4

I am moving from an old server to a new one and everything went well until I got to the DNS server. I cannot get the reverse look-up to work.

I cannot find any misconfiguration but I'm not an expert. rDNS locally works but from other Inet hosts it fails.

named.conf:

zone "5.253.159.in-addr.arpa" IN {

   type master;
   file "5.253.159.in-addr.arpa";
   allow-query { any; };

};

Zone config: (5.253.159.in-addr.arpa)

$TTL 86400

@ IN SOA h4u.be. root.h4u.be. (

  2012083001  ;Serial
   3600        ;Refresh
   1800        ;Retry
   604800      ;Expire
   86400       ;Minimum TTL

)

5.253.159.in-addr.arpa. IN NS ns.h4u.be.
5.253.159.in-addr.arpa. IN NS ns2.h4u.be.

123 IN PTR h4u.be.

Localhost dig result:

;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 65102
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;123.5.253.159.in-addr.arpa. IN PTR

;; ANSWER SECTION:
123.5.253.159.in-addr.arpa. 86400 IN PTR h4u.be.

;; AUTHORITY SECTION:
5.253.159.in-addr.arpa. 86400 IN NS ns2.h4u.be.
5.253.159.in-addr.arpa. 86400 IN NS ns.h4u.be.

;; ADDITIONAL SECTION:
ns.h4u.be. 86400 IN A 159.253.5.123
ns2.h4u.be. 86400 IN A 159.253.5.123

;; Query time: 3 msec
;; SERVER: 159.253.5.123#53(159.253.5.123)
;; WHEN: Thu Aug 30 13:11:58 2012
;; MSG SIZE rcvd: 131

Inet dig result:

;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 43907
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;123.5.253.159.in-addr.arpa. IN PTR

;; AUTHORITY SECTION:
5.253.159.in-addr.arpa. 8032 IN SOA ns3.uxw.nl. ns3.uxw.nl. 0 10800 3600 >604800 3600

;; Query time: 0 msec
;; SERVER: 62.193.206.133#53(62.193.206.133)
;; WHEN: Thu Aug 30 13:12:32 2012
;; MSG SIZE rcvd: 90

2 Answers 2

4

You've set it up correctly on your server, but your server is not marked as authoritative for 123.5.253.159.in-addr.arpa. Your reverse DNS is managed by your ISP (the whole 5.253.159.in-addr.arpa zone):

; <<>> DiG 9.7.3-P3 <<>> ns 5.253.159.in-addr.arpa
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43579
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 2

;; QUESTION SECTION:
;5.253.159.in-addr.arpa.        IN  NS

;; ANSWER SECTION:
5.253.159.in-addr.arpa. 86010   IN  NS  ns3.uxw.nl.
5.253.159.in-addr.arpa. 86010   IN  NS  ns4.uxw.nl.

You have 2 solutions to solve that:

  1. ask your ISP to define the 123.5.253.159.in-addr.arpa record for you on their DNS (ns3.uxw.nl and ns4.uxw.nl),
  2. ask your ISP to delegate the 123.5.253.159.in-addr.arpa record to your server, as per the RFC 2317, this is just a matter of defining a CNAME pointing to a new record on a new zone on your DNS (you then have to define this special zone on your DNS, your ISP will tell you how to name this new zone).

First solution is probably the quickest, but if you change your server's name in the future, you've got to ask them to change it again. Second solution is the most flexible, if your ISP is willing to support RFC 2317. If your ISP is providing you with more than a single address, reverse DNS can be delegated for all of them (the whole range) so you can be in charge. I'd recommend you to ask for that.

This similar question is worth reading.

Trivia: a few years ago (5, or 10 years back), some people were advocating against RFC-2317, because some DNS clients couldn't handle the reverse queries well. However, I don't think that is relevant anymore, RFC-2317 exists for about 15 years now.

1
  • 1
    Just edited the link about RFC-2317 as the link appears to be dead; used Internet Wayback Machine instead. It's amazing that they were advocating that. Seems ridiculous esp as if that's what is allowed not having it will break checks in MTAs (for example). And the statement that it breaks dig -x is nonsense. I never noticed that being a problem even in CentOS 7. It functioned correctly back then and still does.
    – Pryftan
    May 21, 2023 at 10:36
2

Your first step is to contact your uplink provider to make sure they give you the rights to reverse that IP you are trying. My guess is you don't have the ownership to do so.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .