I spun up a new server on AWS using the Ubuntu 14.04 Server AMI. I'm intending to build a public DNS server for our sites. We currently have two others running CentOS, but I was informed that one will be shutdown because it's on old hardware. If nothing else, a good opportunity to learn about BIND!
Here's my current set up on this new (non-functioning) DNS server:
named.conf.options:
options {
directory "/var/cache/bind";
dnssec-validation auto;
auth-nxdomain no; # conform to RFC1035
listen-on-v6 { any; };
listen-on port 53 { any; };
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; };
allow-transfer { none; };
recursion no;
allow-query-cache { none; };
};
zone "test.edu" IN {
type master;
file "/var/named/testedu.db";
allow-update { none; };
};
Then, /var/named/testedu.db:
$TTL 3600
$ORIGIN test.edu.
@ IN SOA dns3.test.edu. isdept.test.edu. (
20150413 ;Serial
10800 ; Refresh after 6 hours
3600 ;Retry
604800 ;Expire
3600 ;TTL
)
;NS Records
IN NS dns3.test.edu.
;mail records
IN MX 5 mail.test.edu.
;Host A records
dns2 IN A 50.19.235.118
dns1 IN A 100.100.219.12
dns3 IN A 52.5.59.8
www IN A 100.100.219.21
test.edu. IN A 100.100.219.21
mail IN A 100.100.219.6
facultyportal IN A 100.100.219.4
So, named-checkconf /etc/bind/named.conf.options
returns nothing, so no errors there.
And named-checkzone test.edu /var/named/testedu.db
returns that it loaded the serial and is OK.
If I run: netstat -an | grep ^udp | grep 53
, I get:
udp 0 0 172.30.1.115:53 0.0.0.0:*
udp 0 0 127.0.0.1:53 0.0.0.0:*
udp6 0 0 :::53 :::*
Which seems right - and shows that BIND is running.
But - when I run nslookup, I get SERVFAIL on any record that this server should be able to return:
user@dns3:/var/named$ nslookup
> server localhost
Default server: localhost
Address: 127.0.0.1#53
> facultyportal.test.edu
Server: localhost
Address: 127.0.0.1#53
** server can't find facultyportal.nwcu.edu: SERVFAIL
Output of named-checkconf -zj:
zone test.edu/IN: loaded serial 20150413
zone stead/IN: loaded serial 1
zone localhost/IN: loaded serial 2
zone 127.in-addr.arpa/IN: loaded serial 1
zone 0.in-addr.arpa/IN: loaded serial 1
zone 255.in-addr.arpa/IN: loaded serial 1
(the stead zone is one that I added as a testing measure. It appears that localhost CAN resolve entries from there)
Is there something I'm missing? Thank you!
facultyportal.test.edu
, notfacultyprotal.nwcu.edu
. Did you runrndc reload
or restartnamed
after updating the zone file?named.conf.options
is the file it actually uses directly. It may be included but there's probably more to your configuration. What doesnamed-checkconf -zj
say, is there anything in the logs and what is listening on 127.0.0.1?