0

I have a BIND9 (9.9.10-P2) server running on Windows Server 2012 R2. I have 2 views - an internal and external - serving up two zones for domains I own.

For some reason, one of these zones it refuses to serve up answers for despite the server starting without complaints. When creating Zone 2 (the problem zone), since it is set up exactly like Zone 1, I simply copied the file from Zone 1 and replaced the relevant bits with the new name. Checkzone says it's ok and shows no errors. Running checkconf -z throws errors for Zone 2 but not Zone 1:

C:\Program Files\ISC BIND 9\bin>named-checkconf.exe -z ..\etc\named.conf
C:\Program Files\ISC BIND 9\etc\zones\domain2.net.int:4: ignoring out-of-zone data
 (domain2.net)
C:\Program Files\ISC BIND 9\etc\zones\domain2.net.int:16: ignoring out-of-zone dat
a (dns.domain2.net)
zone domain2.net/IN: has 0 SOA records
zone domain2.net/IN: has no NS records
zone domain2.net/IN: not loaded due to errors.
internal/domain2.net/IN: bad zone
zone domain1.net/IN: loaded serial 2
C:\Program Files\ISC BIND 9\etc\zones\domain2.net.ext:4: ignoring out-of-zone data
 (domain2.net)
C:\Program Files\ISC BIND 9\etc\zones\domain2.net.ext:16: ignoring out-of-zone dat
a (dns.domain2.net)
zone domain2.net/IN: has 0 SOA records
zone domain2.net/IN: has no NS records
zone domain2.net/IN: not loaded due to errors.
external/domain2.net/IN: bad zone
zone domain1.net/IN: loaded serial 2

Here is my named.conf:

key "rndc-key" {
    algorithm hmac-md5;
    secret "nah";
};

controls {
    inet 127.0.0.1 port 953
    allow { 127.0.0.1; } keys { "rndc-key"; };
};

acl internals {
    127.0.0.0/8;
    10.16.0.0/22;
};

view "internal" {
    match-clients { internals; };
    recursion yes;
    zone "domain2.net" {
        type master;
        file "C:\Program Files\ISC BIND 9\etc\zones\domain2.net.int";
    };
    zone "domain1.net" {
        type master;
        file "C:\Program Files\ISC BIND 9\etc\zones\domain1.net.int";
    };
};
view "external" {
    match-clients { any; };
    recursion no;
    zone "domain2.net" {
        type master;
        file "C:\Program Files\ISC BIND 9\etc\zones\domain2.net.ext";
    };
    zone "domain1.net" {
        type master;
        file "C:\Program Files\ISC BIND 9\etc\zones\domain1.net.ext";
    };
};

Here is Zone 1/Domain 1, the working one:

; domain1.net
$TTL 86400
$ORIGIN domain1.net.
domain1.net.        IN  SOA dns.domain1.net. hostmaster (
                2           ; Serial number
                10800           ; Refresh
                3600            ; Retry
                604800          ; Expire
                86400)          ; Minimum TTL

            ; Nameservers
            IN  NS  dns.domain1.net.
            IN  NS  dns.domain2.net.

; Records
dns.domain1.net.    IN  A   127.0.0.2

Here is Zone 2/Domain 2, the broken one:

; domain2.net
$TTL 86400
$ORIGIN domain2.net.
domain2.net.        IN  SOA dns.domain2.net. hostmaster (
                2           ; Serial number
                10800           ; Refresh
                3600            ; Retry
                604800          ; Expire
                86400)          ; Minimum TTL

            ; Nameservers
            IN  NS  dns.domain2.net.
            IN  NS  dns.domain1.net.

; Records
dns.domain2.net.    IN  A   127.0.0.6

As far as I can tell Zone 1/Domain 1 works perfectly fine. I have deleted and recreated and copied these files numerous times with no success.

1 Answer 1

3

It's ignoring the records in the domain 2 zone files as "out of zone", which seems to indicate a mismatch between the zone "domain2.net" { line of the conf and the domain2.net. name in your zone file, which might have been lost in your domain obfuscation.

Do those two strings match exactly between those two files (apart from the trailing dot in the zone file), and are there any special characters or encoding differences?

2
  • 2
    named-checkzone -o - domain2.net domain2.net.zonefile will dump the zonefile with the $ORIGIN and related macros expanded. You've got something mismatched in obfuscation since your error reports a zone file path ( internal/domain2... ) that shouldn't appear. Jul 6, 2017 at 1:07
  • You guys were right. Despite checking it 30 or 40 times I just totally missed it - rookie mistake with letters that are similar. It really is nice to have someone else's eyes on it to get you to really, really make sure you entered it right. Thanks guys, have a nice day.
    – flashbang
    Jul 6, 2017 at 23:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .