New answers tagged

1

OK, the problem is that the client has an APIPA address (169.254.139.214), which means that it isn't getting an ip address from DHCP. I can see in your screenshots that the DHCP server has a red arrow, which means it hasn't been authorized, which means it won't assign ip addressing information to clients. You need to authorize the DHCP server and then things ...


1

From your router (or whatever is handling DNS resolution), you can delegate queries for ad-related names, say all Those for the ad.example.com domain, to your domain controllers. This would allow non-ad related names to still be resolved even if the domain controllers are down.


0

First check that the DNS record in the error does in fact exist. If not: Make sure the DC is using itself as its primary DNS server. Restart the netlogon service on the DC to re-register the SRV records. Check the records now exist. If they do, ensure your client is using the DC as its primary DNS server and try to join again (but first run 'ipconfig /...


2

Your formatting of the domain name in your query seems to be incorrect, according to http://www.tcpipguide.com/free/t_DNSNameNotationandMessageCompressionTechnique.htm The DNS protocol does not use dots (ASCII 2E) to delineate portions of a domain name...rather it uses length. In your second query, notice that "google" is preceded by ASCII 06, and "com" is ...


5

You solve this by having more than one domain controller running DNS in your environment. A domain-joined client should use only domain controllers for DNS.


2

That wouldn't have any impact whatsoever. The DNS query will start by looking up the sub-domain in its cache and if it's not found, it will look up the NS record for the zone and query it (your DNS server) for the subdomain. It won't even notice the CNAME that worries you.


1

To make sure you are using your DNS and not other name resolution methods like NBT, I would suggest using Fully Qualified Domain Names in form of client.domain.local on clients, in that case, any AD object that is not on DNS wouldn't interfere.


3

You don't. But I have very little knowledge about server. and creating a name server are not compatible. Getting DNS right is quite complicated and really a waste of time as you get a large number of providers that do that for you for a few dollars a year.


0

Thanks for the actual domain :) I think your problem may be that you don't have an MX record for mjp.jp dig -t mx mju.jp ; <<>> DiG 9.8.1-P1 <<>> -t mx mju.jp ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32458 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ...


0

I found this question while asking a similar question: "What are all the ways an SOA record is used?" To add answers to HÃ¥kan Lindqvist's answer here, I would say this: SOA stands for "Start Of Authority". This is a sort of 'anchor' for knowing what server is authoritative for what zone. If you got rid of the SOA record, how would you have that? You might ...


1

Your Cloud Load Balancer won't inspect traffic to find a Host header. You could effectively deny traffic for example.net by forcing SSL if you have a cert for example.com; you'd set the LB to HTTPS only and enable the httpsRedirect option. I'll expect CloudFlare to be able to deny the example.net traffic. Otherwise, look to your web server as you ...


0

Ok so Nginx apparently reeeeeally wants you to symlink your sites-available config files to sites-enabled. After doing this, Nginx started reading these configs. This is intended, nothing wrong here. The issue I am having now is Nginx does not appear to be listening on port 80 at all. I could imagine that nginx is not able to resolve your listen ...


2

Working with a second mx is definitively the way to go for you: Create a second mx entry that has the new IP- address but a lower preference number. As long as the first mx is available, nothing will happen, but DNS- servers will already cache the second mx. As soon as you switch IPs, the first mx will not be available, and ever mail server will -after a ...


0

BIND supports a technique called prefetch. Using prefetch BIND will automatically refresh entries that are about to expire. The following is the syntax of prefetch. sudo vim /etc/bind/named.conf.options ... options { ... prefetch 2 9; }; ... As you can see this has two numbers, the trigger (here 2), and the eligibility (here 9). This tells BIND to ...


0

If you're using Bind9 as your dns server, restart the service sudo service bind9 restart


2

A DNS cache (sometimes called a DNS resolver cache) is a temporary database, maintained by a computer's operating system, that contains records of all recent visits and attempted visits to Web sites and other Internet domains. DNS Cache Poisoning A DNS cache becomes poisoned (sometimes also called "polluted") when unauthorized domain names or IP addresses ...


2

It works as you expect, you can mask your public domain if you add the zone to your internal DNS resolver. If you're using your ISP's DNS resolvers, you will have to set up your own as mentioned in your question. Your internal DNS resolver must be added to the resolv.conf file (or equivalent on Windows) on every machine on your network, and must allow ...


0

To begin with: Yes, this is possible. One approach is to implement split-horizon DNS, which is the facility of a Domain Name System (DNS) implementation to provide different sets of DNS information, selected by, usually, the source address of the DNS request. However, this won't work, if the authoritative name server of your domain is hosted by your ...


4

You must put the A record for the subdomain in the domain's records if it does not have any NS records. You must put the A record for the subdomain in the domain's records if it is a nameserver for itself. (Otherwise, you have a chicken and egg problem.) You may put the A record for the subdomain in the domain's records even if neither of the first two ...


0

Here's a python script that does what you want: #!/usr/bin/env python from dns.resolver import Resolver from re import sub hostsfile='/etc/hosts' proxies = [ 'proxy.us.company.com', 'proxy.eu.company.com', 'proxy.sa.company.com' ] name = 'proxy' def main(): proxy = menu('Select proxy:', proxies) ip = Resolver().query(proxy,'A')[0]....


1

Most operators would expect that the orphan DS record would be ignored. Multiple DS RRs, one or more of which may not not align with the corresponding DNSKEY RRset, can be encountered and this is well-documented. https://tools.ietf.org/html/rfc4035#section-2.4 2.4. Including DS RRs in a Zone The DS resource record establishes authentication chains ...


1

No need of additional software installations. You need only awscli. Here is what I just wrote. It is simple and works like charm. #!/bin/bash -e # # Author: Peycho Dimitrov # # DESCRIPTION # # Create full backup of all hosted Route53 zones / domains in your account. # # REQUIREMENTS # # Available s3 bucket (where your json files will be saved) # ...


0

If you followed the instructions then before adding your custom domain the you'll need to update the config: url: [scheme: "https", host: "mysterious-meadow-6277.herokuapp.com", port: 443], force_ssl: [rewrite_on: [:x_forwarded_proto]]


0

This behavior likely results from the fact that by default CloudFront sets the Host: HTTP request header to the origin hostname, in this case elb.example.com. The application then presumably generates links based on that hostname. If, instead, you configure CloudFront to whitelist that header for forwarding to the origin, the Host header sent by the browser ...


2

Well, your description is very vague A few things first you can check: Make sure the OpenVPN server has the sysctl variable net.ipv4.ip_forward set to 1. You can easily check this using sysctl net.ipv4.ip_forward. In case you need to set it, just to sysctl -w net.ipv4.ip_forward=1 or the server's /etc/sysctl.conf If you want to tunnel all your traffic ...


2

You can configure DNS servers (and additional DNS related settings) via group policy. You can find it in Computer Configuration - Administrative Templates - Network - DNS Client - DNS Servers. There's obviously a bit of a catch-22 here when new machines are spun up that don't necessarily have group policy applied yet. But however you were planning on ...


7

In the DNS context, a TTL defines the duration that a resource record (RR) may be cached by any resolver. NS RRs are part of what is sometimes called the zone's infrastructure records. Infrastructure RRs (which include SOA, NS and MX RRs) are unique in that they return other names not addresses, as such they should be stable and to minimize DNS access can ...


0

I must've misread the SOA record when I looked it up earlier. Turns out the two prebuilt servers (10.0.0.6 and 10.0.0.7) were created when I created my Microsoft Azure Active Directory domain. I connected to the SOA DNS server via RSAT DNS client and was able to add an 'A Record' pointing the local DNS address 'server.training.company.com.au' to the local ...


26

DNS is not just FQDN = IP The important thing about DNS is that it provides more than just A records (hostname = IP). DNS provides different types of records such as MX, CNAME, TXT, etc... that may be required by some software, sometimes. It allows multiple address records, IPv4 + IPv6 records, dynamic addresses, load balancing, geo location based ...


42

Using an IP address ensures that you are not relying on a DNS server. It also has the benefit of preventing attacks through DNS spoofing. Using a FQDN instead of an IP address means that, if you were to migrate your service to a server with a different IP address, you would be able to simply change the record in DNS rather than try and find everywhere that ...


0

I used this article to solve it. In essence, IPv6 was not actually really, truly disabled, so one has to set the registry setting contained in there, and then reboot.


1

Ping and Nslookup make different types of name resolution lookups. See http://superuser.com/questions/495759/why-is-ping-unable-to-resolve-a-name-when-nslookup-works-fine Does Nslookup work? Might also try putting the name in the LMHOSTS file instead of HOSTS. You may also want to run this checklist hosts file ignored, how to troubleshoot?


4

The forwarders that you have configured will only cause problems when running a validating resolver as the Opendns servers do not cooperate when doing DNSSEC validation. I suppose it might mostly work anyway for you as you didn't specify forward only, so named will fall back to resolving things on its own more or less all the time as the forwarders keep ...


2

Per our discussion in the comments, it sounds like you may be confusing the role of a firewall with that of a transparent proxy. Firewalls do not rely upon DNS resolution to implement access policies. There are several reasons for this that I have covered before. The most significant reasons are: Reliance upon an easily spoofed protocol Added software ...


0

The firewall/NAT box may be able to do it and it will only take you several hours to come up with the rule-syntax to achieve it... It may be more straightforward, if these "special" clients accessed a dedicated port -- then the syntax will be easier to figure out. But @kasperd is right -- it is all a work-around...


1

If you're deployed in a VPC and you're using AWS Route53 to manage your domain's DNS, you can create a "Private Hosted Zone" (DNS split view) with the private addresses and associate it with the VPC. Note that you can only use the private zone or the public zone; if there are records in the public zone that are not in the private zone, the DNS lookup will ...


0

You don't want it allowing external DNS lookups. The built-in DNS Forwarder and Resolver are strictly for providing name resolution for your internal machines. If you want a public name server, use something that's designed to be a public name server. The BIND package if you must run it on the firewall, best to use a service provider or something on a ...


0

As a primer, I recommend a quick review of the What happens when two DNS zones intersect on the same server? Q&A. You've already seen that due to my misunderstanding in the comments, but others who have the same question in the future might not have found that yet. What is the difference between these two? Each of the "more specific" domains (i.e. ...


1

First, it helps to understand why the limitation exists. https://deepthought.isc.org/article/AA-01121/0/DNSRPZ-performance-and-scaleability-when-using-multiple-RPZ-zones.html The RPZ mechanism has not changed in BIND 9.10. The documentation in KB article AA-00525 (Building DNS Firewalls with Response Policy Zones (RPZ)is still almost current. ...


1

It depends of the VPN that you are using... usually, Windows resolves everything through the VPN tunnel. Other solutions such as DirectAccess for example, let you define a NRPT to determine how a specific namespace should be resolved.


0

Your DNS records look correct. Since the DNS records look correct, it may be a caching issue. The NS records from the TLD servers have a 48 hour TTL. So if has been less than 48 hours, since you updated the records, you may just have to wait. You can check the caches on the DNS resolvers provided by your own ISP. It is likely one of them has an old record ...


0

Ensure that Network Interfaces is set to All in Services > DNS Resolver Then add a rule like the below in Firewall > Rules > Wan:


5

An Elastic IP can be assigned to an instance. This is not ephemeral like the Public IP assigned to the instance and thus will be maintained across resizes and can be re-assigned to different instances. Information on setting this up can be found here: https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-ip-addressing.html#vpc-eips


1

The IP address (I'll call it just one here, but the concept applies equally well with any number of addresses) which is assigned to the VPS is assigned to the ISP where the VPS is running. In forward DNS, you register a domain name, have it pointed at your name servers, and configure those name servers to serve that zone. In reverse DNS, the owner of the ...


0

Since you're emails are being delivered to multiple Email Providers, each one of those providers process SPF Differently. Some ESP will evaluate the entire SPF, if any part of the SPF record does not conform to standards it will just fail the entire thing. Some ESP will evaluate the SPF in order and as soon as a MATCH is found, it short circuits the SPF. ...


1

You are trying to use "a certificate valid for *.mysite.com" at bar.azurewebsites.net. Of course this doesn't work! The certificate is not valid. You need to either: load a valid separate certificate for bar.azurewebsites.net or replace the *.mysite.com with a multi-domain certificate valid for all of the mysite.com' sites _and_bar.azurewebsites.net` and ...


8

Searching google for ping "us-mid" yields Monitis.com and their IP in Dallas, who also have a DE IP in Frankfurt. From a very well-connected server in France I have 9 ms ping RTT to the DE IP and 111 ms ping RTT to the US-MID IP. For HTTP time-to-response I'd expect double that plus the server's reaction time, for the sake of argument let's say maybe 26 and ...


24

Assuming the graph is http request time it seems fairly reasonable to me. A http request (in the absense of keepalive, fastopen etc) normally requires at least two round trips. Client sends syn Sever receives syn and sends syn-ack Client receives syn-ack and sends ack and request. Server sends response. The speed of light in fiber is about 2*10^8 ...


0

A quick Google search returned this user with the same question: The user took a Wireshark capture and found that when when trying to ping the host, no DNS query was being performed. The explanation for this behaviour was: I believe that nslookup opens a winsock connection on the DNS port and issues a query, whereas ping uses the DNS Client service. ...


18

Any other possible reason in addition to distance from server? The path the packets take.



Top 50 recent answers are included