Tag Info

Hot answers tagged

7

The change in behaviour seems to be related to this changelog (from RedHat's site): 2015-02-19 12:00:00 Tomas Hozza <thozza@redhat.com> 32:9.8.2-0.35.rc1: - Enable RPZ-NSIP and RPZ-NSDNAME during compilation (#1176476) NSDNAME enables a filtering policy based on authoritative nameserver, one can write for example: a.ns.facebook.com.rpz-nsdname ...


5

$ORIGIN defines a base value from which 'unqualified' name (those without a terminating dot) substitutions are made when processing the zone file. The @ symbol is a short-hand for the $ORIGIN in zone files. Using the short-hand @ or the full name example.com. is therefore equivalent. $ORIGIN can be specified explicitly in the zone file, but is often ...


3

When you are testing this you are sending your queries to 172.16.100.66. Your named.config specifies the following addresses: listen-on port 53 { 127.0.0.1; 172.16.100.67; 100.111.100.121; }; Ie, I would expect that named is not listening on the address that you are sending the queries to.


3

As was found based on the discussion in the comments, AppArmor was found to be loaded (based on sudo apparmor_status output). When AppArmor is loaded and has rules in enforce mode it can do things like deny specific processes from accessing anything but specific paths. I wouid assume what is happening here is that it has rules for BIND which ensures that ...


2

Try restoring the context on the file (as root): touch /var/log/file # if it doesn't already exist restorecon -v /var/log/file For more info, this should help: http://wiki.centos.org/HowTos/SELinux


1

Your 104.200.17.225 client was matching the "outside" acl first. Rearranging the order of the acls probably helped, but the more reliable way to do this is to exclude your "trusted" address from "outside": acl "outside" { !173.255.211.166; !104.200.17.225; //this is the client in question !10.8.0.0/24; !10.8.1.0/24; ...


1

So I have figured it out. I used command named-checkzone example.com /etc/bind/db.example.com to check my file and it gave me these errors: /var/lib/bind/cable.comcast.com.hosts:9: ignoring out-of-zone data (ns02) /var/lib/bind/cable.comcast.com.hosts:12: ignoring out-of-zone data (westapps) zone cable.comcast.com/IN: has no NS records zone ...


1

I tossed this question at some smart dudes on IRC and got the answer: options { additional-from-auth yes; additional-from-cache yes; } Where both were explicitly set to no in my config. http://www.zytrax.com/books/dns/ch7/queries.html#additional-from-auth additional-from-auth and additional-from-cache control the behaviour when zones have ...


1

The file format is specified in RFC1034 and parts of RFC1035. It is very old (1987), and not specifically defined for BIND or in light of current features. There is no great wisdom to be had here; it's like that by convention. The format is also designed to be used for things like caches, I believe, though in practice this usage must be terribly rare. In ...



Only top voted, non community-wiki answers of a minimum length are eligible