Tag Info

Hot answers tagged

12

Look at BIND 9.7.2-P2 in which you have the "rndc addzone" and "rndc delzone" statements that allow you to "remotely" add and remove zones from a running server. I have a paper that provides some examples that I gave at NANOG last month. ftp://ftp.isc.org/isc/pubs/pres/NANOG/50/DNSSEC-NANOG50.pdf While this won't go back and clean up any mess that you ...


12

In today's world, I do not recommend creating new zones with arbitrary top level domains, as these might make it into "official dns" at any point in time. I personally would favor the subdomain delegation scenario, as it seems to be fitting what you try to do. (Consolidate but give control to engineering) Maybe you can even find a web-front-end for MS DNS ...


12

First and foremost, make sure you own the domain.tld you plan on using (mit.edu). Even if this never connects to the internet, that's not the point. There are huge benefits to having a hierarchy of dns that at least somewhat matches the org. I've only seen this done when there is someone/people to manage that department in terms of IT support. This is in ...


10

Unless I'm misunderstanding the question, I do this regularly with BIND, and it seems to be fine as long as each zone is absolutely identical. On my primary nameserver, I have named.conf entries that point to the generic zonefile, eg zone "example.com" { type master; file "primary/example.GENERIC"; }; zone "example.co.uk" { type ...


7

These lines are your problem: MYSITE.com. IN NS ns.MYSITE.com MYSITE.com. IN NS ns2.MYSITE.com You need to canonicalise them to stop the domain being reappended: MYSITE.com. IN NS ns.MYSITE.com. MYSITE.com. IN NS ns2.MYSITE.com. This is not the place to ask to be taught about glue records; wikipedia them and read up.


7

No, you cannot just use the IP address as a nameserver. To solve the apparent chicken-vs-egg problem, you need glue records inserted into the parent zone. For example.com., the parent zone would be .com. Your registrar must do this.. So, lets say for sake of argument that your VPS's IP address is 10.1.2.3, and you've got a secondary nameserver running on ...


7

As sysadmin for an environment with dozens of DNS servers and thousands of domains, I feel (well, felt) your pain. We solved it with puppet and templates. All our domains and servers also have entries in our infrastructure database (even the zones get generated from there, but that's irrelevant for now). So we do roughly the following: Master nameservers: ...


7

The allow-query directive is limited to only the trusted acl containing only localhost. This is why you get a response only from localhost. You need to change this to any. Also note the listen-on and listen-on-v6 stanzas need to have IP addresses other than localhost in them - otherwise outside clients will never be able to connect to your nameserver.


7

In BIND's zone file as well as in named.conf, IN is a class. You can omit it in any of the files or in both, in any case if class is not explicitly specified, the default "IN" is used. Regarding the meaning of "IN" - RFC 1035 section 3.2.4: The following CLASS mnemonics and values are defined: IN 1 the Internet ...


6

The first name after the word SOA is MNAME, the name server that is authoritative for the zone -- e.g., the name of your name server itself. The second name, RNAME, looks like a domain name but isn't. It's the string you get if you replace the "@" character with "." in the email address of the person responsible for the zone. (Hopefully your email address ...


6

It's not implied. There's nothing implicitly assumed about what systems you want to authorize. You're explicitly setting mx:domain.com by setting mx at the start of the record - they're functionally identical when the SPF entry is on domain.com. That said, you should not run into any validation errors simply because you specify the same thing twice.


6

You need at least one character of whitespace or a tab (credit: @mdpc's edit for the tab reminder) at the start of every line that begins with the "IN". Some administrators are not partial to tabs: in such cases you should try to keep all of these entries aligned with equal whitespace where possible to do so. This is because you are technically leaving out ...


6

Your first record ("blank"/apex/root) can, but probably shouldn't, be a cname; see How to overcome root domain CNAME restrictions? on Stack Overflow: This is often attempted by inexperienced administrators as an obvious way to allow your domain name to also be a host. However, DNS servers like BIND will see the CNAME and refuse to add any other ...


5

There is in fact a SOA record, it's just not where you're expecting it. Let's take a look at the AUTHORITY section...keep in mind that ns1.nservers.co.uk. is not in any way affiliated with the nic.uk. nameservers, which are authoritative for co.uk.. $ dig @ns1.nservers.co.uk. +norecurse +noall +authority vancemillerkitchensuk.co.uk SOA co.uk. ...


5

You can't (reliably). You can escape the dot (using a \) in the mailbox name, but this isn't always an option. Escaping the dot isn't officially standardized anywhere that I am aware of and although it is widely supported these days there isn't any guarantee that it will be properly parsed by any consumer of that information. See the following resources: ...


5

Firstly, may I congratulate you on what I think is a well-written, clear, and well-researched question, and for not redacting the domain name; that last is hugely helpful in answering. Let me address the substantive issue, if I may: the whois points to a different set of nameservers than those which you have set up to be authoritative: [me@risby ~]$ whois ...


5

The problem is that websitewelcome.com effectively delegated the domain to 1and1: $ dig NS uptowngreenville.com @ns1144.websitewelcome.com ... ;; ANSWER SECTION: uptowngreenville.com. 86400 IN NS ns58.1and1.com. uptowngreenville.com. 86400 IN NS ns57.1and1.com. Also weird, when you trace the resolution, the upstream resolver gives ...


5

I see two problems with your configuration: Inside the options you have defined allow-query { localhost; };. This instructs your bind DNS server to answer only to localhost and to silently drop all queries from other IP addresses. Your domain is defined only inside your localhost_resolver view. This instructs bind to read and serve the zone's contents only ...


5

MYSITE.com. IN NS ns.MYSITE.com MYSITE.com. IN NS ns2.MYSITE.com IN DNS zone file shorthand a resource record without a trailing . is appended with the $ORIGIN, typically the name of the zone and your name-server becomes effectively ns.MYSITE.com.MYSITE.Com. The correct format would have been MYSITE.com. IN NS ns.MYSITE.com. MYSITE.com. IN NS ...


5

The error messages and the referenced RFC2181 5.4.1 pretty much already tells what's wrong: you are having conflicting NS records in your zone and in the parent zone as "glue" records. "Glue" above includes any record in a zone file that is not properly part of that zone, including nameserver records of delegated sub- zones (NS records), ...


5

If the server is only authoritative (i.e. serving your domain to third parties) you may safely remove those zones. If the server is providing recursive DNS lookup service to any client (including to itself[*]) then they should remain to prevent queries for those potential local zones going out to the wider internet. [*] i.e. if /etc/resolv.conf contains ...


5

You do not need to worry about subnets when it comes to the reverse domain lookup. You should setup your files in a way that makes sense for you. Are you going to have many machines? Can you put them all in one file? If that is the case, simply let the reverse lookup 10.20.. addresses and then list the addresses in this file. [named.conf.local] zone ...


5

Google is not going to let you do a zone transfer from them. Zone transfer permissions are in most cases granted only to a very specific subset of other hosts, and almost never to the public at large.


5

You should have one zone per domain, so everything for domain1.tld would go in domain1.tld.zone and entries for domain2.tld would go in domain2.tld.zone (or wherever your specific software stores zones). What seems like the exception is reverse DNS zones files, but they actually function the same way, just think of the domain being 192.168.1. So anything ...


5

You are looking for the notify-source option. From the BIND ARM: notify-source notify-source determines which local source address, and optionally UDP port, will be used to send NOTIFY messages. This address must appear in the slave server's masters zone clause or in an allow-notify clause. This statement sets the notify-source for all zones, ...


4

No. There is no concept of associating identities with DNS packets.


4

I don't know of any way to do this natively to bind9 if you're using flatfile backend. There are various DB-backed systems which can help automate it. Or you can script it: I populate a text file with a list of zones and the primary NS IP for the zone, and stick it on a website that I allow my slaves access to. The slaves fetch this file periodically, and ...


4

Maybe you're looking for a configuration management system like Puppet or CFEngine? There's extra infrastructure involved, but they can handle distributing a lot of configuration stuff, and could easily include this too.


4

Move the closing bracket right behind the 604800, like this: 604800 ) ; Negative Cache TTL and it will work. The way you have written your zone file, the closing bracket is part of the comment, and therefore the parser cannot see it as part of the SOA declaration. When you move it to before the comment starts, the parser can see it.


4

Because the @ is not a valid character for use in DNS names.



Only top voted, non community-wiki answers of a minimum length are eligible