Hot answers tagged

3

Let me summarize and add a reason for the behaviour to the answer for the people who may come to this issue in the future... DNS system by the definition is utilizing as default UDP protocol on port 53. But the service is designed to prevent fragmentation of the answer so once the answer would be bigger size it "fall" back to TCP protocol. With UDP (in ...


2

You have a syntax error; 1y4400 is not a valid TTL. Remove y, update serial and rndc reload.


2

The error message no crypto support sounds like you missed a compile option. Run emerge --info | grep ^USE. You should find ssl in there. If not, you have to add it: Open /etc/portage/make.conf with an editor. Add ssl to the USE variable: USE="ldap ssl" Recompile the package: emerge bind Now you should be able to start it.


2

It seems that the rndc flushtree command was introduced in BIND 9.9 (released in 2012). You are running an older version, which consequently does not have this command. It appears that you are running EOL versions of both your OS and BIND, you should probably consider upgrading also for many reasons other than the lack of rndc flushtree.


2

it seems to me like the issue is primarily out of bind system. This I see the most important to start with. Jun 19 13:54:22 ns2 named[3558]: transfer of '<domain.com>/IN' from <MASTER IP>#53: connected using <OTHER IP, maybe FW?>#41569 In general it seems like communication is working (slave can contact master) but somehow not directly (...


2

The SOA headers you posted from both the slave and the master show identical serial numbers. The typical "newbie" mistake when master-slave replication "suddenly stops working" is that they don't update SOA serial number record when they make a modification in the zone file on the master. When you don't increment the SOA serial number record on the ...


1

I've encountered the same problem when setting up named in a container. You must run named as the correct user, which is named on Redhat/Fedora: named -u named # Possibly in the foreground using an additional -g named drops all capabilities when starting (except the one to bind to low ports), so root loses its capability to read everyone's files, too. I....


1

You have to use the key name you created the key with as the name in the config. From what I can see, you have to use: key "domain2.com.au" { [...] } From the BIND documentation: to verify that incoming requests have been signed with a key matching this name, algorithm, and secret.


Only top voted, non community-wiki answers of a minimum length are eligible