2

I have a master BIND server maintaining a handful of zones. An example entry in the named.conf file:

zone "example.com" {
        type master;
        file "example.com.zone";
        allow-update { 10.202.215.10; 10.202.215.11; 10.201.215.14; };
};

There are three slaves. An example configuration which exists on all three:

zone "example.com" {
        type slave;
        file "slaves/example.com.zone";
        masters { 10.201.215.11; 10.202.215.10; 10.202.215.11; };
};

EDIT

IPs and hostnames of the master and slaves

Master: 10.201.215.11
Slave1: 10.201.215.14
Slave2: 10.202.215.10
Slave3: 10.202.215.11

END EDIT

For the zone file in the example, I've incremented the serial number on the master then ran rndc reload on all of them (master and three slaves). The time stamp on the zone files on each slave is being updated, however, the serial number on the slave doesn't update.

The slaves are updating, though:

Oct 14 12:14:44 dns-slave01 named[12434]: transfer of 'example.com/IN' from m 10.201.215.11#53: connected using 10.202.215.10#44420

Why wouldn't the serial be updating?

EDIT

Based on the comment by yoonix, I've removed all but the one server which I know to be the master for the zone:

zone "example.com" {
        type slave;
        file "slaves/example.com.zone";
        masters { 10.201.215.11; };
};

I've also explicitly set notify yes despite it being enabled by default.

Additionally, I've removed the allow-update option on the master to ensure that all hosts are able to dynamically update.

Replication still isn't occurring.

I am, however, seeing that the master is sending the NOTIFY announcements:

Oct 17 00:48:00 dns-master01 named[5608]: zone example.com/IN: sending notifies (serial 2009091903)
Oct 17 00:48:13 dns-master01 named[5608]: zone example.com/IN: sending notifies (serial 2009091904)

I've verified via telnet that I am able to connect to the slaves from the master via port 53.

EDIT 2 One thing I've done is to ensure that all of the slaves have the same configuration as well as fixing the logging which was misconfigured. About three hours after I modified the zone file the transfer happened. I still can't sort out why it isn't happening immediately.

Below is the master named.conf. There are several more zone entries, but they are all identical with the exception of the domain.

// generated by named-bootconf.pl
// 
// a caching only nameserver config
acl trusted_nets {
 10.201.96.0/20;
 10.202.96.0/20;
 10.201.215.0/24;
 10.202.215.0/24;
 12.130.200.0/24;
 174.47.15.0/24;
 199.108.193.0/24;
 199.108.195.0/24;
 72.165.204.0/24;
};
// 
options { 
        directory "/var/named";
        allow-recursion { trusted_nets; };
        notify yes;
        allow-transfer { 10.202.215.10; 10.202.215.11; 10.201.215.14; 199.108.193.20; 209.67.192.20; 10.201.215.10; };
};
logging {
    channel dns_log {
        file "/var/log/named.log" versions 3 size 5m;
        severity info;
        print-time yes;
        print-severity yes;
        print-category yes;
    };
    category default {
        dns_log;
    };
};
controls { 
    inet 127.0.0.1 allow { localhost; } keys { rndckey; };
};
zone "." { 
    type hint;
    file "named.ca";
};
zone "localhost" { 
    allow-update { none; };
    type master;
    file "localhost.zone";
};
zone "0.0.127.in-addr.arpa" { 
    allow-update { none; };
    type master;
    file "named.local";
};
zone "example.com" { 
    type master;
    file "example.com.zone";
    allow-update { 10.202.215.10; 10.202.215.11; 10.201.215.14; };
};
include  "/etc/rndc.key";

Each of the IPs in the allow-update setting is one of the slaves.

Example slave. Again, there are several more zones but they are identical save for the domain.

// generated by named-bootconf.pl
// 
// a caching only nameserver config
acl trusted_nets {
    10.201.96.0/20;
    10.202.96.0/20;
    10.202.92.0/20;
    10.201.215.0/24;
    10.202.215.0/24;
    12.130.200.0/24;
    174.47.15.0/24;
    199.108.193.0/24;
    199.108.195.0/24;
    72.165.204.0/24;
};
// 
options { 
    directory "/var/named";
    allow-recursion { trusted_nets; };
    allow-transfer { 10.202.215.10; 10.202.215.11; 10.201.215.11; 199.108.193.20; 209.67.192.20; };
};
logging {
    channel mtg_log {
        file "/var/log/named.log" versions 3 size 5m;
        severity info;
        print-time yes;
        print-severity yes;
        print-category yes;
    };
    category default {
        mtg_log;
    };
};
controls { 
    inet 127.0.0.1 port 953
    allow { 127.0.0.1; } keys { rndckey; };
};
zone "." IN { 
    type hint;
    file "named.ca";
};
zone "localhost" { 
    allow-update { none; };
    type master;
    file "localhost.zone";
};
zone "0.0.127.in-addr.arpa" { 
    allow-update { none; };
    type master;
    file "named.local";
};
zone "example.com" { 
    type slave;
    file "slaves/example.com.zone";
    masters { 10.201.215.11; }; 
};
include  "/etc/rndc.key";

With the exception of the type option, they are identical. I don't know if this is how they are supposed to be configured.

EDIT 3

The NOTIFY announcement appears to only be sent when I restart named. I tried rndc reload and service named reload but neither did anything. Only service named restart sent the announcement.

  • 1
    How do you query the serial? Please show the commands and their output displaying different serials for the master and the slaves. – Tilman Schmidt Oct 14 '16 at 21:20
  • 1
    Without knowing what each of those IPs you list in masters is.. I would guess that you have secondaries listed as master. You're then doing a reload on a slave, and it's grabbing from another slave. I would use NOTIFY instead. You don't need to reload your slaves, the master tells them when it has something new for them. – yoonix Oct 14 '16 at 22:14
  • 1
    Any relevant log entries? Can you confirm that the master allows zone transfers (not evident from the included config)? – Håkan Lindqvist Oct 14 '16 at 22:14
  • @yoonix Your comment might be relevant. I do believe a couple of the IPs are also slaves. Also, judging by your comment Re: NOTIFY, I'm guessing it isn't something that I on by default. I'll look into how to get that working. – theillien Oct 17 '16 at 4:13
  • @TilmanSchmidt dig <server> <zone> SOA – theillien Oct 18 '16 at 4:30
0

From your configuration, you have multiple masters servers. Slaves may query any of the masters for an update. Verify all masters are up to date before attempting to update the slaves. I suspect you should only have one IPv4 and/or one IPv6 address in the list.

You likely should add a also-notify list containing the IP addresses of your slave servers. Normally, these should be the only hosts that can do a zone transfer. You should also consider enabling notify for your master server.

-2

I would suggest you deleting the zones files on the slaves and perform a new zone transfers from the master.

  • And this solves the problem exactly how? – Sven Oct 15 '16 at 10:41
  • I have had similar issues, and the only way i resolved it was to delete the zone files on my the salve and re transfer from master. Identify the easiest thing you can do which will get you closer to the solution – ThomasOdus Oct 15 '16 at 14:49
  • I"m not entirely sure how that would help. If the slaves are not getting the updated zone files deleting them will just leave me with no files. – theillien Oct 17 '16 at 7:32

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.