN  NS  ns1.kpaste.ir.
kpaste.ir.      86400   IN  NS  ns2.kpaste.ir.

ns1.kpaste.ir.      86400   IN  A
ns2.kpaste.ir.      86400   IN  A

;; Query time: 0 msec
;; WHEN: Wed Sep 18 04:47:46 2013
;; MSG SIZE  rcvd: 111

But on my local machine, I get this:

; <<>> DiG 9.8.1-P1 <<>> kpaste.ir
;; global options: +cmd
;; connection timed out; no servers could be reached
mnvoh@myh:~$ dig kpaste.ir

; <<>> DiG 9.8.1-P1 <<>> kpaste.ir
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 2113
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;kpaste.ir.         IN  A

;; Query time: 559 msec
;; WHEN: Wed Sep 18 11:27:16 2013
;; MSG SIZE  rcvd: 27

I should elaborate that I have added the proper hostnames, the first entry in front of in /etc/hosts is kpaste.ir and the bind service starts without any erros but I have errors in /var/log/messages. You can view 'messages' here:

It was too long to paste here. In the log it states that foo.bar.com is unreachable, but I can ping that address just alright.

Thanks for any help in advance :)

EDIT: result of iptables -Lnv

[root@kpaste public]# iptables -L -n -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
18811 1005K RH-Firewall-1-INPUT  all  --  *      *             

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 RH-Firewall-1-INPUT  all  --  *      *             

Chain OUTPUT (policy ACCEPT 3778 packets, 308K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain RH-Firewall-1-INPUT (2 references)
 pkts bytes target     prot opt in     out     source               destination         
   34  3496 ACCEPT     all  --  lo     *             
    0     0 ACCEPT     icmp --  *      *             icmp type 255 
    0     0 ACCEPT     esp  --  *      *             
    0     0 ACCEPT     ah   --  *      *             
    0     0 ACCEPT     udp  --  *      *           udp dpt:5353 
    0     0 ACCEPT     udp  --  *      *             udp dpt:631 
    0     0 ACCEPT     tcp  --  *      *             tcp dpt:631 
  464 35080 ACCEPT     all  --  *      *             state RELATED,ESTABLISHED 
    2   164 ACCEPT     tcp  --  *      *             state NEW tcp dpt:22 
    0     0 ACCEPT     tcp  --  *      *             state NEW tcp dpt:80 
    0     0 ACCEPT     tcp  --  *      *             state NEW tcp dpt:443 
    3   180 ACCEPT     tcp  --  *      *             state NEW tcp dpt:53 
    0     0 ACCEPT     tcp  --  *      *             state NEW tcp dpt:25 
    0     0 ACCEPT     tcp  --  *      *             state NEW tcp dpt:110 
    0     0 ACCEPT     tcp  --  *      *             state NEW tcp dpt:143 
    0     0 ACCEPT     tcp  --  *      *             state NEW tcp dpt:993 
    0     0 ACCEPT     tcp  --  *      *             state NEW tcp dpt:995 
18308  966K REJECT     all  --  *      *             reject-with icmp-host-prohibited 
share|improve this question
Honestly, just use your registrars DNS service it will be so much easier for you. –  Iain Sep 18 '13 at 7:14
network unreachable resolving 'ns2.lacnic.net/A/IN': 2001:500:2d::d#53 - You have IPv6 configured, but not properly routed? zone localhost/IN: loading master file localhost.zone: file not found - The file is not found? Put the file in the right place, or fix your path? /etc/named.conf:12: using specific query-source port suppresses port randomization and can be insecure. - Do the needful. –  Zoredache Sep 18 '13 at 7:25
Thanks iain, I appreciate it. Well, I'm checking that out right now, but the thing is, it's kinda personal now :D, you know. I used a third-party dns for a day, but doing so would be pleading defeated. I ain't wanna be no loser in this battle, yo ;) –  MNVOH Sep 18 '13 at 7:28
Thanks Zoredache, I'll check out the things you pointed out, clear the log, and get back to you on it. –  MNVOH Sep 18 '13 at 7:29
MNVOH, if you mouseover the down arrow, you'll see the popup "This question does not show any research effort, it is unclear or not useful". Downvotes without eason may be assumed to be for that one. I disagree with the downvoter, and have in fact upvoted this question, but the downvoter is entitled to his or her opinion, and the mouseover text shows what it may be presumed to be. –  MadHatter Sep 18 '13 at 7:38
show 3 more comments

2 Answers

up vote 2 down vote accepted

Whilst I don't disagree with dsmsk80, I think you have more problems than just missing glue:

[me@risby ~]$ dig ns1.kpaste.ir @

; <<>> DiG 9.9.3-rl.13207.22-P2-RedHat-9.9.3-5.P2.fc19 <<>> ns1.kpaste.ir @
;; global options: +cmd
;; connection timed out; no servers could be reached

So I think you may have some firewall in place, or comparable issue, which is stopping the internet from reaching your new nameserver.

And on a parenthetical note, whilst I don't normally disagree with Iain, I think it is worth running your own nameserver. You'll learn a lot of detail about how the DNS works by the time you have it running, and learning is always worthwhile.

Edit: you've only allowed TCP/53. The DNS is primarily UDP-based, so you need to add an ACCEPT for inbound UDP with dport 53 as well.

share|improve this answer
The firewall is the reason, I've enabled query-source address * port 53; but I think I'll have to check to see if port 53 is allowed. –  MNVOH Sep 18 '13 at 7:51
Oh, and by the way, I like your parethetical note ;) That's exactly why I'm doing all this. Otherwise I had the dns working flawlessly using cloadns.net –  MNVOH Sep 18 '13 at 7:52
If the firewall does turn out to be the reason, don't forget to accept the answer; forgive my comment if you were going to do that anyway! –  MadHatter Sep 18 '13 at 8:09
sure man :). Well it turns out it's not the problem. I opened port 53 in iptables, but nothing changed. I don't suppose that selinux has anything to do with it, does it? –  MNVOH Sep 18 '13 at 8:11
I hesitate to quibble, but we get a lot of iptables questions on here, and some people do occasionally make mistakes in opening ports. To knock the firewall out of the equation, could you paste the output of iptables -L -n -v into your question? –  MadHatter Sep 18 '13 at 8:12
show 3 more comments

You can verify your settings with freely available online DNS reporting tools such viewdns.info. When I check your domain kpaste.ir I can see that there are missing correct glue records which would delegate the domain to your newly configured DNS servers.

enter image description here

To add a glue record for kpaste.ir you will need to contact your name registrar, as the glue records need to be created on the parent name servers.

share|improve this answer
Thanks for the answer, dude. Well, I guess the changes have not been propagated yet. I have changed the nameservers and I'm sure the new ones have glue. But I'll definitely check out viewdns.info again in a few hours –  MNVOH Sep 18 '13 at 7:48
The new ns is not available at viewdns.info. COuld you please check it out and see if you can gimme something based on it? thanks –  MNVOH Sep 18 '13 at 8:12
Currently, I can see correct glue records so you are right that it took some time to propagate the change. –  dsmsk80 Sep 18 '13 at 8:16
Well, the worst problem is the one you don't know about. Thanks anyways bro –  MNVOH Sep 18 '13 at 8:21
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.