Tag Info

New answers tagged

1

I find this unlikely. $ORIGIN example.com. sub IN NS ns1.example.net. sub IN CNAME example.net. # named-checkzone example.com test.zone dns_master_load: test.zone:20: sub.example.com: CNAME and other data A quick Google of CNAME and other data shows that this error message has been around as far back as 9.2.4, so I don't feel compelled to look ...


0

Try named-checkzone. named-checkzone <zonename> /var/named/<filename> http://bencane.com/2011/10/06/bind-checking-a-zone-record-for-errors/


2

@Khaled I have an authoritative nameserver on this computer and would like to forbid access to some websites via /etc/hosts. With bind you can use a Response policy zone to get a similar effect. It isn't an /etc/hosts file, but you can get the similar results. ie blocking specific domains. options { ... response-policy { zone "rpz"; }; }; ... ...


1

From the copy-left guide DNS for Rocket Scientists: By default BIND9 will send NOTIFY messages to all the target names (right-hand names) that appear in NS RRs for the zone So you need to add your slave server as a NS entry in db.example.com.inv.zone. Additionally, you may need to add the settings: In the master: notify yes; and allow-transfer { ...


2

With the information that this is about crawlson.com, a quick test suggests the following: The delegation looks like this: crawlson.com. 172800 IN NS ns2.crawlson.com. crawlson.com. 172800 IN NS ns1.crawlson.com. ns2.crawlson.com. 172800 IN A 23.22.4.186 ns1.crawlson.com. 172800 IN A ...


3

Your pro.lan zone specifies a nameserver of server.pro.lan, but does not define that record. You need to add a server IN A record pointing at its IP address. Additionally, your pro.lan zone is what is known as a "forward" zone - it maps names to IP addresses, not numbers to names. PTR records are used to map numbers to names, and therefore PTR records are ...


0

Make a forward zone for pro.lan with an entry for server.pro.lan. NS records always have to be names, and those names must be resolvable. Apparently server.pro.lan is not resolvable currently.


1

You could, assuming that you're using dhcpd, and with some scripting, associate users with either static IPs or DHCP entries. However, depending on what you're trying to achieve, you would likely need to create a separate view for every user. If you're using MS DHCP, I've no idea how those leases are stored, so parsing them for info may become truly ...


4

No. There is no concept of associating identities with DNS packets.


0

apparmor="DENIED" operation="open" profile="/usr/sbin/named" name="/var/named/run-root/etc/named.conf" It says, it need permissions to access these folders. You should add /var/named/** r, in /etc/apparmor.d/usr.sbin.named then it works.


4

I don't believe there is a configuration option that will do what you ask for. However, I also don't believe that the double notifications is really any cause for concern. While it is redundant in this configuration, the overhead it leads to is minimal and typically no problem at all. Generally speaking, receiving multiple notify messages is not outside ...


2

1) (Common) Fwd zone , line 2 dns.bath.local needs a period following dns.bath.local. 2) remove line 9 ====== reverse zone 1) BIND wants that reverse file to be named 100.168.192.in-addr.arpa the domain specified in BINDD reverse files is the name of the IP subnet NOT the name of the forward domain. Your revese file has noting to do with bath.local, ...


4

You are looking for the notify-source option. From the BIND ARM: notify-source notify-source determines which local source address, and optionally UDP port, will be used to send NOTIFY messages. This address must appear in the slave server's masters zone clause or in an allow-notify clause. This statement sets the notify-source for all zones, ...


1

You got the right idea, session.key might not be writeable or the path might not exist. The BIND option key-directory you mention specifies the directory where the public and private DNSSEC key files should be found when performing dynamic update of secure zones. Try to set the BIND option session-keyfile to the pathname of the file into which to write a ...


0

I faced the same situation. My researched led me to the following realization. If you are using views, then dig@local machine will only serve what is in the localhost-view. the localhost-view get refreshed only during restart of the named. But latest zone file (transferred from the master) is still available on the slave and will be served to all queries ...


0

Another solution, add recursion to 10.1.0.0/24 net, by adding this line in /etc/bind/named.conf.options, as follow: allow-recursion { 10.1.0.0/24; };


1

Sure. Set up BIND and declare an authoritative zone for example.com with an A record pointing to 192.168.1.5. You'll probably want to use wireless on your mobile device to have it use your LAN DNS server.


0

The way I read your question is that you're trying to avoid having the AD domain controller host DNS at all. And that's a perfectly valid configuration. You basically have two options. Configure BIND to allow the DCs to perform dynamic updates Manually populate the DCs' DNS entries into BIND after a DC is promoted Option 1 is the most common. And the ...


0

The two main strategies I've dealt with are delegation and forwarding. With delegation, you configure BIND as a slave to the AD server, offloading the query load to the BIND server. As long as AD is still the SOA (ala ADI), then any dynamic updates will still be sent to the AD box. You can still configure other zones on the BIND server, however you can run ...


0

Turns out, samba-tool can be used to achieve static records in dynamic zone. samba-tool dns add <dnsserver> <domain> <hostname> <record type> <ipaddr> -Uadministrator i.e.: samba-tool dns add ns1 example.com host1 A 192.168.1.160 -Uadministrator More about samba-tool: ...


0

Add ns records for foo.com for server1,2,3. Define the zone on both slaves. Increment the serial number on the master.


1

If this is indeed a dynamically updated zone (allow-update / update-policy specified), it is not safe to edit the zone file directly! In such a setup it is BIND that maintains the zone file; buffering changes in the journal file (.jnl) and rewriting the zone file itself periodically. All changes to the zone data are expected to happen through the dynamic ...


0

Solutions (from comments) add allow-recursion in the bind (which was changed from the default permissive settings around bind 9.4) Possible solution: Try using public DNS server like google famous 8.8.8.8/8.8.4.4. Push route of 10.0.0.9 IP to VPN client by adding this line in your server.conf: push "route 10.0.0.9 255.255.255.255" I hope it worked. ...


3

This one is a real pain to troubleshoot if you aren't familiar with the new max-recursion-queries option or why it was added. CVE-2014-8500 was identified in late 2014 as impacting multiple nameserver products, including BIND. The exploit allows a malicious nameservers to craft a chain of referrals that will be followed infinitely, eventually leading to ...


0

In this scenario since all 4 DNS servers contain the same records, the easiest way to do this is: Login to the registrar, and simply replace the old (BinDNS) authorative nameservers with the new ones (WinDNS). Make sure you keep your old (BinDNS) DNS servers running until propagation is complete. Keep in mind that propagation will be TTL+refresh ...



Top 50 recent answers are included