Bind only works Locally - Ping works locally not externally

Question

I am using Bind on a Centos 6.5 server in order resolve subdomains to an IP.

I have *.ddns.example.com and ddns.example.com pointing to my server via A record. I have added a zone for this, see named.conf:

options {
        listen-on port 53 { any; };
        listen-on-v6 port 53 { any; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        allow-query     { any; };
        recursion yes;

        dnssec-enable yes;
        dnssec-validation yes;
        dnssec-lookaside auto;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.iscdlv.key";

        managed-keys-directory "/var/named/dynamic";
        };

logging {
    channel default_debug {
            file "data/named.run";
            severity dynamic;
    };
};


zone "." IN {
    type hint;
    file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";




zone "ddns.example.com" {
        type master;
        file "/var/named/ddns.example.com.hosts";
        };

Here is my ddns.example.com.hosts file:

$ttl 38400
ddns.example.com.    IN      SOA     ns1.digitalocean.com. jon@example.com. (
                    1414575123
                    10800
                    3600
                    604800
                    38400 )
ddns.example.com.    IN      NS      ns1.digitalocean.com.
bob.ddns.example.com.        IN      A       8.8.8.8

I have restarted the named service and when pinging the domain bob.ddns.example.com I am getting a reply from 8.8.8.8, so the record is working as expected when pinging from the local server. However, when pinging outside of the server ie another network, the subdomain bob.ddns.example.com is still resolving to the IP of the server where bind is configured.

I have stopped my iptables completely to rule this out of the equation and the result is the same, the IP o the Bind server is resolved from the subdomain not 8.8.8.8 as expected. I have set the following options as suggested by some other posts:

listen-on port 53 { any; };
listen-on-v6 port 53 { any; };
allow-query     { any; };

Are there some other options I need to set to allow the resolution from outside? or am I missing something completely?

Dig

The domain is actually a .es domain so i will refer to it form here on in as so.

Here is an example of dig +trace bob.ddns.example.es

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.30.rc1.el6 <<>> +trace bob.ddns.example.es
;; global options: +cmd
.                       518304  IN      NS      e.root-servers.net.
.                       518304  IN      NS      b.root-servers.net.
.                       518304  IN      NS      f.root-servers.net.
.                       518304  IN      NS      i.root-servers.net.
.                       518304  IN      NS      d.root-servers.net.
.                       518304  IN      NS      g.root-servers.net.
.                       518304  IN      NS      h.root-servers.net.
.                       518304  IN      NS      m.root-servers.net.
.                       518304  IN      NS      l.root-servers.net.
.                       518304  IN      NS      k.root-servers.net.
.                       518304  IN      NS      c.root-servers.net.
.                       518304  IN      NS      j.root-servers.net.
.                       518304  IN      NS      a.root-servers.net.
;; Received 228 bytes from 127.0.0.1#53(127.0.0.1) in 608 ms

es.                     172800  IN      NS      ns1.cesca.es.
es.                     172800  IN      NS      ns-ext.nic.cl.
es.                     172800  IN      NS      ns15.communitydns.net.
es.                     172800  IN      NS      ns3.nic.fr.
es.                     172800  IN      NS      sns-pb.isc.org.
es.                     172800  IN      NS      a.nic.es.
es.                     172800  IN      NS      f.nic.es.
;; Received 461 bytes from 192.36.148.17#53(192.36.148.17) in 1540 ms

example.es.                 86400   IN      NS      ns1.tsohost.co.uk.
example.es.                 86400   IN      NS      ns2.tsohost.co.uk.
;; Received 84 bytes from 192.134.0.49#53(192.134.0.49) in 120 ms

bob.ddns.example.es.      1       IN      A       178.62.171.XXX
;; Received 51 bytes from 95.142.155.4#53(95.142.155.4) in 20 ms

Here is the output of the command dig @127.0.0.1 bob.ddns.example.es

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.30.rc1.el6 <<>> @127.0.0.1 bob.ddns.example.es
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11646
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;bob.ddns.example.es.               IN      A

;; ANSWER SECTION:
bob.ddns.example.es.        1       IN      A       8.8.8.8

;; AUTHORITY SECTION:
ddns.example.es.            1       IN      NS      ns1.digitalocean.com.

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Thu Oct 30 04:55:19 2014
;; MSG SIZE  rcvd: 83

Here is the output of the command dig @8.8.8.8 bob.ddns.example.es

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.30.rc1.el6 <<>> @8.8.8.8 bob.ddns.example.es
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 35748
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;bob.ddns.example.es.               IN      A

;; ANSWER SECTION:
bob.ddns.blu.es.        0       IN      A       178.62.171.XXX

;; Query time: 55 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Thu Oct 30 04:56:48 2014
;; MSG SIZE  rcvd: 49

Please also note that the domain is registered with Godaddy. On Godaddy we set ns1.tsohost.co.uk as the name server. Here we serve the website (ie example.es and www.example.es) on the tsohost hosting package. On tso we created an A record for both ddns.example.es and *.ddns.example.es to go to a digital ocean server ie 178.62.171.XXX, it is on this server we wish to manipulate the IP addresses for these domains.

Answer 1

Based on the presented dig +trace output, the most likely cause is that the packets hitting the internet facing IPs are not being received by the server process that you think they are. This can be definitively proved with the following CHAOS query, which demonstrates that the internet facing IP is being managed by a PowerDNS daemon.

$ dig @95.142.155.4 chaos txt version.bind

; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> @95.142.155.4 chaos txt version.bind
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24158
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;version.bind.                  CH      TXT

;; ANSWER SECTION:
version.bind.           5       CH      TXT     "PowerDNS Authoritative Server 3.3.1     (jenkins@autotest.powerdns.com built 20131217140448 root@autotest.powerdns.com)"

;; Query time: 97 msec
;; SERVER: 95.142.155.4#53(95.142.155.4)
;; WHEN: Sat Nov  1 08:57:18 2014
;; MSG SIZE  rcvd: 158

Barring the very unlikely case that you are defining a custom version.bind string in one of those include files, queries on the internet are simply not hitting your BIND server at all.

---

Taking this a step further, the following comment has me suspicious that you may not have this configured correctly for your intended purpose:

Please also note that the domain is registered with Godaddy. On Godaddy we set ns1.tsohost.co.uk as the name server. Here we serve the website (ie example.es and www.example.es) on the tsohost hosting package. On tso we created an A record for both ddns.example.es and *.ddns.example.es to go to a digital ocean server ie 178.62.171.XXX, it is on this server we wish to manipulate the IP addresses for these domains.

Bolded emphasis is mine. If your goal is to have internet facing DDNS work correctly, you would need to be pointing at your Digital Ocean server with a NS record, not an A record. The NS record would tell servers that control of ddns.example.es has been delegated to your BIND nameserver. The dig +trace would have followed that referral and stopped at your BIND nameserver, which it is obviously not.

As a side note, NS records have to point at names, not IP addresses, so you will need to create A records for those nameservers in addition to the NS records.

Answer 2

The examples above, at least at the the time of this writing, are showing contradictory results. I assume you are changing host names and IP addresses to protect your identity? That is all fine, but makes it muy difficult to diagnose the problem.

So, here is what I propose. Start by making sure your DNS records are set correctly.

Verify your domain name is registered properly with the root servers and the .es domain root servers. This is shown in your first dig +trace result above. According to this, your dns servers are

example.es.                 86400   IN      NS      ns1.tsohost.co.uk.
example.es.                 86400   IN      NS      ns2.tsohost.co.uk.

If these are incorrect, then your domain registration likely has the wrong name servers, so you must fix this. If these are correct, then are they returning the correct answer when you query them? In your dig +trace above they are returning

bob.ddns.example.es.      1       IN      A       178.62.171.XXX

Is this correct? I would also specifically check both of them separately:

dig bob.ddns.blu.es @ns1.tsohost.co.uk +norecurse
dig bob.ddns.blu.es @ns2.tsohost.co.uk +norecurse

This will tell you where the problem is. For the other two examples:

dig @127.0.0.1 bob.ddns.example.es
dig @8.8.8.8 bob.ddns.example.es

I don't know what host you are running them from (i.e is run on the nameserver or another host?) so I can't be of much help. When you do run dig though, please use the +trace option so you can tell exactly where things go off the rails.

Please also note that the domain is registered with Godaddy. On Godaddy we set ns1.tsohost.co.uk as the name server. Here we serve the website (ie example.es and www.example.es) on the tsohost hosting package. On tso we created an A record for both ddns.example.es and *.ddns.example.es to go to a digital ocean server ie 178.62.171.XXX, it is on this server we wish to manipulate the IP addresses for these domains.

As AndrewB noticed and I missed, this looks like your problem. If you have an A record on tsohost name server pointing to your digital ocean server, you are telling it the final answer for its A record query is the digital ocean name server. DNS will not further query the digital ocean server - it has already gotten its answer. Instead, remove that A record from tsohost and tell it to delegate requests for the subdomain to your other name server. Do this by adding another origin and NS records delegating to your subdomain:

; sub-domain definitions
; zone fragment for ddns.example.com
$ORIGIN ddns.example.com.
; we define two name servers for the sub-domain
@             IN      NS     <name of your dns server>.

Note that your dns server must also be registered as a DNS server specifically with GO DADDY or whoever your registrar is. How to for subdomain delegation