Tag Info

New answers tagged

0

You're specifying a delegation. If you want corp.domain.com to resolve to something, you need (below the delegation): $ORIGIN corp.domain.com. IN A some.ip.add.ress as IN A 192.168.0.5 and verify that the delegation (NS) is correct in the authoritative server for corp.domain.com


0

Maybe formating the error message could help other to interpret it better. From the error message, you have an error in another file failed: unbalanced parentheses dns_master_load: /etc/bind/8.16.172.in-addr.arpa.zone:11: unbalanced parentheses Try to solve the parentheses issue in file /etc/bind/8.16.172.in-addr.arpa.zone And you have also this ...


0

If one of your requirements is that it only be successfully resolved names, you can use the dns.flags.response filter. Useful writeup here. Bind can also log queries to a file (reference) which you could then parse with a wide variety of log/text analysis tools.


0

tcpdump -nni any host <host IP> and port 53 -w <write out file>


0

I'm not sure if 202.159.36.218 is supposed to be an authoritative nameserver for muse.mu or where it comes into the picture. Because of that I can't explain why 202.159.36.218 answers for muse.mu without being recursive. The warning you're seeing is printed from digwhenever it sends a query with RD (recursion desired), and receives a response without RA ...


2

BIND uses SRTT as a variable to decide which DNS to use, so you can get access to it dumping the cache with the command rndc dumpdb will dump the cache in bind's directory (or the directory specified by the dump-file configuration directive). In that file named_dump.db you will be able to get the SRTT of each nameserver, just grep the file for srttp and you ...


1

You can log all queries by running these 2 commands: rndc querylog rndc trace 1 Logs will appear in named.run. You disable logging with rndc trace 0 I don't think it's possible to log queries for a single entry.


1

I shortened the config a bit. Problem was, that disabling DNS Sec was persistent on proxy. After keppen DNS Sec turned off for several minutes, the proxy recognized it. Thanks!


0

Am assuming you've already looked here. Only watching the pid of a network service like named can be misleading. The purpose of the service is to answer network requests, so you should verify that the network port is listening and responding. If the monitor fails, you can then restart/stop ospfd via it's own init script.


1

Edit the hosts file of your local machine (or the server running your DNS) to include the following: 192.168.5.25 mycompanysupport The location of your hosts file will vary depending upon your platform. For Windows NT and Windows 2000: C:\winnt\system32\drivers\etc For Windows XP, Windows Vista, Windows 7 or Windows 8: ...


2

There are a couple ways about this, as i understand: -As of BIND 9.9 there is Response Policy Zone Rewriting (RPZ), which allows an ip or dname match to be rewritten, two of the options are returning NXDOMAIN & NODATA - BIND 9.9 Reference Manual -I've saw method (but haven't tried, i use NSD and this doesn't work) that you can create an empty SOA for ...


0

Removing query-source address * port 53; from BIND config solved the problem.


1

Part of your problem is in your debugging approach. You're running your dig command with the A command-line option which requests only A-records. When you're getting odd results you want to use either no option or the any option so you don't restrict the output: dig any gitlab.myorg.com. My assumption is that doing so will show that you have two DNS ...


1

No, the standards for DNS do not require that nameservers have valid PTR records for their IP addresses.


2

BIND will accept records of arbitrary type on the standardized generic opaque record format: foo.example.com. IN TYPE<typeno> \# <length> <hexencodedRData>


1

Your current DNS firewall strategy for BIND is a little behind the times as you are stealing authority for the root zone. Making a passthrough work in this situation is rather difficult; there is no "whitelisting" functionality that allows you to re-enable recursion for specific DNS records. The solution doesn't scale because you're stuck keeping information ...


0

Check your logging directory permissions. I found in my logs: Jun 5 18:46:38 xsystem named[1116]: isc_stdio_open '/var/log/named.debug.log' failed: permission denied Jun 5 18:46:38 xsystem named[1116]: configuring logging: permission denied Jun 5 18:46:38 xsystem named[1116]: loading configuration: permission denied Jun 5 18:46:38 xsystem named[1116]: ...


5

If you are not using DNSSEC there is no definitive way for the client to see if a reply was produced by a * record in the zone or by an exact match. The client could use heuristic by comparing the answers produced by looking up the desired name to the answers produced by looking up a random string of characters. If the answers are identical it is likely a * ...


7

I had a quick look to see if all the authoritative nameservers have synced. $ dig +nssearch fm.mg SOA ns1.hartwig-at.de. hostmaster.hartwig-at.de. 2015022400 86400 10800 2419200 3600 from server 217.70.177.40 in 8 ms. SOA ns1.hartwig-at.de. hostmaster.hartwig-at.de. 2015060502 86400 10800 2419200 3600 from server 2a00:1158:3::b6 in 25 ms. SOA ...


0

Looking at your dig +sigchase output, we can see that the KSK (SEP) DNSKEY is: ex-mailer.com. 86400 IN DNSKEY 257 3 8 AwEAAaer0hZ5wLS++AsZyIEea+hqFzH4VKCWtFrLIUIqPU368szAfq9q 58adbqXjbizWGVimZEhVgDdUbl+TI3hQQ8eppOpX5yPr49XNv3AP6IbT pUlXAEXUjb6DsTONKciWHxo8r0Es7KL/SJSWmd3aTqtMeIrxb2SSFRmH ...



Top 50 recent answers are included