I’ve been struggling with understanding DNS with BIND9.
I’ve used two machines, A and B, connected by a LAN and not for global use.
A is running a name server managing “example” domain and web server named “www”.
B is running a name server managing “sub.example” domain as subdomain with delegation from A and web server named “www” too.
Configuration files are bellow.
"named.conf" for "example" at machine A.
options {
directory "C:\dns\etc";
recursion yes;
version "XXX DNS Server 1.0X";
};
logging {
channel my_file {
file "c:\dns\etc\named.run" versions 5 size 1m;
severity debug 0;
print-category yes;
print-severity yes;
print-time yes;
};
category default {my_file;};
category queries {my_file;};
category lame-servers {my_file;};
category config {my_file;};
};
zone "." {
type hint;
file "named.root";
};
zone "localhost" {
type master;
file "localhost/fwd";
allow-update { none; };
};
zone "0.0.127.in-addr.arpa" {
type master;
file "localhost/rev";
allow-update { none; };
};
zone "example" {
type master;
file "example/fwd";
allow-update { none; };
};
zone "72.11.16.172.in-addr.arpa" {
type master;
file "example/rev";
allow-update { none; };
};
"zone file" for "example" at machine A.
$TTL 1H
@ 1H IN SOA example. postmaster.example. (
200508291 ; Serial
15M ; Refresh
5M ; Retry
1D ; Expire
15M) ; TTL
IN NS ns.example.
IN A 172.16.11.72
ns IN A 172.16.11.72
www IN A 172.16.11.72
sub IN NS ns.sub.example.
ns.sub.example. IN A 172.16.10.37
"named.conf" for "example" at machine B.
options {
directory "C:\dns\etc";
recursion yes;
version "unknown";
allow-transfer {172.16.11.72; };
};
logging {
channel my_file {
file "c:\dns\etc\named.run" versions 5 size 1m;
severity debug 0;
print-category yes;
print-severity yes;
print-time yes;
};
category default {my_file;};
category queries {my_file;};
category lame-servers {my_file;};
category config {my_file;};
};
zone "." {
type hint;
file "named.root";
};
zone "localhost" {
type master;
file "localhost/fwd";
allow-update { none; };
};
zone "0.0.127.in-addr.arpa" {
type master;
file "localhost/rev";
allow-update { none; };
};
zone "sub.example" {
type master;
file "example/fwd";
allow-update { none; };
};
zone "37.10.16.172.in-addr.arpa" {
type master;
file "example/rev";
allow-update { none; };
};
zone "example" {
type forward;
forward only;
forwarders {
172.16.11.72;
};
};
"zone file" for "sub.example" at machine B.
$TTL 1H
@ 1H IN SOA sub.example. postmaster.sub.example. (
200508291 ; Serial
15M ; Refresh
5M ; Retry
1D ; Expire
15M) ; TTL
IN NS ns.sub.example.
IN A 172.16.10.37
ns IN A 172.16.10.37
www IN A 172.16.10.37
Now I have four servers in two machines like below.
"ns.example" and "www.example" in machine A.
"ns.sub.example" and "www.sub.example" in machine B.
I can resolve “www.example” from A and “www.sub.example” from B.
But I can’t resolve “www.sub.example” from A and “www.example” from B.
The messages dig command shows and being written in BIND's log are the bottom.
Both A and B are respond "SERVFAIL" or "connection timed out; no servers could be reached" but there are no error message in BIND's log.
Actually they are Windows2008 servers and I’ve changed windows firewall filter to accept UPD 53 port each other.
Strangely there are no DROP message, even ALLOW message too, in firewall log both A and B.
I mean if I dig "www.example" from A I can see ALLOW message but if I dig "www.sub.exaple" I can’t see ALLOW and DROP message.
I think I have to classify this problem into BIND caused or Windows firewall caused.
What do I have to do first?
For example, I guess DNS query can't be sent to another machine of name server. That's why dig showed message "no servers could be reached".
How can I check DNS query is sent or NOT and why if it’s not sent?
dig at machine A.
C:\dns\bin>dig www.sub.example
; <<>> DiG 9.9.2-P1 <<>> www.sub.example
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 1777
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.sub.example. IN A
;; Query time: 0 msec
;; SERVER: 172.16.11.72#53(172.16.11.72)
;; WHEN: Wed Mar 13 08:42:04 2013
;; MSG SIZE rcvd: 44
C:\dns\bin>dig @172.16.10.37 www.sub.example. a
; <<>> DiG 9.9.2-P1 <<>> @172.16.10.37 www.sub.example. a
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached
dig at machine B.
C:\dns\bin>dig www.example
; <<>> DiG 9.9.2-P1 <<>> www.example
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 39790
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.example. IN A
;; Query time: 4015 msec
;; SERVER: 172.16.10.37#53(172.16.10.37)
;; WHEN: Wed Mar 13 09:40:31 2013
;; MSG SIZE rcvd: 40
C:\dns\bin>dig @172.16.11.72 www.example. a
; <<>> DiG 9.9.2-P1 <<>> @172.16.11.72 www.example
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached
BIND's log at A.
13-Mar-2013 14:43:22.624 general: info: managed-keys-zone: loaded serial 0
13-Mar-2013 14:43:22.624 general: info: zone 72.11.16.172.in-addr.arpa/IN: loaded serial 200508291
13-Mar-2013 14:43:22.624 general: info: zone 0.0.127.in-addr.arpa/IN: loaded serial 200508291
13-Mar-2013 14:43:22.624 general: info: zone example/IN: loaded serial 200508291
13-Mar-2013 14:43:22.624 general: info: zone localhost/IN: loaded serial 200508291
13-Mar-2013 14:43:22.624 general: notice: all zones loaded
13-Mar-2013 14:43:22.624 general: notice: running
13-Mar-2013 14:43:22.624 notify: info: zone example/IN: sending notifies (serial 200508291)
13-Mar-2013 14:43:22.624 notify: info: zone 72.11.16.172.in-addr.arpa/IN: sending notifies (serial 200508291)
13-Mar-2013 14:44:34.515 queries: info: client 172.16.11.72#58221 (www.sub.example): query: www.sub.example IN A +E (172.16.11.72)
13-Mar-2013 14:44:39.515 queries: info: client 172.16.11.72#58221 (www.sub.example): query: www.sub.example IN A +E (172.16.11.72)
13-Mar-2013 14:44:44.515 queries: info: client 172.16.11.72#58221 (www.sub.example): query: www.sub.example IN A +E (172.16.11.72)
BIND's log at B
13-Mar-2013 14:38:27.281 general: info: managed-keys-zone: loaded serial 0
13-Mar-2013 14:38:27.281 general: info: zone 0.0.127.in-addr.arpa/IN: loaded serial 200508291
13-Mar-2013 14:38:27.281 general: info: zone 37.10.16.172.in-addr.arpa/IN: loaded serial 200508291
13-Mar-2013 14:38:27.281 general: info: zone sub.example/IN: loaded serial 200508291
13-Mar-2013 14:38:27.281 general: info: zone localhost/IN: loaded serial 200508291
13-Mar-2013 14:38:27.296 general: notice: all zones loaded
13-Mar-2013 14:38:27.296 general: notice: running
13-Mar-2013 14:38:27.296 notify: info: zone sub.example/IN: sending notifies (serial 200508291)
13-Mar-2013 14:38:27.296 notify: info: zone 37.10.16.172.in-addr.arpa/IN: sending notifies (serial 200508291)
13-Mar-2013 14:46:08.984 queries: info: client 172.16.10.37#58326 (www.sub.example): query: www.sub.example IN A +E (172.16.10.37)
13-Mar-2013 14:46:11.250 queries: info: client 172.16.10.37#58330 (www.example): query: www.example IN A +E (172.16.10.37)
13-Mar-2013 14:46:17.250 queries: info: client 172.16.10.37#58330 (www.example): query: www.example IN A +E (172.16.10.37)