Hot answers tagged

12

i'd make it via sudo user1 ALL=(root) /usr/sbin/rndc reload user1.domain1.com, /usr/sbin/rndc reload user1.domain2.com user2 ALL=(root) /usr/sbin/rndc reload user2.domain1.com, /usr/sbin/rndc reload user2.domain2.com


6

While I dearly wish that ISC would document these features better for the sake of users with an experience level below "expert", that is wishful thinking. There are two separate implementations of rate limiting within BIND as of 9.11, and they are targeted at solving two completely different problems. DNS RRL The first form of rate-limiting is DNS Response ...


4

There is no difference. The second ends in a dot. Using this method, the PTR record is defined explicitly without taking into consideration the context of the zone the record is residing in. Or rather, the dot suppresses the zone from being appended on the end. The first case is missing the dot at the end so the zone the record is defined in is ...


3

The advantage of zone transfers (AXFR/IXFR) is that it's a standardized way for nameservers to synchronize zone data. It uses the same on-wire format for records that the nameservers need to support for regular responses, so there is no reliance on specific file formats, etc. The implication of this is two-fold: The slave server already knows what is ...


2

From what I can tell the issue doesn't seem to actually involve RPZ, but rather just comes down to that you have a setup that relies on recursion (ie, it appears that you expect to process queries for names that are not in any of your own zones?) but you have recursion turned off in your configuration. recursion no; Now, technically, the lookup of the ...


2

It looks like you set things up right, but that the problem is with how you tried to test it. ;; QUESTION SECTION: ;129.128/25.2.0.192.in-addr.arpa. IN A Your query is for A, not PTR. Because of this you get a result saying that there is no such record (but not NXDOMAIN as the requested name does exist). Ie, dig @localhost ...


2

Honestly, it looks like your ACL is working as intended: query-errors: info: client 93.48.40.139#54822 (cpsc.gov): rate limit drop REFUSED error response to 93.48.40.0/24 You're still getting the queries, but you're refusing to provide an answer to them. The rate limiting code is being invoked because the queries are still coming in volume and having ...


2

Bear in mind that BIND (and the zone files and such in /etc/bind) acts as a directory of sorts: it lists the hosts that exist in example.com, what their IP addresses are, and that sort of thing. /etc/resolv.conf, on the other hand, tells your machine where to look up information in DNS. Just because a machine is running a nameserver doesn't mean that it has ...


2

The normal protocol BIND (and other name servers) use to transfer zone data between servers is AXFR, which has been standardized since RFC 1034. It's difficult to imagine BIND getting it wrong at this point in time, and if they were to do so it would get noticed very widely very quickly. The problem is almost certainly to do with the configuration of your ...


2

If you make sure you have your synchronisation under control outside of BIND, there is no problem with this.


1

Sadly, HTTP clients no nothing about SRV records. You will need to use some sort of reverse proxy to accomplish this.


1

You can either remove all nameserver references from your resolv.conf or you can add a specific nameserver 127.0.0.1 to your file. Note that if you add multiple nameserver entries they are tried in the order they are defined. Note also that the maximum is currently three. You should probably read the documentation, resolv.conf(5).


1

BIND has a large number of built-in empty zones which are enabled by default whenever you have recursion enabled. The purpose of these empty zones is to immediately terminate recursion requests for zones that are known not to exist on the public Internet (reverse zones for reserved networks). A significant chunk of traffic directed at the root servers is ...


1

You need to configure forwarders. To quote from the linked article: Click Start, click Run, type dnsmgmt.msc, and then press ENTER. The DNS Manager console will open. In the console tree, click the name of the DNS server you wish to configure. On the Action menu, click Properties. Click the Forwarders tab. Modify the list of forwarders as ...


1

By default the DNS server listens on all interfaces / IP addresses. Most DNS servers set to allow recursive queries should not be listening on a public interface / IP address. Doing so allows them to be used in a DNS applification attack (a type of DDOS), ref: US-Cert DNS Amplification Attacks. Configure the DNS server to only listen on internal ...


1

Your starting assumption is incorrect: I expect that server A.A.A.A will do the same single query to server B.B.B.B and will return address 172.231.112.37. Let's break this down. The client is asking for an record of type A named downloadcenter.intel.com.. There is no such A record. The recursive server cannot lie and say that the A record value of ...


1

You should do this from the WHM interface from the basic setup section - I haven't used WMH in almost 1 year now and don't have access to one to check, but the documentation indicates that it is in Home >> Server Configuration >> Basic cPanel & WHM Setup More information can be found at ...


1

You could ask your clients to use a rcs tool like git to update their zone files and push them to their homedirs. There, create a git repository with a post receive hook that runs those commands using the sudo rules user1700494 indicates (I would add named-checkzone and named-checkconf as well). For completeness sake, here are the sudo rules user1700494 ...



Only top voted, non community-wiki answers of a minimum length are eligible