1

i have several domains at Strato. I want set up my own external DNS to manage my domains.

To do this at Strato I used the option "Domainverwaltung: NS-Records ändern". I had to provide 2 Nameservers for this configuration. The system accepted my configuration.

I have a primary (master) and a secondary (slave) BIND9 DNS on DEBIAN9.

root@server1:/etc/bind# named -v
BIND 9.10.3-P4-Debian <id:ebd72b3>

The configuration of the MASTER

/etc/bind/named.conf.options

acl trusted {
        127.0.0.1;
        xxx.xxx.xxx.43; # NS1
        xx.xx.xx.107; # NS2
        81.169.148.38; # Strato DNS
};

options {
        directory "/var/cache/bind";

        // If there is a firewall between you and nameservers you want
        // to talk to, you may need to fix the firewall to allow multiple
        // ports to talk.  See http://www.kb.cert.org/vuls/id/800113

        // If your ISP provided one or more IP addresses for stable
        // nameservers, you probably want to use them as forwarders.
        // Uncomment the following block, and insert the addresses replacing
        // the all-0's placeholder.

        // forwarders {
        //             0.0.0.0;
        // };

        //========================================================================
        // If BIND logs error messages about the root key being expired,
        // you will need to update your keys.  See https://www.isc.org/bind-keys
        //========================================================================
        dnssec-validation auto;
        listen-on port 53 { any; };
         recursion no;
         allow-query { any; };
        auth-nxdomain no;    # conform to RFC1035
        listen-on-v6 { any; };
        allow-notify { trusted; };
        allow-transfer { trusted; };
};

/etc/bind/named.conf.local

//
// Do any local configuration here
//

// Consider adding the 1918 zones here, if they are not used in your
// organization
//include "/etc/bind/zones.rfc1918";
zone    "my-domain.com"   {
        type master;
        file    "/etc/bind/forward.my-domain.com";
        allow-transfer { xx.xx.xx.107; };
 };

/etc/bind/forward.my-domain.com

$TTL    604800

@       IN      SOA     primary.my-domain.com. root.primary.my-domain.com. (
                              6         ; Serial
                         604820         ; Refresh
                          86600         ; Retry
                        2419600         ; Expire
                         604600 )       ; Negative Cache TTL

;Name Server Information
@       IN      NS      primary.my-domain.com.
@       IN      NS      secondary.my-domain.com.

;IP address of Your Domain Name Server(DNS)
primary IN       A      xxx.xxx.xxx.43
secondary IN     A      xx.xx.xx.107

;A Record for Host names
@       IN       A       xxx.xxx.xxx.43
www     IN       A       xxx.xxx.xxx.43

;CNAME Record
ftp     IN      CNAME    www.my-domain.com.

The configuration of the Slave

/etc/bind/named.conf.options

acl trusted {
        127.0.0.1;
        xxx.xxx.xxx.43; # NS1
        xx.xx.xx.107; # NS2
        81.169.148.38; # Strato DNS
};

options {
        directory "/var/cache/bind";

        // If there is a firewall between you and nameservers you want
        // to talk to, you may need to fix the firewall to allow multiple
        // ports to talk.  See http://www.kb.cert.org/vuls/id/800113

        // If your ISP provided one or more IP addresses for stable
        // nameservers, you probably want to use them as forwarders.
        // Uncomment the following block, and insert the addresses replacing
        // the all-0's placeholder.

        // forwarders {
        //             0.0.0.0;
        // };

        //========================================================================
        // If BIND logs error messages about the root key being expired,
        // you will need to update your keys.  See https://www.isc.org/bind-keys
        //========================================================================
        dnssec-validation auto;
        listen-on port 53 { any; };
         recursion no;
         allow-query { any; };
        auth-nxdomain no;    # conform to RFC1035
        listen-on-v6 { any; };
        allow-notify { trusted; };
        allow-transfer { trusted; };
};

/etc/bind/named.conf.local

//
// Do any local configuration here
//

// Consider adding the 1918 zones here, if they are not used in your
// organization
//include "/etc/bind/zones.rfc1918";
zone    "my-domain.com"   {
        type slave;
        file    "/etc/bind/forward.my-domain.com";
         masters { xxx.xxx.xxx.43; };
 };

/etc/bind/forward.my-domain.com

$TTL    604800

@       IN      SOA     primary.my-domain.com. root.primary.my-domain.com. (
                              6         ; Serial
                         604820         ; Refresh
                          86600         ; Retry
                        2419600         ; Expire
                         604600 )       ; Negative Cache TTL

;Name Server Information
@       IN      NS      primary.my-domain.com.
@       IN      NS      secondary.my-domain.com.

;IP address of Your Domain Name Server(DNS)
primary IN       A      xxx.xxx.xxx.43
secondary IN     A      xx.xx.xx.107

;A Record for Host names
@       IN       A       xxx.xxx.xxx.43
www     IN       A       xxx.xxx.xxx.43

;CNAME Record
ftp     IN      CNAME    www.my-domain.com.

To test this i used:

DIG

~$ dig my-domain.com @xxx.xxx.xxx.43

; <<>> DiG 9.11.3-1ubuntu1.2-Ubuntu <<>> my-domain.com @xxx.xxx.xxx.43
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31536
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;my-domain.com.         IN  A

;; ANSWER SECTION:
my-domain.com.      604800  IN  A   xxx.xxx.xxx.43

;; AUTHORITY SECTION:
my-domain.com.      604800  IN  NS  secondary.my-domain.com.
my-domain.com.      604800  IN  NS  primary.my-domain.com.

;; ADDITIONAL SECTION:
primary.my-domain.com.  604800  IN  A   xxx.xxx.xxx.43
secondary.my-domain.com. 604800 IN  A   xx.xx.xx.107

;; Query time: 16 msec
;; SERVER: xxx.xxx.xxx.43#53(xxx.xxx.xxx.43)
;; WHEN: Tue Oct 16 14:42:09 CEST 2018
;; MSG SIZE  rcvd: 136

And NSLOOKUP:

~$ nslookup my-domain.com xxx.xxx.xxx.43
Server:     xxx.xxx.xxx.43
Address:    xxx.xxx.xxx.43#53

Name:   my-domain.com
Address: xxx.xxx.xxx.43

But without pointing directly to my NS the NS of my provider is answering:

DIG:

~$ dig my-domain.com

; <<>> DiG 9.11.3-1ubuntu1.2-Ubuntu <<>> my-domain.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7286
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;my-domain.com.         IN  A

;; ANSWER SECTION:
my-domain.com.      69  IN  A   81.169.145.157

;; Query time: 0 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Tue Oct 16 14:44:23 CEST 2018
;; MSG SIZE  rcvd: 58

NSLOOKUP:

~$ nslookup my-domain.com
Server:     127.0.0.53
Address:    127.0.0.53#53

Non-authoritative answer:
Name:   my-domain.com
Address: 81.169.145.157
Name:   my-domain.com
Address: 2a01:238:20a:202:1157::

Strato stated: "Please note that due to the decentralized structure of DNS, changes to these settings will not be fully active until 24 hours after activation."

But even after 24h my check does not point to my NS-Server. Is there any test I can perform to find possible problems?

Strato is also pointing out: (sorry automatic translation) Original here.

Set Record (only for Dedicated Servers)

With a secondary name server you can create a backup if the primary name server should fail. This will ensure that the domain will still be reached. Primary and Secondary nameservers are redundant (by the zone transfer all configurations are synchronized concerning the domain), so that the second name server can issue the correct DNS records for the domain, such as A-Record, MX-Record, etc. The zone transfer must be allowed for the IP address of the STRATO Secondary Name Server 81.169.148.38. This IP address is static and therefore does not need to be changed in the future (for BIND, for example via allow-transfer).

When using STRATO Secondary Nameserver, it is not necessary to operate two own name servers. If you allow a zone transfer from your primary name server to sns.serverkompetenz.de, it will get the DNS configurations of the domains you have set up on your primary name server. In case of failure of the primary name server, the domains are still reachable.

In the domain zone, sns.serverkompetenz.de must also be listed as a name server in the NS set.

  • To create a valid bind9 configuration the following website can help: zonefile.org – Fritjof Oct 17 '18 at 21:34
  • Both DNSVIZ and Zonemaster are online testing tools, and you can provide the NS list to use before delegation. – Patrick Mevzek Jan 6 at 22:18
  • Do you mean this? dnsviz.net and zonemaster.excedonet.net ?? – Fritjof Jan 8 at 10:46
  • dnsviz.net and zonemaster.net (see Pre-Delegated Domain option on top). Your Zonemaster link seems to be same tool (it is open source and freely installable anywhere you like), zonemaster.net is just its canonical home and should be updated/upgraded by its core developers. – Patrick Mevzek Jan 8 at 14:40
0

You can start by performing a dig +trace my-domain.com.. This will start at the ROOT-SERVERS nameserver, and then trace the NS delegation path (hopefully) all the way to your own nameservers. Make sure that the NS records that are returned at each point are the ones that you expect to see. For example, this is what a (filtered) trace for my domain looks like:

$ dig +trace guzzijason.com. | grep -E 'IN\s*NS'
.           509129  IN  NS  b.root-servers.net.
.           509129  IN  NS  h.root-servers.net.
.           509129  IN  NS  g.root-servers.net.
.           509129  IN  NS  i.root-servers.net.
.           509129  IN  NS  m.root-servers.net.
.           509129  IN  NS  k.root-servers.net.
.           509129  IN  NS  f.root-servers.net.
.           509129  IN  NS  j.root-servers.net.
.           509129  IN  NS  e.root-servers.net.
.           509129  IN  NS  c.root-servers.net.
.           509129  IN  NS  d.root-servers.net.
.           509129  IN  NS  l.root-servers.net.
.           509129  IN  NS  a.root-servers.net.
com.            172800  IN  NS  a.gtld-servers.net.
com.            172800  IN  NS  b.gtld-servers.net.
com.            172800  IN  NS  c.gtld-servers.net.
com.            172800  IN  NS  d.gtld-servers.net.
com.            172800  IN  NS  e.gtld-servers.net.
com.            172800  IN  NS  f.gtld-servers.net.
com.            172800  IN  NS  g.gtld-servers.net.
com.            172800  IN  NS  h.gtld-servers.net.
com.            172800  IN  NS  i.gtld-servers.net.
com.            172800  IN  NS  j.gtld-servers.net.
com.            172800  IN  NS  k.gtld-servers.net.
com.            172800  IN  NS  l.gtld-servers.net.
com.            172800  IN  NS  m.gtld-servers.net.
guzzijason.com.     172800  IN  NS  ns01.guzzijason.com. # Note: delegation NS record hosted by gtld-servers
guzzijason.com.     172800  IN  NS  ns02.guzzijason.com. # Note: delegation NS record hosted by gtld-servers
guzzijason.com.     7200    IN  NS  ns01.guzzijason.com. # authoritative NS record served by guzzijason.com nameservers
guzzijason.com.     7200    IN  NS  ns02.guzzijason.com. # authoritative NS record served by guzzijason.com nameservers

I've also noted which are the upstream delegation records and which records are those served by my authoratative nameservers.

0

Thank you guzzijason for sharing the +trace option of dig.

Another option to test the own nameserver DENIC->SERVICE->TOOLS->NAST. This is as a service on the denic website.

There you can enter the domain you are setting up, Nameserver 1, Nameserver 2 and the IPs of your nameservers. See the result here:

NAST test on DENIC-Website

This was showing me my setup was correct. So I could go deeper into the topic.

My problem was: In the webinterface of my domain provider Strato I was entering the IPs from my rootserver mentioned above xxx.xxx.xxx.43 and xx.xx.xx.107.

The correct config for Strato is to enter the SERVER DNS-HOSTNAME like: "h1234567.stratoserver.net" for a strato server or "b123123.online-server.cloud" for a 1und1 server.

Maybe this will help someone...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.