33

It's a wildcard DNS entry. The dns.nextdns.io zone is configured to return 45.90.28.0 as a response to a query for anything in front of dns.nextdns.io. Here are some examples, looking for foo and bar. And for good measure, they might already have those two in their zone because they are commonly used for testing and demos, so let's look for something that ...


27

All your clients would wait for a few seconds on every DNS lookup, for starters. IPv6 is not optional and modern operating systems treat it as such. A client looking for an address will look up both AAAA and A records, even if it does not seem to have any IPv6 connectivity at that exact moment. If you drop one of the queries, the client software doing the ...


23

The authoritative answers for the ns{1-6}.maccentrecloud.com.au names point to: ns1.maccentrecloud.com.au. 1800 IN A 208.94.148.4 ns2.maccentrecloud.com.au. 1800 IN A 208.80.124.4 ns3.maccentrecloud.com.au. 1800 IN A 208.80.126.4 ns4.maccentrecloud.com.au. 1800 IN A 208.80.125.4 ns5.maccentrecloud.com.au. 1800 IN ...


20

Netstat almost certainly won't be able to help you. Netstat displays open sockets and active connections at the moment you execute the program. A DNS request will happen entirely too quickly for you to catch it because it'll be gone and done in less time than it takes to type out the command parameters. Moreover, UDP is stateless, so there isn't an active ...


20

There's nothing special in the cloudflare setup. This is just a property of HTTP. When a client opens a URL, there are three important steps: If required, it makes a DNS (or other resolution method) to turn a hostname into an IP address. If the URL specifies an IP address for the host, use that. It makes a connection to that IP address on a well-known ...


19

You're looking at the client query logs, and normally a client will choose from one of the ephemeral ports to have your DNS server respond back to. Yes your server is listening on port 53, but your clients will most likely receive responses from your DNS server over ports 49152 to 65535. The fact that the source of your query traffic is choosing to use port ...


18

I don't think netstat will let you inspect the actual traffic but tcpdump will if you don't have access to netcat. tcpdump udp port 53 should show you the traffic.


16

The supposed domain name in the question indeed looked unusual, so I went searching for context. Google led me here https://github.com/nextdns/nextdns/blob/91b3c6cc735c779c730c3b93a7b0372c9e11774f/resolver/endpoint/manager.go#L139 which looks like a perfect match for the string in the question. Relevant fragments of code: var TestDomain = "probe-test.dns....


16

This seemed like overkill to me, we already wont come close to filling the single /64 but this might be my IPv4 mindset confusing me. Stop counting hosts, that's IPv4 thinking. Subnets come in one size fits all, enormous. A /64 can address every IP device ever made with plenty room to spare. Yet the address space is even bigger such that a single site ...


15

"Never attribute to malice that which is adequately explained by stupidity." I would guess that your domain provider didn't purposefully lie to you so much as misunderstand what you were asking for because they didn't know what a CAA record was. They probably saw the word certificate somewhere in the conversation and assumed you were talking about the ...


13

When you need a help with a particular domain DNS don’t try to hide its name. It doesn’t help with diagnostics. The IP for festivaldeglobos.mx is 189.139.85.147 while the IP for www.festivaldeglobos.mx is 189.139.107.23 - you should make both the same. Don’t mix CNAME and A records for the same name. It’s not permitted by the DNS specification and leads to ...


12

Your domain does not have an MX record. But an MTA is listening on the A record's IP, and that is the fallback of SMTP in case there is no MX record.


11

To answer the question in your headline: No, it is not necessary to create an AAAA record for your website as long as most traffic runs over IPv4, but I would argue that it probably is beneficial for the deployment of IPv6 to have more sites support the protocol. To answer the question in your post: Yes, if you want your site to support IPv6 traffic, ...


10

You have 6 name servers. 2 of them have the wrong zone information. Thus most of the time the answers are correct, but occasionally you hit a bad DNS server. I'm not at my PC at the moment but you can check what each server is returning with a command like dig @nsX.maccentrecloud.com.au elyseecollective.com.au A For each nameserver and find the faulty ...


10

Please note you have to wait for a while until changes in your DNS zone will be updated on servers worldwide. Your problem is that you're trying to check if changes are applied to the DNS too fast. There is a good way out from this case and it requires using DNS provider's API. If you use for instance OVH, you can use their API for DNS changes and certbot ...


9

First: get that /48. For security and manageability not putting everything in a single broadcast domain (VLAN) is good practice. Second: for servers just configure the addresses statically. You can use SLAAC, DHCPv6 and static addresses on the same network if you want. It's not very common to put IPv6 addresses of workstations in DNS, but there are use ...


9

No, or not necessarily. .dev like all new Google TLDs (including .new in one month) has been added to the HSTS Preloading list. It means that all names under this TLD will force browsers (because they incorporate the HSTS preloading list) to do only HTTPS calls, and never HTTP one. You can find Google explanations at https://security.googleblog.com/2017/09/...


9

This is an issue within CenturyLink network. You need to talk to them about the issue and get it resolved.


8

Short answer: Yes. Longer: I would suggest you adding exactly www.example.com and not *.example.com unless you don't want to ever use any sub-domain like john.example.com and jane.example.com, etc.... Also, do not forget to configure your apache/nginx (which ever you use) to accept connections for both domain names.


8

Don't mix AD, Hyper-V and File Server in one Windows Server instance. Just install Hyper-V on baremetal and deploy sepearte Windows VMs for AD and FileServer role. Virtual Switches allow you to segregate network interfaces for each role. Here is explanation regarding combining Hyper-V and AD role on the same server: https://www.hyper-v.io/combining-hyper-v-...


8

According to RFC 7208 section 3.2: 3.2. Multiple DNS Records A domain name MUST NOT have multiple records that would cause an authorization check to select more than one record. See Section 4.5 for the selection rules. And section 4.5 says: If the resultant record set includes more than one record, check_host() produces the "...


7

Note that in a zone file, names not ending with a dot . are relative, usually to the current domain. So an entry for _acme-challenge.db.example.com inside the zone for db.example.com actually means an entry for _acme-challenge.db.example.com.db.example.com. To make sure you have the right entry, you can either: Add a dot a the end: _acme-challenge.db....


7

There are several things to address here: Zones vs files It's probably more relevant to talk about how many zones they have, rather than how many files they have. It will depend on the nameserver software how zone data is stored. (Eg individual files, data for all zones compiled into a combined file, an RDBMS, something else.) What matters is the responses ...


7

The traffic is returning to the external IP's port 80. Usually, the provided “source IP address” is spoofed, and somebody's trying to use your DNS server as part of a DDOS attack – specifically, a reflector attack. You should set up something like fail2ban to prevent your server from being used in such an attack. Or, to mitigate it, just configure your ...


7

There are a few things that don't make sense. First: CNAME mail prismapixel.studio Auto Proxied This means that mail.prismapixel.studio is a CNAME to prismapixel.studio. However, prismapixel.studio returns three A records, all hosted at Cloudflare. You've stated that Cloudflare does not host your email (naturally, since they'...


6

This looks like a Kerberos issue; if I'm correct, then the server's AD computer account(*) has a registered SPN for HTTP/SERVERNAME (this can be verified with the SETSPN command-line tool), thus automatic Kerberos authentication can happen when the web service is called using the computer's name; however, when calling the web service with any other name, ...


6

You only need to worry about what the banner name is when mail2 is used to send an outgoing mail. And in that case, it should still match the reverse DNS for the IP it is using. About the only thing left to check is that the proper name is used in any SSL certs (all 3 names need to match for each server - banner/helo name, name in SSL cert, and reverse ...


6

As is noted already in the question, there is a conflict between the desire of not accepting incoming email and the idea of being able to contact the domain owner via email by convention-based email addresses. There is just no way around those two goals being in direct conflict, you will have to decide if you are going to accept email or not. If you decide ...


6

it needs to change his DNS settings to that of the Domain Controller IP address This isn't actually correct. You need to have your client (the machine you want to join the domain) be using a DNS server (or servers) that knows all the records for the AD domain; that doesn't have to be a DC. In many environments, its really easy to simply make the Venn ...


5

Here's a little systemd service that lets you specify an alias for your current machine like test.local in addition to hostname.local (assuming your machine is called hostname). Setup First install avahi-utils, if you haven't already: sudo apt-get install avahi-utils Then put the following into /etc/systemd/system/avahi-alias@.service [Unit] Description=...


Only top voted, non community-wiki answers of a minimum length are eligible