254

v=spf1 include:_spf.google.com include:otherdomain.com ~all There's no restriction against including multiple names in a single entry; Hotmail, for instance, takes this to extremes. Note that multiple includes, or nested ones, need to stay under the limit of 10 total DNS lookups for the whole SPF check.


155

The short answer is to your specific question of listing CNAMEs is that you can't without permission to do zone transfers (see How to list all CNAME records for a given domain?). That said, you can use dig to list the other records by doing: dig +nocmd yourdomain.example any +multiline +noall +answer


123

A glue record is a term for a record that's served by a DNS server that's not authoritative for the zone, to avoid a condition of impossible dependencies for a DNS zone. Say I own a DNS zone for example.com. I want to have DNS servers that're hosting the authoritative zone for this domain so that I can actually use it - adding records for the root of the ...


114

You can use the @ syntax to look up the domain from a particular server. If the DNS server is authoritative for that domain, the response will not be a cached result. dig @ns1.example.com example.com You can find the authoritative servers by asking for the NS records for a domain: dig example.com NS


103

I would choose a consistent approach across the entire environment. Both solutions work fine and will remain compatible with most applications. There is a difference in manageability, though. I go with the short name as the HOSTNAME setting, and set the FQDN as the first column in /etc/hosts for the server's IP, followed by the short name. I have not ...


103

Think of it like this: DNS is the phone directory/yellow pages. When someone wants to call your phone, they can look up your name and get your phone number and call that phone. DNS does the same but for computers - when someone wants to go to www.example.com they ask DNS for the IP address and then they can contact the computer that has that IP address. ...


102

DNSSEC has some risks, but they are not directly related to reflection or amplification. The EDNS0 message size expansion is a red herring in this case. Let me explain. Any exchange of packets that does not depend on a previous proof of identity is subject to abuse by DDoS attackers who can use that unauthenticated packet exchange as a reflector, and ...


98

Basically, it's what the name says it is. An authoritative answer comes from a nameserver that is considered authoritative for the domain which it's returning a record for (one of the nameservers in the list for the domain you did a lookup on), and a non-authoritative answer comes from anywhere else (a nameserver not in the list for the domain you did a ...


94

CNAME records were originally created to allow multiple names that provide the same resource to be aliased to a single "canonical name" for the resource. With the advent of name based virtual hosting, it has instead become commonplace to use them as a generic form of IP address aliasing. Unfortunately, most people who come from a web hosting background ...


88

The whole idea behind the MX record is to specify a host or hosts which can accept mail for a domain. As specified in RFC 1035, the MX record contains a domain name. It must therefore point to a host which itself can be resolved in the DNS. An IP address could not be used as it would be interpreted as an unqualified domain name, which cannot be resolved. ...


87

Actually, it's more complicated than that - rather than one "central registry (that) holds a table that maps domains (www.mysite.com) to DNS servers", there are several layers of hierarchy There's a central registry (the Root Servers) which contain only a small set of entries: the NS (nameserver) records for all the top-level domains - .com, .net, .org, .uk,...


82

You can work around this issue in one of two ways, both of which are in the VirtualBox manual: Enabling DNS proxy in NAT mode The NAT engine by default offers the same DNS servers to the guest that are configured on the host. In some scenarios, it can be desirable to hide the DNS server IPs from the guest, for example when this information can ...


78

Sigh. I've had a few clients fall trap to this by using afraid.org as their DNS provider. Because they're free, they allow anyone who wants to to create subdomains off your primary domain, unless you specifically disallow it. You can see here: https://freedns.afraid.org/domain/registry/?sort=5&q=gotgenes&submit=SEARCH that someone has created 79 ...


77

The trouble with "ping" is that it's not strictly a name server lookup tool (like nslookup) - for instance if you ping a hostname, it can be resolved to an IP address by a number of methods: DNS lookup, host file lookup, WINS (god forbid) or NetBIOS broadcast. It can also return a potentially out-dated cached result. The order in which the methods are tried,...


77

From RFC 1034 - Domain names - concepts and facilities: Of course, by the robustness principle, domain software should not fail when presented with CNAME chains or loops; CNAME chains should be followed and CNAME loops signalled as an error. So yes, it is allowed and properly written software will handle it just OK. CNAME chains aren't however considered ...


76

Disclaimer: No offense, but this is a really bad idea. I do not recommend that anyone do this in real life. But if you give a bored IT guy a lab, funny things will happen! For this experiment, I used a Microsoft DNS server running on Server 2012 R2. Because of the complications of hosting a DNS zone in Active Directory, I created a new primary zone named ...


72

A much easier command to remember (and more informative) is: > dig google.com ANY Which returns the following: ; <<>> DiG 9.8.3-P1 <<>> google.com ANY ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31013 ;; flags: qr rd ra; QUERY: 1, ANSWER: 22, AUTHORITY: 0, ADDITIONAL: 3 ...


69

All SPF mechanisms, including include, can be used multiple times, separated by spaces: "v=spf1 include:_spf.google.com include:otherdomain.com -all" Evaluation of include works this way: If the included data returned PASS, then the include itself generates a result (for example, include:foo.bar generates a PASS, but -include:foo.bar generates a FAIL). If ...


69

Following up on https://serverfault.com/a/453260/14832, if you're using a version 2 Vagrantfile config format, the one which starts: Vagrant.configure("2") do |config| Then you might want to add this to that config file: config.vm.provider :virtualbox do |vb| vb.customize ["modifyvm", :id, "--natdnshostresolver1", "on"] end If you're using the old ...


68

SPF records detail which servers are allowed to send mail for your domain. Questions 1-3 really summarise the whole point of SPF: You're supposed to be listing the addresses of all the servers that are authorised to send mail coming from your domain. If you don't have an exhaustive list at this time, it's generally not a good idea to set up an SPF record. ...


67

The public DNS name always matches the public IP address. The public IP address stays the same for an instance until it is terminated or stopped. A reboot does not change the public IP address. If an EC2 instance is in a VPC, then it will retain the same public IP address across a stop and start. If an EC2 instance that is not in a VPC is stopped and ...


64

There is no record for that subdomain: $ dig BDASERVER.businessdts.com ; <<>> DiG 9.8.3-P1 <<>> BDASERVER.businessdts.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 11871 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ;; QUESTION SECTION: ;BDASERVER....


62

It depends on whether you want to delegate hosting the subdomain off to a different DNS server (or to the same server, but in a different zone file). You delegate a zone when you want some other entity to control it, such as a different IT department or organization. If you do, then you need NS records. If not, A or CNAME records will suffice. Let's say ...


60

Woo, I found a post on github that solved my problem. After Steve K. pointed out that it wasn't actually a DNS issue and was a connectivity issue, I was able to find a post on github that described how to fix this problem. Apparently the docker0 network bridge was hung up. Installing bridge-utils and running the following got my Docker in working order: ...


59

Never you mind the comments section below, and never you mind the previous answers in the edit history. After about an hour of some conversation with friends (thank you @joeQwerty, @Iain, and @JourneymanGeek), and some jovial hacking around we got to the bottom of both your question and the situation on the whole. Sorry for brusqueness and misunderstanding ...


58

According to the Section 5 of RFC 5321, if no MX record is present mail servers should fall back to the A record for the domain. This is probably what's happening.


58

Anyone who has a cached copy of the domain record will not bother updating it for 24 hours, so yes if your intent is to have at most a 5 minute window of unavailability you should wait until all of the outstanding caches have updated to live no more than 5 minutes.


57

You need to have separate SPF records for each subdomain you wish to send mail from. http://www.openspf.org/FAQ/The_demon_question The Demon Question: What about subdomains? If I get mail from pielovers.demon.co.uk, and there's no SPF data for pielovers, should I go back one level and test SPF for demon.co.uk? No. Each subdomain at Demon is a ...


57

What they're talking about is that when you use a CNAME to point to their services (which is only possible on subdomain, not the zone root - it can't coexist with the SOA and NS records that are required on the root of your zone), they can make a change to their own DNS records to work around some kind of availability issue. With a zone root, you must use ...


57

Multiple CNAME records for the same fully-qualified domain name is a violation of the specs for DNS. Some versions of BIND would allow you to do this (some only if you specified the multiple-cnames yes option) and would round-robin load-balance between then but it's not technically legal. There are not supposed to be resource records (RRs) with the same ...


Only top voted, non community-wiki answers of a minimum length are eligible