Tag Info

New answers tagged

0

It turned out the problem is I didn't register ns4 at Godaddy as a name server for this domain. After I added ns4 at Godaddy, the replication to ns4 becomes realtime.


0

If you have DNS on the ubuntu box, you can also remove the DNS entry from the router's DHCP (so it gives only the router itself as DNS to the client) and add the ubunto as primary DNS server and a fallback as secondary DNS server.


2

If upgrading to Bind 9.10 is a possibility, the "in-view" statement would solve this perfectly ( http://www.zytrax.com/books/dns/ch7/zone.html#in-view ). However, if that's not possible, I noticed something quite interesting that I did not know while looking up "in-view". For slave zones, the "file" parameter (it happens to immediately precede "in-view" in ...


1

Perhaps with a named.conf configuration of: view "sitea" { include "/etc/common_zones.conf"; match-clients {localhost; ...; }; }; view "siteb" { include "/etc/UNcommon_zones.conf"; match-clients {any;}; }; And then common_zones.conf is what it currently is, while over in UNcommon_zones.conf you put in forwarders: zone "..." IN { type forward; ...


2

Perhaps turning recursion off will do the trick: allow-recursion { none; }; Or: recursion no; Explanation: Turning off the forwarders will prevent your DNS from sending requests to another (likely recursive) server. You also need recursion turned off on your own server to prevent it from doing the recursive queries itself.


0

Add a 'forward only;' statement to the forwarded zone: zone "subzone.mydns.example.com" { type forward; forward only; forwarders { 192.168.0.4; }; };


2

It looks like Comcast's servers are deliberately stripping out DNSSEC signatures from the responses they're giving you, so your server cannot validate com. (in this case) even though it knows that one should be signed. This is unlikely to cause any directly noticeable problems, it just leaves you and your users wide open for all the attacks that DNSSEC was ...


1

First, let's clear up a misconception. This statement is not correct: "Bind9 does not resolve example.com, so router uses secondary DNS for that." DNS resolvers do not go thru the list of configured DNS servers until it finds a response it likes. They generally assume all the servers will response correctly and stop after one server responds (positively ...


1

The file format is specified in RFC1034 and parts of RFC1035. It is very old (1987), and not specifically defined for BIND or in light of current features. There is no great wisdom to be had here; it's like that by convention. The format is also designed to be used for things like caches, I believe, though in practice this usage must be terribly rare. In ...


0

Solution: Can't use a symlink inside the chroot. Add to your rc.local, to run in boot: $ cp /etc/resolv.conf /var/named/chroot/etc/resolv.conf This ensures that chrooted bind can use the name servers amazon assigns during cloud init. It will have no problem resolving dns within the chroot.


0

Yes, you not only can have multiple PTR records in the same reverse zone file, if your IP network is 192.168.10.0/24 and you thus have a reverse zone is 10.168.192.in-addr.arpa you don't really have a reasonable alternative solution. It's important to note that the only thing that a reverse zone has a direct relation to is the IP network. The pointer ...


3

As was found based on the discussion in the comments, AppArmor was found to be loaded (based on sudo apparmor_status output). When AppArmor is loaded and has rules in enforce mode it can do things like deny specific processes from accessing anything but specific paths. I wouid assume what is happening here is that it has rules for BIND which ensures that ...


0

You can have an internal server that contains different records than your AWS DNS. However if you want different responses for valid records, you will either need views or, possibly, RPZ records. The split-view setup you seem to be talking about is not that uncommon.


0

As you can see from this TLDP example you can have multiple PTR records in the same zone. $TTL 3D @ IN SOA yourdomain.com. root.yourdomain.com. ( 199609206 ; Serial 28800 ; Refresh 7200 ; Retry ...


0

On Linux, both ufw and docker's rules are implemented on top of netfilter. So is iptables. So it is not possible to get ufw to do some things and get docker rules to do others - all those things will be done by the single underlying netfilter subsystem. The command iptables-save is useful to dump out everything that has been configured for netfilter, ...


7

The change in behaviour seems to be related to this changelog (from RedHat's site): 2015-02-19 12:00:00 Tomas Hozza <thozza@redhat.com> 32:9.8.2-0.35.rc1: - Enable RPZ-NSIP and RPZ-NSDNAME during compilation (#1176476) NSDNAME enables a filtering policy based on authoritative nameserver, one can write for example: a.ns.facebook.com.rpz-nsdname ...


3

When you are testing this you are sending your queries to 172.16.100.66. Your named.config specifies the following addresses: listen-on port 53 { 127.0.0.1; 172.16.100.67; 100.111.100.121; }; Ie, I would expect that named is not listening on the address that you are sending the queries to.


0

Forwarders in the zone file are used when bind has no information for a particular domain that is still part of the authority of the zone. For example, if you have zone foo.com, and you receive a request for user3.bar.foo.com, the forwarders will be queried on what the result should be, unless you have records for the bar.foo.com domain. You will have ...


0

Any query that your nameserver cannot resolve locally will be sent to that address, effectively asking it to resolve the query on your server's behalf (ie a recursive query). This is often done for networking reasons - say you don't want your corporate DNS exposed directly to the Internet, you could create a forrwarder to a DMZ name server, which will query ...


0

If you're really interested in history rather than accuracy, the quickest dirtiest hack you can do is probably make your name server an authoritative master for the domain and recreate the zonefile as frequently as needed through a script. Definitely only recommended for taking over the world though, not for real life. In general if you really want a ...


0

You can, as you say, limit the longest TTL with max-cache-ttl and max-ncache-ttl, either in the BIND options clause, or a view that only applies to your development server. However, that affects the TTL of all lookups, so would increase network/load on a production server and decrease DNS resilience. For BIND 9.3 and above, if you just want to clear the ...


2

Your 104.200.17.225 client was matching the "outside" acl first. Rearranging the order of the acls probably helped, but the more reliable way to do this is to exclude your "trusted" address from "outside": acl "outside" { !173.255.211.166; !104.200.17.225; //this is the client in question !10.8.0.0/24; !10.8.1.0/24; ...


5

$ORIGIN defines a base value from which 'unqualified' name (those without a terminating dot) substitutions are made when processing the zone file. The @ symbol is a short-hand for the $ORIGIN in zone files. Using the short-hand @ or the full name example.com. is therefore equivalent. $ORIGIN can be specified explicitly in the zone file, but is often ...



Top 50 recent answers are included