27

All your clients would wait for a few seconds on every DNS lookup, for starters. IPv6 is not optional and modern operating systems treat it as such. A client looking for an address will look up both AAAA and A records, even if it does not seem to have any IPv6 connectivity at that exact moment. If you drop one of the queries, the client software doing the ...


18

You're looking at the client query logs, and normally a client will choose from one of the ephemeral ports to have your DNS server respond back to. Yes your server is listening on port 53, but your clients will most likely receive responses from your DNS server over ports 49152 to 65535. The fact that the source of your query traffic is choosing to use port ...


7

The traffic is returning to the external IP's port 80. Usually, the provided “source IP address” is spoofed, and somebody's trying to use your DNS server as part of a DDOS attack – specifically, a reflector attack. You should set up something like fail2ban to prevent your server from being used in such an attack. Or, to mitigate it, just configure your ...


7

There are a few things that don't make sense. First: CNAME mail prismapixel.studio Auto Proxied This means that mail.prismapixel.studio is a CNAME to prismapixel.studio. However, prismapixel.studio returns three A records, all hosted at Cloudflare. You've stated that Cloudflare does not host your email (naturally, since they'...


3

The question on what is the first server that gets queried depends on: Circumstances: what's already cached and where? The part of the DNS we are focusing on: How a recursive name server starts hierachically from the root? How a clients sends a query to its nearest recursive name server? Abstraction level: are we interested just in the delegation hierachy ...


3

You're not seeing the TXT record because you're not querying the TXT record. Solution: Query the TXT record. dig -t TXT _acme-challenge.pelicandd.com +short "a4OJqHKIlQUt689jaZxnfhhNgRDYPtPe9qNxGBczRoU"


2

Your domain's nameservers are set through your domain registrar, and only the registrars can change them. Thus the nameserver addresses returned in "Step 2" were sent to the root nameservers by your domain registrar when you change them at their web site. The root nameservers will only accept updates from the domain's listed registrar.


2

The main problem in terms of caching is that this some form of a broken response (I would think broken NODATA based on the suggested intent). DNS caching is done based on some TTL, for positive responses the RRSet TTL and for negative responses the cache TTL is based on the SOA record in the AUTHORITY section (specifically the TTL used is MIN(SOA TTL, SOA....


2

Please look here for Option 2 https://docs.microsoft.com/en-us/archive/blogs/josebda/multiple-names-for-one-computer-consolidate-your-smb-file-servers-without-breaking-unc-paths The problem is that client, when using Kerberos Auth (by default for domain shares) checks server for its name to avoid authenticating to wrong/fake server, and server responds with ...


2

DNS doesn't propagate, but is cached. Every recursive name server first looks from it's own cache if it has already resolved the record within its TTL and then asks for the authoritative servers. That's why you should always start debugging by querying the authoritative servers, and then the parents. DNSSEC enabled, but Hostinger DNS doesn't support it In ...


2

Is it legal? Sure. No laws exist against it. Is it syntactically correct? Sure, it doesn’t break any RFCs. Is it probable that someone will add a record for localhost.mydomain.com? You’ll have to contact the US company MyDomain, located in Massachusetts, and ask them if they have plans to use that hostname within the domain mydomain.com that they’ve owned ...


2

The primary purpose of the SERIAL field in the SOA is indeed to allow secondary nameservers to determine whether they should initiate a zone transfer because the zone has been updated. If you sync your zones via some other method, then this is not relevant and the SERIAL can be pretty much whatever. The SERIAL is not involved in any way in authoritative ...


2

You don't want to do that and can't - at least not simply. Why you don't want to - usually DCs are security critical and not accessible from public internet. I presume this is a playground so it might not be so bad. Why you can't. You use RFC1918 IPs for your DCs that are not routable over internet. To be able to domain join, you need public IPs or NAT. NAT ...


1

Firefox has cached your object and is revalidating the object with the origin server. You can tell this because it sent the If-Modified-Since: and Cache-Control: request headers. Firefox will generally revalidate cached objects in two situations: The cached object is stale, as determined by the Cache-Control: and Expires: response headers that were sent ...


1

As you have already noticed Windows DNS server only allows settings IP addresses in the list of servers to be notified. That's pretty much dead end. (Frankly, at first the question sounded like a bad idea, but as the goal is to enable gradual transition towards better practices, it's really a good question.) In BIND, you don't need use any more complex ...


1

One cause of this can be that the firewall is not set up to forward the replies from the public interface to the bridge. Try iptables-save | grep FORWARD to see what is being forwarded. Depending on what is there currently, you might need to add something like: iptables -A FORWARD -p udp -m udp --dport 53 -j ACCEPT It looks like you may be using NAT (given ...


1

As mentioned by @PatrickMevzek this wasn't a network or DNS issue. I checked the logs with debug level enabled and noticed this error: [Fri Jul 24 12:33:11.463639 2020] [ssl:info] [pid 9792:tid 139651482162944] [client clientip:26294] AH01964: Connection to child 441 established (server default.virtual.host:443) [Fri Jul 24 12:33:11.463917 2020] [ssl:debug] [...


1

You actually partly answer your own question: when I send a wget from the client to my proxy on Port 443 it is correctly forwarded to the virtual host and logged in my custom log The incorrect Apache redirect is the issue you have, because you're relying on the explicit port number, and that's not very common. RewriteCond %{SERVER_PORT} !^443$ This ...


1

The CNAME is set for the subdomain, not for the root domain, so if you want to query the CNAME you have to query the subdomain itself, for example: k1._domainkey.example.com.


1

I suspect your two-way trust might be the problem here. I can't think of a way to "hide" a trusted domain name even with the jiggery-pokery with CNAMEs. You may notice a different result if you use FQDNs. What happens when you try "OLD.TEST.TLD"? I'd expect that to hit the new location. Perhaps. Here's something to try: set up your CNAMEs ...


1

For your first question, I'm not sure what you're getting at. Are you saying that you don't think it's necessary to have a public DNS record for your domain? You're right, you don't, technically. The thing is, your domain namespace should be unique worldwide, and if it's subordinate to a namespace you already own, then you can be guaranteed it is unique. It ...


Only top voted, non community-wiki answers of a minimum length are eligible