I'm having trouble with setting up reverse DNS.

I own the mentioned public IP addresses.

After making changes to named.conf (added zone "1.198.193.in-addr.arpa" )

options {
        directory "/var/cache/bind";

        auth-nxdomain no;    # conform to RFC1035

        listen-on { 193.198.1.6; };
        listen-on-v6 { "none"; };

        recursion no;

        allow-transfer { 193.198.1.9; };
        also-notify { 193.198.1.9; };
};

controls {
        inet 127.0.0.1 allow { localhost; };
};

zone "gkr.hr" {
        type master;
        file "/etc/bind/zones/gkr.hr.db";
};

zone "gkri.hr" {
        type master;
        file "/etc/bind/zones/gkri.hr.db";
};


zone "1.198.193.in-addr.arpa" in {
        type master;
        file "/etc/bind/193.198.1.gkri.rev";
        allow-transfer {
                193.198.1.9;
        };
        allow-query { any; };

};

and creating a new .rev file

Content of the /etc/bind/193.198.1.gkri.rev

$TTL 1D

@       SOA     a.ns.gkr.hr. admin.gkr.hr. (

        2016091201 ; Serial
        10800      ; Refresh
        3600       ; Retry
        2419200    ; Expire
        14400)     ; Minimum

@       NS      a.ns.gkr.hr.
@       NS      b.ns.gkr.hr.

11      PTR     mail.gkri.hr.

And after this configuration when I run:

root@a:/home/admin# nslookup 193.198.1.11

I get

;; Got SERVFAIL reply from 161.53.123.3, trying next server
;; Got SERVFAIL reply from 161.53.160.3, trying next server
;; connection timed out; no servers could be reached

but when I run

root@a:/home/admin# nslookup mail.gkri.hr

mail.gkri.hr is on 193.198.1.11

Server:     161.53.123.3
Address:    161.53.123.3#53

Non-authoritative answer:
Name:   mail.gkri.hr
Address: 193.198.1.11

Also some other valuable info

root@a:/home/admin# named-checkzone 1.198.193.in-addr.arpa /etc/bind/193.198.1.gkri.rev

zone 1.198.193.in-addr.arpa/IN: loaded serial 2016091201
OK
root@a:/home/admin# named-checkconf -z
zone gkr.hr/IN: loaded serial 2016091201
zone gkri.hr/IN: loaded serial 2016091203
zone 11.1.198.193.in-addr.arpa/IN: loaded serial 2016091201

root@a:/home/admin# host -t any 11.1.198.193.in-addr.arpa a.ns.gkr.hr

Using domain server:
Name: a.ns.gkr.hr
Address: 193.198.1.6#53
Aliases: 

11.1.198.193.in-addr.arpa has SOA record a.ns.gkr.hr. admin.gkr.hr. 2016091201 10800 3600 2419200 14400
11.1.198.193.in-addr.arpa name server a.ns.gkr.hr.
11.1.198.193.in-addr.arpa name server b.ns.gkr.hr.

When running dig I get

root@a:/etc/bind# dig -x 193.198.1.11

; <<>> DiG 9.7.3 <<>> -x 193.198.1.11
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 11421
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;11.1.198.193.in-addr.arpa. IN  PTR

;; ANSWER SECTION:
11.1.198.193.in-addr.arpa. 14400 IN CNAME   11.0/27.1.198.193.in-addr.arpa.

;; Query time: 33 msec
;; SERVER: 161.53.123.3#53(161.53.123.3)
;; WHEN: Tue Sep 13 11:56:47 2016
;; MSG SIZE  rcvd: 65

root@a:/home/admin# dig -x 193.198.1.11 +trace

      ; <<>> DiG 9.7.3 <<>> -x 193.198.1.11 +trace
        ;; global options: +cmd
        .           3599800 IN  NS  e.root-servers.net.
        .           3599800 IN  NS  k.root-servers.net.
        .           3599800 IN  NS  j.root-servers.net.
        .           3599800 IN  NS  i.root-servers.net.
        .           3599800 IN  NS  c.root-servers.net.
        .           3599800 IN  NS  m.root-servers.net.
        .           3599800 IN  NS  b.root-servers.net.
        .           3599800 IN  NS  l.root-servers.net.
        .           3599800 IN  NS  a.root-servers.net.
        .           3599800 IN  NS  f.root-servers.net.
        .           3599800 IN  NS  g.root-servers.net.
        .           3599800 IN  NS  d.root-servers.net.
        .           3599800 IN  NS  h.root-servers.net.
        ;; Received 241 bytes from 161.53.123.3#53(161.53.123.3) in 15 ms

        in-addr.arpa.       172800  IN  NS  e.in-addr-servers.arpa.
        in-addr.arpa.       172800  IN  NS  f.in-addr-servers.arpa.
        in-addr.arpa.       172800  IN  NS  d.in-addr-servers.arpa.
        in-addr.arpa.       172800  IN  NS  c.in-addr-servers.arpa.
        in-addr.arpa.       172800  IN  NS  b.in-addr-servers.arpa.
        in-addr.arpa.       172800  IN  NS  a.in-addr-servers.arpa.
        ;; Received 419 bytes from 198.41.0.4#53(a.root-servers.net) in 35 ms

        193.in-addr.arpa.   86400   IN  NS  tinnie.arin.net.
        193.in-addr.arpa.   86400   IN  NS  pri.authdns.ripe.net.
        193.in-addr.arpa.   86400   IN  NS  sns-pb.isc.org.
        193.in-addr.arpa.   86400   IN  NS  sec3.apnic.net.
        ;; Received 156 bytes from 193.0.9.1#53(f.in-addr-servers.arpa) in 30 ms

        198.193.in-addr.arpa.   172800  IN  NS  dns1.carnet.hr.
        198.193.in-addr.arpa.   172800  IN  NS  dns2.carnet.hr.
        198.193.in-addr.arpa.   172800  IN  NS  ns.ripe.net.
        ;; Received 159 bytes from 202.12.28.140#53(sec3.apnic.net) in 238 ms

11.1.198.193.in-addr.arpa. 14400 IN CNAME   11.0/27.1.198.193.in-addr.arpa.
0/27.1.198.193.in-addr.arpa. 14400 IN   NS  ns.ri.carnet.hr.
0/27.1.198.193.in-addr.arpa. 14400 IN   NS  ns.gkri.hr.
;; Received 116 bytes from 161.53.160.2#53(dns2.carnet.hr) in 3 ms

Here is my sys log after /etc/init.d/bind9 restart

root@a:/var/log# cat /var/log/syslog | grep named

Sep 13 10:12:37 a named[934]: received control channel command 'stop -p'
Sep 13 10:12:37 a named[934]: shutting down: flushing changes
Sep 13 10:12:37 a named[934]: stopping command channel on 127.0.0.1#953
Sep 13 10:12:37 a named[934]: no longer listening on 193.198.1.6#53
Sep 13 10:12:37 a named[934]: exiting
Sep 13 10:12:38 a named[1187]: starting BIND 9.7.3 -4 -u bind
Sep 13 10:12:38 a named[1187]: built with '--prefix=/usr' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--sysconfdir=/etc/bind' '--localstatedir=/var' '--enable-threads' '--enable-largefile' '--with-libtool' '--enable-shared' '--enable-static' '--with-openssl=/usr' '--with-gssapi=/usr' '--with-gnu-ld' '--with-dlz-postgres=no' '--with-dlz-mysql=no' '--with-dlz-bdb=yes' '--with-dlz-filesystem=yes' '--with-dlz-ldap=yes' '--with-dlz-stub=yes' '--with-geoip=/usr' '--enable-ipv6' 'CFLAGS=-fno-strict-aliasing -DDIG_SIGCHASE -O2' 'LDFLAGS=' 'CPPFLAGS='
Sep 13 10:12:38 a named[1187]: adjusted limit on open files from 1024 to 1048576
Sep 13 10:12:38 a named[1187]: found 1 CPU, using 1 worker thread
Sep 13 10:12:38 a named[1187]: using up to 4096 sockets
Sep 13 10:12:38 a named[1187]: loading configuration from '/etc/bind/named.conf'
Sep 13 10:12:38 a named[1187]: using default UDP/IPv4 port range: [1024, 65535]
Sep 13 10:12:38 a named[1187]: using default UDP/IPv6 port range: [1024, 65535]
Sep 13 10:12:38 a named[1187]: no IPv6 interfaces found
Sep 13 10:12:38 a named[1187]: listening on IPv4 interface eth0, 193.198.1.6#53
Sep 13 10:12:38 a named[1187]: generating session key for dynamic DNS
Sep 13 10:12:38 a named[1187]: set up managed keys zone for view _default, file 'managed-keys.bind'
Sep 13 10:12:38 a named[1187]: command channel listening on 127.0.0.1#953
Sep 13 10:12:38 a named[1187]: zone 11.1.198.193.in-addr.arpa/IN: loaded serial 2016091201
Sep 13 10:12:38 a named[1187]: zone gkr.hr/IN: loaded serial 2016091201
Sep 13 10:12:38 a named[1187]: zone gkri.hr/IN: loaded serial 2016091203
Sep 13 10:12:38 a named[1187]: managed-keys-zone ./IN: loading from master file managed-keys.bind failed: file not found
Sep 13 10:12:38 a named[1187]: managed-keys-zone ./IN: loaded serial 0
Sep 13 10:12:38 a named[1187]: running
Sep 13 10:12:38 a named[1187]: zone 11.1.198.193.in-addr.arpa/IN: sending notifies (serial 2016091201)
Sep 13 10:12:38 a named[1187]: zone gkr.hr/IN: sending notifies (serial 2016091201)
Sep 13 10:12:38 a named[1187]: zone gkri.hr/IN: sending notifies (serial 2016091203)

Anybody got a clue what is wrong?

Could it be DNSSEC key information for Bind 9 ?

*mentioned in syslog (managed-keys.bind)

  • zone "11.1.198.193.in-addr.arpa" in { <<< should remove the first 11. – Florin Asăvoaie Sep 13 '16 at 11:24
  • I've changed it to 0/27.1.198.193.in-addr.arpa since I have that range of IP address. I'm still getting root@a:/etc/bind# nslookup 193.198.1.11 ;; Got SERVFAIL reply from 161.53.123.3, trying next server ;; Got SERVFAIL reply from 161.53.160.3, trying next server ;; connection timed out; no servers could be reached – Rene Brakus Sep 13 '16 at 11:46
  • I said remove it: zone "1.198.... – Florin Asăvoaie Sep 13 '16 at 11:50
  • Ok, I just did, after bind restart, I'm still getting SERVFAIL reply – Rene Brakus Sep 13 '16 at 11:52
up vote 0 down vote accepted

Your zone is "0/27.1.198.193.in-addr.arpa", so change your zone in named.conf to:

zone "0/27.1.198.193.in-addr.arpa" in {

Restart BIND.

  • In the original post my setup was like you mentioned, strangely enough it didn't work. But it does now. Hvala još jedanput :) – Rene Brakus Sep 14 '16 at 5:24

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.