Tag Info

Hot answers tagged

12

Look at BIND 9.7.2-P2 in which you have the "rndc addzone" and "rndc delzone" statements that allow you to "remotely" add and remove zones from a running server. I have a paper that provides some examples that I gave at NANOG last month. ftp://ftp.isc.org/isc/pubs/pres/NANOG/50/DNSSEC-NANOG50.pdf While this won't go back and clean up any mess that you ...


12

First and foremost, make sure you own the domain.tld you plan on using (mit.edu). Even if this never connects to the internet, that's not the point. There are huge benefits to having a hierarchy of dns that at least somewhat matches the org. I've only seen this done when there is someone/people to manage that department in terms of IT support. This is in ...


11

In today's world, I do not recommend creating new zones with arbitrary top level domains, as these might make it into "official dns" at any point in time. I personally would favor the subdomain delegation scenario, as it seems to be fitting what you try to do. (Consolidate but give control to engineering) Maybe you can even find a web-front-end for MS DNS ...


7

The allow-query directive is limited to only the trusted acl containing only localhost. This is why you get a response only from localhost. You need to change this to any. Also note the listen-on and listen-on-v6 stanzas need to have IP addresses other than localhost in them - otherwise outside clients will never be able to connect to your nameserver.


7

In BIND's zone file as well as in named.conf, IN is a class. You can omit it in any of the files or in both, in any case if class is not explicitly specified, the default "IN" is used. Regarding the meaning of "IN" - RFC 1035 section 3.2.4: The following CLASS mnemonics and values are defined: IN 1 the Internet ...


7

As sysadmin for an environment with dozens of DNS servers and thousands of domains, I feel (well, felt) your pain. We solved it with puppet and templates. All our domains and servers also have entries in our infrastructure database (even the zones get generated from there, but that's irrelevant for now). So we do roughly the following: Master nameservers: ...


7

No, you cannot just use the IP address as a nameserver. To solve the apparent chicken-vs-egg problem, you need glue records inserted into the parent zone. For example.com., the parent zone would be .com. Your registrar must do this.. So, lets say for sake of argument that your VPS's IP address is 10.1.2.3, and you've got a secondary nameserver running on ...


6

The first name after the word SOA is MNAME, the name server that is authoritative for the zone -- e.g., the name of your name server itself. The second name, RNAME, looks like a domain name but isn't. It's the string you get if you replace the "@" character with "." in the email address of the person responsible for the zone. (Hopefully your email address ...


6

It's not implied. There's nothing implicitly assumed about what systems you want to authorize. You're explicitly setting mx:domain.com by setting mx at the start of the record - they're functionally identical when the SPF entry is on domain.com. That said, you should not run into any validation errors simply because you specify the same thing twice.


6

You need at least one character of whitespace or a tab (credit: @mdpc's edit for the tab reminder) at the start of every line that begins with the "IN". Some administrators are not partial to tabs: in such cases you should try to keep all of these entries aligned with equal whitespace where possible to do so. This is because you are technically leaving out ...


5

Google is not going to let you do a zone transfer from them. Zone transfer permissions are in most cases granted only to a very specific subset of other hosts, and almost never to the public at large.


5

You should have one zone per domain, so everything for domain1.tld would go in domain1.tld.zone and entries for domain2.tld would go in domain2.tld.zone (or wherever your specific software stores zones). What seems like the exception is reverse DNS zones files, but they actually function the same way, just think of the domain being 192.168.1. So anything ...


5

If the server is only authoritative (i.e. serving your domain to third parties) you may safely remove those zones. If the server is providing recursive DNS lookup service to any client (including to itself[*]) then they should remain to prevent queries for those potential local zones going out to the wider internet. [*] i.e. if /etc/resolv.conf contains ...


5

I see two problems with your configuration: Inside the options you have defined allow-query { localhost; };. This instructs your bind DNS server to answer only to localhost and to silently drop all queries from other IP addresses. Your domain is defined only inside your localhost_resolver view. This instructs bind to read and serve the zone's contents only ...


5

Your first record ("blank"/apex/root) can, but probably shouldn't, be a cname; see How to overcome root domain CNAME restrictions? on Stack Overflow: This is often attempted by inexperienced administrators as an obvious way to allow your domain name to also be a host. However, DNS servers like BIND will see the CNAME and refuse to add any other ...


5

You can't (reliably). You can escape the dot (using a \) in the mailbox name, but this isn't always an option. Escaping the dot isn't officially standardized anywhere that I am aware of and although it is widely supported these days there isn't any guarantee that it will be properly parsed by any consumer of that information. See the following resources: ...


5

Firstly, may I congratulate you on what I think is a well-written, clear, and well-researched question, and for not redacting the domain name; that last is hugely helpful in answering. Let me address the substantive issue, if I may: the whois points to a different set of nameservers than those which you have set up to be authoritative: [me@risby ~]$ whois ...


4

I don't know of any way to do this natively to bind9 if you're using flatfile backend. There are various DB-backed systems which can help automate it. Or you can script it: I populate a text file with a list of zones and the primary NS IP for the zone, and stick it on a website that I allow my slaves access to. The slaves fetch this file periodically, and ...


4

Maybe you're looking for a configuration management system like Puppet or CFEngine? There's extra infrastructure involved, but they can handle distributing a lot of configuration stuff, and could easily include this too.


4

You do not need to worry about subnets when it comes to the reverse domain lookup. You should setup your files in a way that makes sense for you. Are you going to have many machines? Can you put them all in one file? If that is the case, simply let the reverse lookup 10.20.. addresses and then list the addresses in this file. [named.conf.local] zone ...


4

Move the closing bracket right behind the 604800, like this: 604800 ) ; Negative Cache TTL and it will work. The way you have written your zone file, the closing bracket is part of the comment, and therefore the parser cannot see it as part of the SOA declaration. When you move it to before the comment starts, the parser can see it.


4

Absolutely fine -- with one critically important caveat: You MUST use short names for your records. foo IN A 127.0.0.1 ; <-- This is fine. bar IN CNAME foo ; <-- This is fine. baz IN CNAME foo.correctdomain.com ; <-- That's fine too. @ ...


4

In PowerDNS, all names are fully qualified, but without a trailing dot. So, not www but www.example.com. Not @ or `` but example.com.


3

To use your own DNS, you would change your name servers to point to your new server. Using GoDaddy, this involves going into your domain control panel, picking your domain, then going to the name servers section: You would then set your nameserver to a URL that points to your server. This could either be a URL on a separate domain, or creating name servers ...


3

MX entries specify which server(s) to contact for delivering emails to a certain domain. The "@" refers to the base domain, and not to an ip address. The MX records have nothing to do with the A records for the same domain, they are completely separate. So if you change the A record for "@", it normally won't affect any MX records. But if you change the ...


3

To start, try verifying that a zone transfer works. On the slave, issue dig @master your-domain. axfr What versions of BIND and what OS?


3

Always thought it means Internet Number. According to Wikipedia is actually just Internet: The CLASS of a record is set to IN (for Internet) for common DNS records involving Internet hostnames, servers, or IP addresses.


3

No, you were correct to remove the old A record and replace it with the CNAME for ghs.googlehosted.com. If a particular entry (e.g. mail.example.com) has a CNAME record, it should not have either A or AAAA records as these will be disregarded. Google does not provide individual IP addresses for each customer to use. Setting the CNAME to ghs.googlehosted.com ...


3

You need a plain IN A 46.105.178.101 line too, because * IN A 46.105.178.101 only maches to subdomains.


3

zone "example.com " { Is that accurately copied? You shouldn't have a space there.



Only top voted, non community-wiki answers of a minimum length are eligible