I have a problem with a group of bind9 DNS servers running on Centos 5.10
The servers are on an internal network and are NATed from the internet facing network architecture to allow external resources the ability to lookup external DNS names and IPs that the bind9 servers host.
Bind reverse zone files contents are:
$ORIGIN .
$TTL 86400 ; 1 day
114.X.41.in-addr.arpa. IN SOA dns001dns01.myorg.com. hostmaster.myorg.com. (
;;@ IN SOA dns001dns01.myorg.com. hostmaster.myorg.com. (
2008110934
10800
3600
604800
0 )
IN NS dns001dns01.myorg.com.
IN NS dns001dns02.myorg.com.
IN NS dns001dns03.myorg.com.
$ORIGIN 114.X.41.in-addr.arpa.
2 IN PTR mail.myorg.com.
12 IN PTR exchmail3.myorg.com.
15 IN PTR online.myorg.com.
16 IN PTR exchmail2.myorg.com.
37 IN PTR toprms.myorg.com.
5 IN PTR appraisalworkflow.myorg.com.
14 IN PTR exchmail5.myorg.com.
78 IN PTR exchmail.myorg.com.
Config stanza:
zone "AAA.X.41.in-addr.arpa" IN {
type master;
notify yes;
file "41.X.AAA.rev";
allow-query { any;};
allow-update { key rndckey; };
allow-transfer { 172.30.0.41; 172.30.0.42; 172.20.50.52; };
};
Forward lookups work great, and both forward and reverse lookups work between the servers and on the internal networks that the servers are connected to. However external REVERSE lookups fail.
Is it possible to trace where reverse domain records stop, and which servers are the authoritative reverse lookup servers for a particular domain? ( I hope I am making sense, sorry if I am not.)
I tried to do a dig trace from my computer to the reverse zone (apologies for how it looks, trying to protect the innocent with a little obscurity). The many BAD (HORIZONTAL) REFERRAL indicate something is wrong, but please what could it be? See below:
; <<>> DiG 9.9.5-3-Ubuntu <<>> -x 41.X.AAA.14 +trace
;; global options: +cmd
. 8479 IN NS i.root-servers.net.
. 8479 IN NS k.root-servers.net.
. 8479 IN NS f.root-servers.net.
. 8479 IN NS m.root-servers.net.
. 8479 IN NS g.root-servers.net.
. 8479 IN NS e.root-servers.net.
. 8479 IN NS c.root-servers.net.
. 8479 IN NS h.root-servers.net.
. 8479 IN NS j.root-servers.net.
. 8479 IN NS l.root-servers.net.
. 8479 IN NS b.root-servers.net.
. 8479 IN NS d.root-servers.net.
. 8479 IN NS a.root-servers.net.
. 8479 IN RRSIG NS 8 0 518400 20140603000000 20140526230000 40926 . gsG1xrmc32HKMscG4pEQjgTNg2UOKgXTEZEGjg5lY9X14ADCwNleAwfN XkeAS2cEEJI+Sj8P4gWvKCpgCi7rKSMVPapfelN8huMZHiplWsl0JyaH xkU6WwAa2ciBIayGuY7vsPY2LGudosN4th+5eXnB0gfIJFCuQjhaK3dI 5iM=
;; Received 1270 bytes from 127.0.1.1#53(127.0.1.1) in 1033 ms
AAA.X.41.in-addr.arpa. 13805 IN NS dns001dns03.myorg.com.
AAA.X.41.in-addr.arpa. 13805 IN NS dns001dns01.myorg.com.
AAA.X.41.in-addr.arpa. 13805 IN NS dns001dns02.myorg.com.
;; Received 215 bytes from 192.112.36.4#53(g.root-servers.net) in 331 ms
AAA.X.41.in-addr.arpa. 13805 IN NS dns001dns01.myorg.com.
AAA.X.41.in-addr.arpa. 13805 IN NS dns001dns02.myorg.com.
AAA.X.41.in-addr.arpa. 13805 IN NS dns001dns03.myorg.com.
;; BAD (HORIZONTAL) REFERRAL
;; Received 215 bytes from 41.X.113.52#53(dns001dns03.myorg.com) in 272 ms
114.X.41.in-addr.arpa
zone? i.e.zone "114.X.41.in-addr.arpa" { type master; "
etc.dig -x 41.x.x.14 @41.X.113.52
), does that work? Anything useful in bind's logs?