Tag Info

Hot answers tagged

10

There is an article here on setting up NXDOMAIN redirects: BIND 9.9 redirect zones (for NXDOMAIN redirection). Here is the example as given by ISC, but full explanation is available on their page. In named.conf, you add a new "zone": zone "." { type redirect; file "db.redirect" ; }; And then in that zone file db.redirect, you populate it with ...


6

Assuming you're running a dns server (this is serverfault after all and 'opening the port' suggests that's what you're trying to do) then your dport and sport are round the wrong way. You want --dport 53 on the INPUT chain. You've also got the connection state tracking wrong in that case. If you only allow ESTABLISHED on input, how can anyone reach your dns ...


3

Despite what I configure or do. I get always the same result with dig (like if the data comes from other place bit not my zone file): In your output I notice you have 2 dns servers. ;; AUTHORITY SECTION: mydomain.com. 63046 IN NS dns1.kontent.com. mydomain.com. 63046 IN NS dns2.kontent.com. Your domain server is ...


3

Rerun your dig +trace with the +additional flag. I expect it to still fail, but I'll explain what's happening. +trace with +additional will display the nameserver glue (the ADDITIONAL section), which will at least tell you that the TLD nameservers are properly returning the IP address of ns4.dhl.com. The couldn't get address for 'ns4.dhl.com': no more ...


3

Have you checked your firewall is not blocking port 53 TCP - It looks to me that the dhl.com zone is signed and is thus quite large - for large requests DNS falls back from UDP to TCP, and that might explain your problem.


2

Messing around with how your DNS servers find the root zone is a completely wrong approach to solving this problem. I can't imagine how it could possibly help. I can imagine how it could cause lots of things to break. The IP addresses of other resolvers than your own are not of importance to your setup. If you think you need to know the IP addresses of those ...


2

Actually that is the error. You forgot the trailing period on your NS record.


2

The actual file not found errors come across as fairly self-explanatory (no such files exist, I suppose?). However, DS records live in the parent zone, alternatively DLV records live at the DLV server. This means that your step 4 does not exist (as per the guide you linked). Can you really not get the DS records into the parent zone instead? DLV was ...


2

Strategies for seeing why named fails to start: Check named-checkconf -zj output. (named-checkconf as well as named-checkzone should probably be part of your regular workflow, not only for troubleshooting) Check the logs. (named logs to syslog by default, see your named.conf for any logging configuration you have have that may override this) If none of the ...


2

DNS operates best in a Master/Slave scenario. Consider this: you have two nameservers, ns1 and ns2. To help balance the load, you have two NS records in your domain record for both ns1 and ns2. By the very nature of DNS, clients will query the nameservers in random order because nameserver lookups are returned in a random order. See this answer for helpful ...


1

If a DNS server responds, then bind is usually happy. NXDOMAIN is NXDOMAIN, and that's an answer bind is content to use. I don't see in the logs exactly what response bind is getting back, but from the symptoms it seems that this is the case. You may want to set up a scripted action on the gateway to turn off its DNS service if it loses WAN connection. That ...


1

This is possible, except surprisingly no one has made an article about it, even Amazon has not documented it well enough. See my answer here: http://serverfault.com/a/649714/56596


1

If you want to run you own DNS Server, you can have a look at PowerDNS on Git. https://github.com/PowerDNS/pdns/tree/alias You need to build it yourself but in the "alias" Branch is their current implementation of ALIASRR and it works fine.


1

It seems clear that the (a) basic issue named's inability to write to its pid file. Possibilities that come to mind are conflicting entries for named user in passwd file selinux Suggestions for how you might test these theories in comments. Since changing the location of the pid file in named.conf has fixed things it still seems likely that there's an ...


1

While you could set up load balancing software to balance your caching name servers, the easiest way to do it is to simply add more name servers to the network and the clients' configuration. Almost every operating system will randomly choose a name server out of the list it's given by DHCP or it's /etc/resolv.conf file, or whatever that particular OS uses ...


1

This won't work, because zone transfers are handled on a zone-to-zone basis. You can't transfer a full zone to a partial zone. That said, it's possible to define a more specific zone on your master server called ec2.example.net.. Doing this will hide ec2 and all records beneath it in your example.net. zone, so you will need to ensure that all of those ...



Only top voted, non community-wiki answers of a minimum length are eligible