0

I’ve been struggling with understanding DNS with BIND9.

I’ve used two machines, A and B, connected by a LAN and not for global use.

A is running a name server managing “example” domain and web server named “www”.

B is running a name server managing “sub.example” domain as subdomain with delegation from A and web server named “www” too.

Configuration files are bellow.

"named.conf" for "example" at machine A.

options {
            directory "C:\dns\etc"; 
            recursion yes; 
            version "XXX DNS Server 1.0X";

};
logging {
        channel my_file {
        file "c:\dns\etc\named.run" versions 5 size 1m;
        severity debug 0;
        print-category yes;
        print-severity yes;
        print-time yes;
        };
        category default {my_file;};
        category queries {my_file;};
        category lame-servers {my_file;};
        category config {my_file;};
};


zone "." {
            type hint; 
            file "named.root";
};

zone "localhost" {
            type master;
            file "localhost/fwd";
            allow-update { none; };

};
zone "0.0.127.in-addr.arpa" {
            type master;
            file "localhost/rev";
            allow-update { none; };
};
zone "example" {
            type master;
            file "example/fwd";
            allow-update { none; };  

};
zone "72.11.16.172.in-addr.arpa" {
            type master;
            file "example/rev";
            allow-update { none; };
};

"zone file" for "example" at machine A.

$TTL 1H
@ 1H    IN SOA example. postmaster.example. (
    200508291  ; Serial
          15M  ; Refresh
           5M  ; Retry
           1D  ; Expire
          15M) ; TTL

        IN  NS  ns.example.
        IN  A   172.16.11.72
ns      IN  A   172.16.11.72
www     IN  A   172.16.11.72

sub     IN  NS  ns.sub.example.
ns.sub.example. IN  A   172.16.10.37

"named.conf" for "example" at machine B.

options {
            directory "C:\dns\etc"; 
            recursion yes; 
            version "unknown";
            allow-transfer {172.16.11.72; };

};
logging {
        channel my_file {
        file "c:\dns\etc\named.run" versions 5 size 1m;
        severity debug 0;
        print-category yes;
        print-severity yes;
        print-time yes;
        };
        category default {my_file;};
        category queries {my_file;};
        category lame-servers {my_file;};
        category config {my_file;};
};



zone "." {
            type hint; 
            file "named.root";
};

zone "localhost" {
            type master;
            file "localhost/fwd";
            allow-update { none; };

};
zone "0.0.127.in-addr.arpa" {
            type master;
            file "localhost/rev";
            allow-update { none; };
};
zone "sub.example" {
            type master;
            file "example/fwd";
            allow-update { none; };
};
zone "37.10.16.172.in-addr.arpa" {
            type master;
            file "example/rev";
            allow-update { none; };
}; 
zone "example" {
    type forward;
    forward only;
    forwarders {
        172.16.11.72;
    };
};

"zone file" for "sub.example" at machine B.

$TTL 1H
@ 1H    IN SOA sub.example. postmaster.sub.example. (
    200508291  ; Serial
          15M  ; Refresh
           5M  ; Retry
           1D  ; Expire
          15M) ; TTL

        IN  NS  ns.sub.example.
        IN  A   172.16.10.37
ns      IN  A   172.16.10.37
www     IN  A   172.16.10.37

Now I have four servers in two machines like below.

"ns.example"  and "www.example"   in machine A.

"ns.sub.example" and  "www.sub.example" in machine B.

I can resolve “www.example” from A and “www.sub.example” from B.

But I can’t resolve “www.sub.example” from A and “www.example” from B.

The messages dig command shows and being written in BIND's log are the bottom.

Both A and B are respond "SERVFAIL" or "connection timed out; no servers could be reached" but there are no error message in BIND's log.

Actually they are Windows2008 servers and I’ve changed windows firewall filter to accept UPD 53 port each other.

Strangely there are no DROP message, even ALLOW message too, in firewall log both A and B.

I mean if I dig "www.example" from A I can see ALLOW message but if I dig "www.sub.exaple" I can’t see ALLOW and DROP message.

I think I have to classify this problem into BIND caused or Windows firewall caused.

What do I have to do first?

For example, I guess DNS query can't be sent to another machine of name server. That's why dig showed message "no servers could be reached".

How can I check DNS query is sent or NOT and why if it’s not sent?

dig at machine A.

C:\dns\bin>dig www.sub.example

; <<>> DiG 9.9.2-P1 <<>> www.sub.example
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 1777
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.sub.example.               IN      A

;; Query time: 0 msec
;; SERVER: 172.16.11.72#53(172.16.11.72)
;; WHEN: Wed Mar 13 08:42:04 2013
;; MSG SIZE  rcvd: 44

C:\dns\bin>dig @172.16.10.37 www.sub.example. a

; <<>> DiG 9.9.2-P1 <<>> @172.16.10.37 www.sub.example. a
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

dig at machine B.

C:\dns\bin>dig www.example

; <<>> DiG 9.9.2-P1 <<>> www.example
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 39790
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096

;; QUESTION SECTION:
;www.example.                   IN      A

;; Query time: 4015 msec
;; SERVER: 172.16.10.37#53(172.16.10.37)
;; WHEN: Wed Mar 13 09:40:31 2013
;; MSG SIZE  rcvd: 40

C:\dns\bin>dig @172.16.11.72 www.example. a

; <<>> DiG 9.9.2-P1 <<>> @172.16.11.72 www.example
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

BIND's log at A.

13-Mar-2013 14:43:22.624 general: info: managed-keys-zone: loaded serial 0
13-Mar-2013 14:43:22.624 general: info: zone 72.11.16.172.in-addr.arpa/IN: loaded serial 200508291
13-Mar-2013 14:43:22.624 general: info: zone 0.0.127.in-addr.arpa/IN: loaded serial 200508291
13-Mar-2013 14:43:22.624 general: info: zone example/IN: loaded serial 200508291
13-Mar-2013 14:43:22.624 general: info: zone localhost/IN: loaded serial 200508291
13-Mar-2013 14:43:22.624 general: notice: all zones loaded
13-Mar-2013 14:43:22.624 general: notice: running
13-Mar-2013 14:43:22.624 notify: info: zone example/IN: sending notifies (serial 200508291)
13-Mar-2013 14:43:22.624 notify: info: zone 72.11.16.172.in-addr.arpa/IN: sending notifies (serial 200508291)
13-Mar-2013 14:44:34.515 queries: info: client 172.16.11.72#58221 (www.sub.example): query: www.sub.example IN A +E (172.16.11.72)
13-Mar-2013 14:44:39.515 queries: info: client 172.16.11.72#58221 (www.sub.example): query: www.sub.example IN A +E (172.16.11.72)
13-Mar-2013 14:44:44.515 queries: info: client 172.16.11.72#58221 (www.sub.example): query: www.sub.example IN A +E (172.16.11.72)

BIND's log at B

13-Mar-2013 14:38:27.281 general: info: managed-keys-zone: loaded serial 0
13-Mar-2013 14:38:27.281 general: info: zone 0.0.127.in-addr.arpa/IN: loaded serial 200508291
13-Mar-2013 14:38:27.281 general: info: zone 37.10.16.172.in-addr.arpa/IN: loaded serial 200508291
13-Mar-2013 14:38:27.281 general: info: zone sub.example/IN: loaded serial 200508291
13-Mar-2013 14:38:27.281 general: info: zone localhost/IN: loaded serial 200508291
13-Mar-2013 14:38:27.296 general: notice: all zones loaded
13-Mar-2013 14:38:27.296 general: notice: running
13-Mar-2013 14:38:27.296 notify: info: zone sub.example/IN: sending notifies (serial 200508291)
13-Mar-2013 14:38:27.296 notify: info: zone 37.10.16.172.in-addr.arpa/IN: sending notifies (serial 200508291)
13-Mar-2013 14:46:08.984 queries: info: client 172.16.10.37#58326 (www.sub.example): query: www.sub.example IN A +E (172.16.10.37)
13-Mar-2013 14:46:11.250 queries: info: client 172.16.10.37#58330 (www.example): query: www.example IN A +E (172.16.10.37)
13-Mar-2013 14:46:17.250 queries: info: client 172.16.10.37#58330 (www.example): query: www.example IN A +E (172.16.10.37)

2 Answers 2

0

There are a couple of things I can think to suggest.

The first is that the return code you are getting in the failed digs is SERVFAIL. There can be several reasons for that, but one that you want to rule out first is that something is preventing name queries between machines. I recognize that you say you have turned off the Windows firewall rule for port 53 UDP, but I would suggest you demonstrate (to yourself, at least) that Machine B can do a "dig @machine-a www.example. a" and get the answer you expect. Then check that Machine A can query the server at Machine B.

Apart from that, it would be very helpful to see your named.conf and any messages named is logging. Showing us named.conf would allow us to check that your zones are specified correctly (most of the RRs in your zone files are relative to the zone origin so it's important to see how the zone is loaded so we can see what the origin really is..) and will help us figure out if either of the machines, or both, are supposed to be performing recursion.

Please provide more information; it will make it much easier to determine what is going on.

EDIT:

The dig output you have provided certainly makes it sound like the servers are not receiving requests from other machines:

; <<>> DiG 9.9.2-P1 <<>> @172.16.10.37 www.sub.example. a
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

and

; <<>> DiG 9.9.2-P1 <<>> @172.16.11.72 www.example
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

that would seem significant, wouldn't you agree?

6
  • I add result of "dig@machine-a www.example. a" from A and from B. And up named.comf.See edited. Mar 13, 2013 at 5:35
  • Yes, I would. And there is no messaged in BIND's log.I think query packet isn't sent anywhere out of machine. Mar 13, 2013 at 7:36
  • Well, something's not getting through anyway.. Mar 13, 2013 at 7:39
  • See edited quetion. Mar 13, 2013 at 8:54
  • "How can I check DNS query is sent or NOT and why if it’s not sent?" Sometimes there's no substitute for a packet sniffer. Wireshark is free, very capable, and pretty easy to use. Mar 13, 2013 at 16:41
0

Assuming that both domais aren't properly registered, since you said they aren't for "global use", I would say that your servers doesn't know each other, and they also don't have information about domain and sub domain.

You have to create a delegation clause on A to tell where the DNS for sub.example is. And a forward clause on B to redirect the queries to example.

1
  • I add my zone file ,see edited.I think "sub.example" already has been delegated . Mar 13, 2013 at 4:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .