0

I'm trying to setup my own nameservers for my server. So far I have:

  1. Installed bind9 via apt-get
  2. Updated my DNS so I have:

    NS1.NEWBYHOST.COM => 213.219.38.44 (and also an AAAA record)

    NS2.NEWBYHOST.COM => 213.219.38.44 (and also an AAAA record)

  3. It has now updated, and pings correctly:

PS C:\Users\Andy> ping NS1.NEWBYHOST.COM

Pinging NS1.NEWBYHOST.COM [213.219.38.44] with 32 bytes of data: Reply from 213.219.38.44: bytes=32 time=10ms TTL=54 Reply from 213.219.38.44: bytes=32 time=10ms TTL=54

Ping statistics for 213.219.38.44: Packets: Sent = 2, Received = 2, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 10ms, Maximum = 10ms, Average = 10ms Control-C PS C:\Users\Andy> ping NS2.NEWBYHOST.COM

Pinging NS2.NEWBYHOST.COM [213.219.38.44] with 32 bytes of data: Reply from 213.219.38.44: bytes=32 time=10ms TTL=54 Reply from 213.219.38.44: bytes=32 time=10ms TTL=54

Ping statistics for 213.219.38.44: Packets: Sent = 2, Received = 2, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 10ms, Maximum = 10ms, Average = 10ms

However, when trying to update my domain in GoDaddy, I get an error:

enter image description here

What am I missing?

  • I'm not sure what exactly godaddy are checking there, but does the relevant zone exist on your nameserver? – Håkan Lindqvist Mar 5 '18 at 7:23
  • @HåkanLindqvist thanks for the quick reply. What do you mean by the "relevant zone" ? – Andrew Newby Mar 5 '18 at 7:25
  • The domain name that you are delegating should exist as a zone on your nameserver. – Håkan Lindqvist Mar 5 '18 at 7:27
  • @HåkanLindqvist - you mean on the Linode DNS? (newbyhost.com is pointing there, and then I have the ns1 and ns2 pointing to the new server where the DNS server is hosted). – Andrew Newby Mar 5 '18 at 7:28
  • here is what I have: ibb.co/matohn – Andrew Newby Mar 5 '18 at 7:29
0

There are several problems with what you are trying to do here. The Unavailable error you get is simply a measure to prevent you from doing such errors. Your configuration doesn't meet the IANA Technical requirements for authoritative name servers:

  1. You only have one name server 213.219.38.44. This has two problems, of which the second is a logical cause from the first. Even if your single server has two different IP addresses, it still wouldn't fully meet the purpose of the network diversity requirement. Also, you don't actually want the whole domain to simply disappear every time your single server is down, do you?

    Minimum number of name servers

    There must be at least two NS records listed in a delegation, and the hosts must not resolve to the same IP address.

    Network diversity

    The name servers must be in at least two topologically separate networks. A network is defined as an origin autonomous system in the BGP routing table. The requirement is assessed through inspection of views of the BGP routing table.

  2. Your single name server isn't configured to answer authoritatively for newbyhost.com:

    dig newbyhost.com @213.219.38.44
    
    ; <<>> DiG 9.10.3-P4-Debian <<>> newbyhost.com @213.219.38.44
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 56269
    ;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
    ;; WARNING: recursion requested but not available
    

    If you just installed Bind 9, you'd need to configure it, too!

    Answer authoritatively

    The name servers must answer authoritatively for the designated zone. Responses to queries to the name servers for the designated zone must have the “AA”-bit set.

    This will be tested by querying for the SOA record of the designated zone with no “RD”-bit set.

  3. If you use the domain itself for its name servers, you should have glue records at the parent.

If you are trying to have own name servers for vanity reasons alone, stop right there: Linode has the expertise to host the name servers for you.

  • Thanks for the answer. I'm a bit confused as to how you would run 2 DNS servers with the same data? My DNS records on 213.219.38.44 are created using our GUI system (VestaCP). It enters the correct records into the system. Can't we just use 2 different IPs, but the same server? I know its not ideal - but seeing as the only sites that are going to be served from this DNS server, are the sites that are on it - its kind of irrelevant if it is on another server (as the site would be down either way). Does that make sense? – Andrew Newby Mar 5 '18 at 10:13
  • BTW, I'm not just doing this for vanity reasons :) I'm trying to get SpamAssasins spam checks to work (its telling me I've gone over my limit, which apparently is due to the fact we are using the shared Linode nameservers, which get overloaded with all the traffic coming through from their servers – Andrew Newby Mar 5 '18 at 10:19
  • 1
    Guess what? There is a technology for keeping the records up to date on every single secondary name server! It's called DNS Zone Transfer (RFC 5936): the secondary name servers are configured to copy the zone from the master whenever it's updated. – Esa Jokinen Mar 5 '18 at 11:23
  • 1
    You are also probably mixing authoritative and recursive nameservers. The way you speak about Linode nameservers seems to me that you are speaking about their recursive nameservers, used by servers hey host. This has nothing to do with authoritative nameservers providing data for some domains, which is what you are attempting to do. So again I urge you to revisit to whole issue to really understand the core of the problem with SpamAssassin before going the route of setting up authoritative nameservers on which a domain will depend. – Patrick Mevzek Mar 6 '18 at 2:57
  • 1
    @Andrew see the relevant link for this data: "Resolving the block might be as simple as using your own non-forwarding caching nameserver to avoid being lumped together with other users queries;" This means you need to install a recursive nameserver not an authoritative one like you were trying to do. Install unbound for example, or bind (but more complicated) and configure it to be only available for your own servers and make sure they use it (change every /etc/resolv.conf to point to your newly installed nameserver. – Patrick Mevzek Mar 6 '18 at 13:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.