New answers tagged

0

You need to do two things: Run the kube-proxy on all nodes you want to access the VIPs (virtual IPs) for the services Point the node's DNS in /etc/resolv.conf to point to the DNS server that is running in the kubernetes cluster.


0

Alan Bates, Generally speaking yes you need to modify your DNS for other LAN clients in your network to know how to reach the website. An easy way to think about it is the setting you create in IIS tell the web server what IP address and host name your website to answer to. It does NOT tell other LAN clients how to reach your website. LAN clients send the ...


2

It's possible (DNS does not require much hardware-wise). It was common practice, but is not recommended. The downside of having DNS, Web, etc. On the same box is that when it goes down, everything goes down. There are plenty solid free DNS servers that have great infrastructure Rackspace and Namecheap to mention a few. In my experience the biggest problem ...


0

A helpful forum poster over on AWS helped me to figure it out. It is indeed not a DNS-related issue, but rather a webserver one. In this case, the webserver effectively being AWS S3. It was incorrectly set up with a redirect to (not surprisingly) route requests from the actual domain to the S3 bucket address. Actually I think that the user documentation was ...


0

Go into your DNS server and find the zone for your company website and update the appropriate record to the correct IP from an external DNS server.


3

It is possible but not recommended if you have more than just the web server relying on that planned DNS, i.e your company email, ftp, etc. also using that DNS. From a security standpoint alone, your web server will provide a very big attack surface and you do not want your DNS compromised. Use an online DNS provider which are plenty and cheap instead.


1

Running a web server and a name server on the same machine is possible and common. If you can do so on your machine depends on things in your setup that we can only guess. But if we guess that you have a real, unfiltered Internet connection with real IP addresses (rather than CG-NAT or something like that), then yes, you can.


0

I solved this by using the following GPO setting: Computer Configuration -> Policies -> Administrative Templates -> Network -> DNS Client -> Dynamic update -> Enabled Which is strange, since the behaviour when not configured is enabled. I double checked and we don't have any other Group Policies active concerning DNS, except for the suffix search list.


0

If I understand correctly, you want to resolve your domains to public IP addresses for the clients that reach them through WAN, and to local IP addresses for your LAN clients, that reach your domains through LAN. If so, then yes, it's possible with named and it's called views. Check this article for examples: Understanding views in BIND 9, by example


3

Firstly, just for clarity on include, s5.2 of RFC 4408 says: Only the evaluated result of the referenced SPF record is used, rather than acting as if the referenced SPF record was literally included in the first. As to whether the MX RR in an included record refers to your MX, or the MX of the included domain, I cheerfully concede that OpenSPF's ...


4

You're hiding the answer from yourself with the dig options that remove information from the output, specifically TTL in this case. If we look at the full answer section: ;; ANSWER SECTION: microsoft.com. 3600 IN A 23.96.52.53 microsoft.com. 3600 IN A 191.239.213.197 microsoft.com. 3600 IN A ...


8

When overlapping zones are defined on an authoritative nameserver, the most specific zone is used to provide the answer. A query of example.com. IN A? hits the example.com zone. A query of foo.example.com. IN A? hits the foo.example.com zone. If foo.example.com is defined in the example.com zone, it will be ignored. A query of sub.foo.example.com. IN A? ...


1

After implementing various hotfixes from microsoft and testing each, the one which seemed to solve my problem was https://support.microsoft.com/en-us/kb/968372 Im not sure why changing the cache from 24 to 48 hours fixes resolution issues for a DNS record with a TTL of only an hour, but my issue has gone. Thanks for any help offered.


0

Stephen Hartzell, You have your DNS A record pointing to the public IP of your router and your router is forwarding TCP 80 traffic to the internal IP of your CentOS web server? You're doing it right! A few thoughts though, you mentioned you cannot access your router (from the public IP assigned to the WAN port I must assume?) with TCP 80 being port ...


0

So far, the best I've been able to do, is to setup a Type A Record to point to my router, and then port-forward port 80 on my router to my CentOS VM. - That's exactly how you do it. if I do that, then I can no longer get into my router to make changes - You shouldn't have web access enabled for your router on the WAN/Public interface anyway. You should only ...


0

As it turns out, the only way to get this done wihtout a url redirect record is to have 2 A records: A Record: @ 124.22.22.1 A Record: www 124.22.22.1 This mostly due to I have to use @ as the domain name. Because of this, I can not use cname record as the input will not allow @ and namescheap dns does not use domain name, but @.


0

I would suggest running a "dynamic dns" service - for example dyn.com (there are plenty of them), setting the TTL value for the DNS address to some small value like 60 or 20 seconds, and running a watchdog service that will change the DNS record via dynamic dns service API as soon as you detect that the server is getting full. This will require writing some ...


0

If anyone else runs into this issue, I just wanted to clear up the solution: I went through all the settings available to me on azure, and the only way to solve this issue was to remove the VM from all Security Groups, thus disabling the Azure firewall. The Azure DNS does not affect the filtering. The connection with RedSys works now by using an internal ...


3

Please avoid using both single and double quotes, e.g. '"string"' $computer = 'abc01.somenetwork.net' Get-DnsEntry $computer or $computer = "abc01.somenetwork.net" Get-DnsEntry $computer Both should work fine.


1

This question already has a million answers, but I'm gonna add another one. Here's a little function I wrote for easily doing reverse DNS with dig. Add this to your ~/.bashrc file, reload your shell, and then you can do reverse DNS lookups with revdns 1.2.3.4: function revdns() { octets="" addr="in-addr.arpa" # split the IP address into an ...


0

Try "host" Forward lookup with host: $ host google-public-dns-b.google.com. google-public-dns-b.google.com has address 8.8.4.4 google-public-dns-b.google.com has IPv6 address 2001:4860:4860::8844 Reverse lookup with host: $ host 8.8.4.4 4.4.8.8.in-addr.arpa domain name pointer google-public-dns-b.google.com. Similar to dig Forward lookup with dig: ...


0

As described, it's not possible. If other people are "doing this" then you should ask them. Otherwise, the only answer is to manually enter those records in to your DNS. And this is just one of the reasons that you should create your Active Directory forest in a subdomain.


2

If you were to write www.example.com inside a zone file for example.com. the actual name you have created is www.example.com.example.com. Instead you can append a . to the name to make it absolute rather than relative. In that case you would write www.example.com. Alternatively you could use a relative name and write only www without a . which since it is ...


0

dig @10.10.0.200 mydomain.lan actually shows the error. It should have SOA answered not the A record. basically, the subzone file is needed to investigate further


0

The FQDN (Fully Qualified Domain Name) the is complete name ending with a dot (https://en.wikipedia.org/wiki/Fully_qualified_domain_name) In /etc/hosts you put the full and short name (but no fqdn) 127.0.0.1 localhost 1.2.3.4 mail.example.com mail Forging the email address for locally generated mails is the role of your mailer program or your local mail ...


0

unique.example.com is the correct FQDN, where unique denotes the hostname and example.comis the parent domain. example is not a hostname, and com is a TLD (Top Level Domain), so example.com is not a fqdn and as such is not valid and not same as unique.exampl.com. Read deatils here: What is a fully qualified domain name (FQDN)? A fully qualified ...


1

Well, actually... Conceivably it might be that at least one root name server (say, for the sake of argument, that it'd be named L) is actually a set of hundreds of servers distributed all over the world. And it might be that some entity is interested in testing the setups of DNS zones, and that this entity might have access to this set of machines. It would ...


1

Your starting assumption is incorrect: I expect that server A.A.A.A will do the same single query to server B.B.B.B and will return address 172.231.112.37. Let's break this down. The client is asking for an record of type A named downloadcenter.intel.com.. There is no such A record. The recursive server cannot lie and say that the A record value of ...


0

For the most part, while I would agree with the sentiment about not trusting the big fish to always manage their settings. Since there is really no (direct) profit available from running DNS (let's ignore OpenDNS/Google etc). I have always believed that the root domain servers are very likely run by very very geeky DNS guys who are very adept at what they ...


0

Your nethogs output shows your IP in discussion with port 53 on other IPs (mostly belonging to akam.net). This is normal behavior if you are running a resolving DNS client. The list is growing because your iptables filter is incorrect and blocks dpt:53 also on the OUTPUT chain, which blocks your own resolver.


2

DNS is primarily UDP on port 53. But why are you blocking it in OUTPUT chain as well? Do you not want to resolve any domain name from this machine?


2

DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 Generally DNS traffic is UDP with fallback to TCP. You need to DROP UDP to port 53 too. iptables -I INPUT -p udp --destination-port 53 -j DROP


0

Nevermind, this setup works perfectly! I can just add more forwarders whenever I add a server and won't have to mess with adding more vanity nameservers!


0

I'll be short, "is using a switch for DNS/DHCP good or bad practice" is least of your problems you said nothing about router (at least your story is incomplete), however, this isn't that important now too. usually having 15+ Windows machines means you need to have an AD. in an AD environment you need to have at least one controller, thus a Windows server, ...


11

Yes, precisely so. The globally-scoped address is the one you advertise to the world (which in this case, means list in your AAAA record). The link-scoped address is a very useful feature of ipv6 which makes setting up point-to-point links elegant, but it isn't, as you say, globally-routable, and advertising it to the world will not get you any visitors. ...


0

You're close. Your second line should be server= instead. address=/#/127.0.0.1 server=/google.com/# Whereas address means "Resolve this domain and its subdomains as this address", server means "Ask this nameserver to resolve this domain and its subdomains." The server directive supports # in the second position to mean "the default upstream server". ...


3

The servers DNS needs to point to itself, and the clients DNS needs to point to the server. Servers DNS should be 10.0.0.5 (or 127.0.0.1) Clients DNS should be 10.0.0.5


0

My solution was to simply remove the bind 'zone' entry and let samba have control. I assume they would be conflicting anyway. If you look on the samba docs site.. https://wiki.samba.org/index.php/Setup_a_basic_BIND_installation You will see that they leave out any extra zones other than the 'localhost' ones.


2

That panel is asking you to provide the IP addresses of your DNS SERVERS, which are going to manage the domain you registered; as it appears, you only bought a domain, not a DNS service to actually manage it. You will need to configure your A records (and/or any record at all) for your domain inside your DNS server(s). But before doing that, you'll need to ...


2

It looks like you set things up right, but that the problem is with how you tried to test it. ;; QUESTION SECTION: ;129.128/25.2.0.192.in-addr.arpa. IN A Your query is for A, not PTR. Because of this you get a result saying that there is no such record (but not NXDOMAIN as the requested name does exist). Ie, dig @localhost ...


2

From what I can tell the issue doesn't seem to actually involve RPZ, but rather just comes down to that you have a setup that relies on recursion (ie, it appears that you expect to process queries for names that are not in any of your own zones?) but you have recursion turned off in your configuration. recursion no; Now, technically, the lookup of the ...


1

If you really need to multihome your DC, please follow these step. I took them from there. The document link to old KB, but it's a updated document by a know blogger. The following are the manual steps to configure a Multihomed DC Insure that all the NICS only point to your internal DNS server(s) only and none others, such as your ISP’s DNS servers’ IP ...


0

This could be a permissions issue on your AD. The user who is creating the cluster, or in your case running the validation wizard, must be able to create computer objects/accounts in AD. I would first check that. When running the Failover Cluster Wizards an computer name object (CNO) is created for the cluster, if this fails, you may experience the error ...


2

Yes, you installed an authoritative DNS server on the same domain for which it is not authoritative. This is a common mistake. Simply add the correct A and CNAME records to your internal DNS so that it will properly resolve for your public website, or more properly, rename your internal domain using the TLD of something like .internal, .local, or ...


0

I've just had this here at work. DNS should be case insensitive.... the RFC specifies that .https://tools.ietf.org/html/rfc4343 but doesn't say it MUST be lower case. So we had the pleasure of troubleshooting a host that didn't resolve things right for our internal domain "t.local" p123$ ping p123-db.t.local PING p123-db.t.local (192.168.106.175) ...


2

I found the problem after trying to restart BIND, which caused the server to go offline completely. This prompted me to run named-checkzone, which pointed out an errant "." following the ftp record (see "yyy.yyy.yyy.yyy." in original post). This was causing the file to be ignored whenever the configuration was reloaded. After fixing this, the zone file was ...


0

The way deregistering a service is handled with Apple's mDNS daemon is that upon registering a service the registering process is provided with a service descriptor, and that descriptor is needed to deregister the service. That means that typically only the process that registers a has the necessary info to deregister it. A process can't start up and ...


0

I know this is an old conversation, I just wanted to add my two cents worth of summary... Most of the reverse checks have this in common: they check something from both the forward DNS domain and the reverse domain (eg. the IP subnet). These two domains are not usually controlled by the same entity, especially when one is trying to masquerade as a different ...


2

It does not appear that you ever changed the delegation for this zone. Looking at the chain of delegations the parent zone refers to: applistar.com. 172800 IN NS dns2.applistar.com. applistar.com. 172800 IN NS mx2.applistar.com. dns2.applistar.com. 172800 IN A 211.19.48.186 mx2.applistar.com. ...


1

I know this means that I won't be able to add an AAAA record to the domain, This is wrong. The incompetance of the domain registry has no bearing on the record types you can use (unless they force you to use their servers as the authoritative namesevers in which case I would suggest running far away). but what does this mean for ...



Top 50 recent answers are included