resolving DNS issues behind firewall on OS X Server

Question

I have a problem that has recently broken single sign-on with our Mac clients (10.5 & 10.6) to an OS X Server (10.5). hosts seem to resolve on clients & server both forward & reverse. subnet is behind firewall and using 10.0.1.xxx.

preliminary tests with nslookup seem to be ok.

are there other tests/tools I could be using. External DNS testing websites won't help as this is behind a firewall...

thanks

EDIT: Here's what I did to break things... I manually removed the block of code below for the zone 0.0.10.in-addr.arpa. I have no 10.0.0.xxx subnet and ServerAdmin annoyingly kept adding it. With no other way to get rid of it I followed the advice of this thread. I guess my question now is does OS X Server require 10.0.0.xxx for some reason? for Kerberos? OD? Network still wonky though getting reports that some services are now working!?! Ah DNS, how I love thee....

server:/etc/dns me$ more publicView.conf.apple
acl "com.apple.ServerAdmin.DNS.public" {localnets;};

//
// This is the view that is shown in Server Admin
// This is an automatically generated file.
// PLEASE DO NOT MANUALLY MODIFY THIS FILE!
// Please make your changes in the named.conf file
//

view "com.apple.ServerAdmin.DNS.public" {
//GUID=A37562D4-E056-2DA7-B4AD-3C4973C63824;

        allow-recursion {"com.apple.ServerAdmin.DNS.public";};

        zone "0.0.10.in-addr.arpa." {
                type master;
                file "db.0.0.10.in-addr.arpa.";
                allow-transfer {none;};
                allow-update {none;};
        };


        zone "domain1.com." {
                type master;
                file "db.domain1.com.";
                allow-transfer {none;};
                allow-update {none;};
        };


        zone "1.0.10.in-addr.arpa." {
                type master;
                file "db.1.0.10.in-addr.arpa.";
                allow-transfer {none;};
                allow-update {none;};
        };


        zone "domain2.com." {
                type master;
                file "db.domain2.com.";
                allow-transfer {none;};
                allow-update {none;};
        };

        zone "." {
                type hint;
                file "named.ca";
        };
        zone "localhost" IN {
                type master;
                file "localhost.zone";
                allow-update { none; };
        };

        zone "0.0.127.in-addr.arpa" IN {
                type master;
                file "named.local";
                allow-update { none; };
        };

};

Answer 1

Kerberos is picky with Leopard and SSO. To verify your DNS setup do a few of the following with the tool dig

Make sure your OD Master Server resolves correctly dig <od.master.fqdn>

Take the IP answer from the previous question and plug it in here dig -x <IP> it should resolve to the FQDN of your OD Server

Third verify the authority section from both questions above has all your DNS servers listed in it

Finally dig your client your signing in from to make sure the forward and reverse answers are correct. (dig == forward dig -x == reverse)

If everything looks OK, check to make sure kerberos is even running. Go to ServerAdmin->OpenDirectory->Overview. If Kerberos is not running start it up by running.

launchctl load /System/Library/LaunchDaemons/edu.mit.Kerberos.krb5kdc.plist

Click refresh in Server Admin, if Kerberos is STILL not running then tail -f /var/log/krb5kdc/kdc.log while executing the above launchctl command. That should give you some more insight as to why Kerberos is not running.

Without more details on your part, this is all I can give you.