I just inherited an intranet where a Mandriva Directory Server 5.0 acts as internal DNS and DHCP server, based on an LDAP server for configuration storage.

The idea is that all intranet hosts get a DNS entry name-ipdaddres where the ip address is in a NATted private space 10.0.*.*

Some of those hosts are also declared on a real public DNS (internet :-) ) pointing to our router public IP address; it takes care of some port-forwarding and http-redirections to allow some intranet services to be available from outside the office without a VPN-like or SSH-tunnel access.

The MDS DNS server thus only covers private ip addresses and relies on public DNS servers for the rest.

Now I have a couple of strictly related questions about this setup; I am not used to mandriva configuration files, and am a bit confused about the correct practice for this 'double' dns setup

  1. WHERE can I modify the 'public' nameservers for MDS?

    Is it in /etc/sysconfig/network-scripts/ifcfg-eth0 , DNS1 and DNS2 ? They have changed since.

  2. What's the best practice to have an host first check the MDS DNS, then use the public DNS? Should hosts only use the MDS DNS, and MDS goes to public DNSs to get the missing entries, or...?


Advancing but still the main issue seems the same.

Please not that the server is currently working and most domain names are resolved, but some are not, and likely it was using and old, outdated public DNS.

Following @TiZon advise I have edited /etc/resolvconf/resolv.conf.d/tail to add the public nameservers.

Now this is what happens. When the main nameserver fails, it does not fallback to the public ones:

dig rueducommerce.com @

; <<>> DiG 9.5.0-P2 <<>> rueducommerce.com @
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 55845
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;rueducommerce.com.             IN      A

;; Query time: 0 msec
;; WHEN: Thu May 19 15:50:55 2011
;; MSG SIZE  rcvd: 35

Dig (or nslookup, same behaviour) without specifying a server will get the fail code and try the next server in /etc/resolv.conf and correctly return the result.

dig rueducommerce.com

;; Got SERVFAIL reply from, trying next server

; <<>> DiG 9.5.0-P2 <<>> rueducommerce.com
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38942
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;rueducommerce.com.             IN      A

rueducommerce.com.      440     IN      A
rueducommerce.com.      440     IN      A

;; Query time: 279 msec
;; WHEN: Thu May 19 15:51:51 2011
;; MSG SIZE  rcvd: 67

but stackoverflow works

dig stackoverflow.com @

; <<>> DiG 9.5.0-P2 <<>> stackoverflow.com @
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40964
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 0

;stackoverflow.com.             IN      A

stackoverflow.com.      1800    IN      A

stackoverflow.com.      38      IN      NS      ns3.serverfault.com.
stackoverflow.com.      38      IN      NS      ns2.serverfault.com.
stackoverflow.com.      38      IN      NS      ns1.serverfault.com.

;; Query time: 230 msec
;; WHEN: Thu May 19 16:02:24 2011
;; MSG SIZE  rcvd: 117

Qhat can I debug to understand why stackoverflow is working but rueducommerce is not?

I could add a public DNS as a secondary DNS in the DHCP (how?) and the clients are probably going to behave better (same as this command line), but is that the correct way to solve this problem? To me it sounds like clients could start to get contraddictory results from the private and public server.

Is there a way for bind/named to go fetch those results or tell the client where to go fetch them?

Hope the question is clear enough, don't hesitate adding comments should I need to state it more clearly or add details.. thanks!


The DNS-settings are stored in /etc/resolv.conf. The server (or other clients that use DHCP and get the same list) will use the first nameserver if available, he will only fall back if the first one doesn't respond (not if he doesn't know it). So you should try to configure the first (private) DNS to relay for the public DNS.

In /etc/resolv.conf the first line should be nameserver Put your public one on the second line: nameserver

If you have resolv.conf.d running (check if folder etc/resolvconf/resolv.conf.d exists), in that case, append the public nameserver to /etc/resolvconf/resolv.conf.d/tail

Now test it from another computer in the network:

nslookup serverfault.com 10.0.X.X

(where 10.0.X.X should be the IP the MDS server has)

  • thanks @TiZon unluckily MDS uses resolvconf and ldap so the /etc/resolv.conf is an auto-generated file... so I'm exactly trying to find out generated from what :-D . Also how to correctly do the relay configuration is exactly what I am trying to figure out :-). – Stefano May 19 '11 at 10:26
  • You probably have resolv.conf.d running, in that case, append the public nameserver to /etc/resolvconf/resolv.conf.d/tail. – Bart De Vos May 19 '11 at 10:30
  • I think I'm almost there - by the way, you should edit your comment into your answer as that may happen often. Now, I still have a problem on some hostnames. dig serverfault.com @ would correctly retrieve the IP address and the authoritative servers, but dig lobusca.com @ would return a ** server can't find lobusca.com: SERVFAIL. Sounds like the old (broken) public dns are still somehow used? It happens with a few other domains too. Maybe I have not restarted/flushed all required services? – Stefano May 19 '11 at 11:06
  • You could try to restart the services. Another question: Is there anything special about the public DNS you are using? Does it work when you try google's DNS ( ? – Bart De Vos May 19 '11 at 11:38
  • I am actually using that google dns already as one of the 2 public dns. edited my question for some more info... still not clear to me how exactly the 'private' dns server and the dns client behave when an entry is not found... – Stefano May 19 '11 at 14:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.