1

I have a problem with a group of bind9 DNS servers running on Centos 5.10

The servers are on an internal network and are NATed from the internet facing network architecture to allow external resources the ability to lookup external DNS names and IPs that the bind9 servers host.

Bind reverse zone files contents are:

$ORIGIN .
$TTL 86400      ; 1 day
114.X.41.in-addr.arpa. IN   SOA dns001dns01.myorg.com. hostmaster.myorg.com. (
;;@ IN  SOA dns001dns01.myorg.com. hostmaster.myorg.com. (
            2008110934
            10800
            3600
            604800
            0 )
    IN        NS      dns001dns01.myorg.com.
    IN    NS      dns001dns02.myorg.com.
    IN    NS      dns001dns03.myorg.com.

$ORIGIN 114.X.41.in-addr.arpa.

2   IN  PTR mail.myorg.com.
12  IN  PTR exchmail3.myorg.com.
15  IN  PTR online.myorg.com.
16  IN  PTR exchmail2.myorg.com.
37  IN  PTR toprms.myorg.com. 
5   IN  PTR appraisalworkflow.myorg.com.
14  IN  PTR exchmail5.myorg.com.
78  IN  PTR exchmail.myorg.com.

Config stanza:

zone "AAA.X.41.in-addr.arpa" IN {
    type master;
    notify yes;
    file "41.X.AAA.rev";
    allow-query { any;};
    allow-update { key rndckey; };
    allow-transfer { 172.30.0.41; 172.30.0.42; 172.20.50.52; };

};

Forward lookups work great, and both forward and reverse lookups work between the servers and on the internal networks that the servers are connected to. However external REVERSE lookups fail.

Is it possible to trace where reverse domain records stop, and which servers are the authoritative reverse lookup servers for a particular domain? ( I hope I am making sense, sorry if I am not.)

I tried to do a dig trace from my computer to the reverse zone (apologies for how it looks, trying to protect the innocent with a little obscurity). The many BAD (HORIZONTAL) REFERRAL indicate something is wrong, but please what could it be? See below:

        ; <<>> DiG 9.9.5-3-Ubuntu <<>> -x 41.X.AAA.14 +trace  
;; global options: +cmd
.    8479   IN  NS  i.root-servers.net.
.    8479   IN  NS  k.root-servers.net.
.    8479   IN  NS  f.root-servers.net.
.    8479   IN  NS  m.root-servers.net.
.    8479   IN  NS  g.root-servers.net.
.    8479   IN  NS  e.root-servers.net.
.    8479   IN  NS  c.root-servers.net.
.    8479   IN  NS  h.root-servers.net.
.    8479   IN  NS  j.root-servers.net.
.    8479   IN  NS  l.root-servers.net.
.    8479   IN  NS  b.root-servers.net.
.    8479   IN  NS  d.root-servers.net.
.    8479   IN  NS  a.root-servers.net.
.    8479   IN  RRSIG   NS 8 0 518400 20140603000000 20140526230000 40926 . gsG1xrmc32HKMscG4pEQjgTNg2UOKgXTEZEGjg5lY9X14ADCwNleAwfN     XkeAS2cEEJI+Sj8P4gWvKCpgCi7rKSMVPapfelN8huMZHiplWsl0JyaH     xkU6WwAa2ciBIayGuY7vsPY2LGudosN4th+5eXnB0gfIJFCuQjhaK3dI 5iM=
;; Received 1270 bytes from 127.0.1.1#53(127.0.1.1) in 1033 ms

AAA.X.41.in-addr.arpa. 13805    IN  NS  dns001dns03.myorg.com.
AAA.X.41.in-addr.arpa. 13805    IN  NS  dns001dns01.myorg.com.
AAA.X.41.in-addr.arpa. 13805    IN  NS  dns001dns02.myorg.com.
;; Received 215 bytes from 192.112.36.4#53(g.root-servers.net) in 331 ms

AAA.X.41.in-addr.arpa. 13805    IN  NS  dns001dns01.myorg.com.
AAA.X.41.in-addr.arpa. 13805    IN  NS  dns001dns02.myorg.com.
AAA.X.41.in-addr.arpa. 13805    IN  NS  dns001dns03.myorg.com.
;; BAD (HORIZONTAL) REFERRAL
;; Received 215 bytes from 41.X.113.52#53(dns001dns03.myorg.com) in 272 ms
  • Can you add the config stanza that defines the 114.X.41.in-addr.arpa zone? i.e. zone "114.X.41.in-addr.arpa" { type master; " etc. – Flup May 28 '14 at 10:25
  • If you do an external lookup directed at your nameserver (dig -x 41.x.x.14 @41.X.113.52), does that work? Anything useful in bind's logs? – Flup May 28 '14 at 10:45
  • Nothing in bind logs at all ( I grepped my source address in named.run) – SinaOwolabi May 28 '14 at 10:53
  • Does anyone see anything at all? Waiting hopefully! – SinaOwolabi May 28 '14 at 13:14

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.