New answers tagged domain-name-system
0
Solved. Everything works fine now.
Problem was that i have added vps2.server.com records in server.com domain DNS zone.
Solution is if someone is using panels like: plesk, cpanel, vestacp etc... create SUB-DOMAIN, do not create DNS records in main domain eg. server.com Zone.
Thank you all.
0
The problem is most likely not in the zone file on vps1, but in your zone file on vps2.
Bind on vps2 will need to be configured with a zone file for vps2.server.com and have the appropriate block in named.conf. The A records for ns?.vps2.server.com are merely glue records.
2
Is it legal? Sure. No laws exist against it.
Is it syntactically correct? Sure, it doesn’t break any RFCs.
Is it probable that someone will add a record for localhost.mydomain.com? You’ll have to contact the US company MyDomain, located in Massachusetts, and ask them if they have plans to use that hostname within the domain mydomain.com that they’ve owned ...
0
The problem is dig blah.net causes status: SERVFAIL while pointing at a nameserver resoloves fine (e.g. dig @ns-#.awsdns-##.net. blah.net works fine with status: NOERROR )
This indicates that whatever DNS server you're using on the host running dig is misconfigured, has corrupt cache, or is (to use a technical term) jacked up.
It also shows the records/...
0
Pre-amble: Your subject contradicts the body of the Q/A. The subject is a totally different scenario. The body of your question describes a theoretical event where two registrars think they have authority over one domain. The subject seems to refer to a scenario where two DNS hosts have a zone for the same domain -- so what happens if you change NS records ...
2
The primary purpose of the SERIAL field in the SOA is indeed to allow secondary nameservers to determine whether they should initiate a zone transfer because the zone has been updated. If you sync your zones via some other method, then this is not relevant and the SERIAL can be pretty much whatever.
The SERIAL is not involved in any way in authoritative ...
0
The process depends on your SSL certificate provider. If you are doing it with LetsEncrypt and all subdomains are served by the same HTTP server, then just pass each DN to certbot, e.g.
certbot certonly --standalone --http-01-port=8888 -d blog.example.com -d labs.example.com -d www.example.com
For a commercial SSL provider then if you want a single SSL ...
3
The question on what is the first server that gets queried depends on:
Circumstances: what's already cached and where?
The part of the DNS we are focusing on:
How a recursive name server starts hierachically from the root?
How a clients sends a query to its nearest recursive name server?
Abstraction level: are we interested just in the delegation hierachy ...
0
An authoritative nameserver must have a fixed IP address, as this address needs to be known by the authoritative nameservers for the higher level domains. For example, if your domain is example.com., then the nameservers for com. need to know what the nameservers are for your domain. This is done through your domain registrar, who forwards the updated ...
7
The traffic is returning to the external IP's port 80. Usually, the provided “source IP address” is spoofed, and somebody's trying to use your DNS server as part of a DDOS attack – specifically, a reflector attack.
You should set up something like fail2ban to prevent your server from being used in such an attack. Or, to mitigate it, just configure your ...
18
You're looking at the client query logs, and normally a client will choose from one of the ephemeral ports to have your DNS server respond back to. Yes your server is listening on port 53, but your clients will most likely receive responses from your DNS server over ports 49152 to 65535. The fact that the source of your query traffic is choosing to use port ...
0
Possibly because allow-recursion is not set. Try adding allow-recursion { 192.168/16; }; to named.conf.options.
0
If your DNS provider supports ALIAS records, use those. Otherwise do the repetition.
0
No, CNAME is an alias, it can only be used once.
What you can do is omit the name:
www IN A 10.0.0.1
IN A 10.0.0.2
IN A 10.0.0.3
The IN is also optional, so you can abbreviate this to
www A 10.0.0.1
A 10.0.0.2
A 10.0.0.3
0
You can do that by Nameserver record forwarding to Cloud DNS. You must enter the authoritative name servers for Cloud DNS in the name servers section of Google Domains, as opposed to adding them as NS records to the Google Domains managed zone. Please follow 1 for more details
2
You don't want to do that and can't - at least not simply.
Why you don't want to - usually DCs are security critical and not accessible from public internet. I presume this is a playground so it might not be so bad.
Why you can't.
You use RFC1918 IPs for your DCs that are not routable over internet. To be able to domain join, you need public IPs or NAT. NAT ...
1
Why does Firefox still make connections to server although the HTTP resources are shown as “cached”?
Firefox has cached your object and is revalidating the object with the origin server. You can tell this because it sent the If-Modified-Since: and Cache-Control: request headers.
Firefox will generally revalidate cached objects in two situations:
The cached object is stale, as determined by the Cache-Control: and Expires: response headers that were sent ...
0
Geez, how long does validation take? Even 5-10 seconds is an eternity for a recursive DNS lookup. Most servers timeout at 2 seconds. As far as zone TTLs, I wouldn't set them higher than 10 minutes personally. Otherwise any mistakes made will take the TTL expiration time to correct. A low TTL is fine if your DNS server can handle it. I have some 30 ...
0
192.168.2.254
listen-on port 53 { 192.168.2.254; }; - this tells bind to only answer queries originating from the same computer that runs bind.
==> pimmup.com.db <==
$TTL 86400
@ IN SOA pimmup.com. hostmaster.pimmup.com. (
2001062501 ; serial
21600 ; refresh ...
0
Ok so in the course of adding more context to the question I ended up solving the problem.
For those who stumble across this, for Windows clients, in order to increase the default TTL of 86,400 seconds (1 day), simply create a DWORD registry entry called MaxCacheTtl under the following key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNSCache\...
0
Yes you can accomplish this by deploying two dns server each on in each data center and connect them with high availability connecting two dns servers to HA (high availability)heart beat connecting two dns servers if active server goes down heart beat message stop travelingin in HA cable passive server stop listening heart beat messages and passive dns will ...
1
One cause of this can be that the firewall is not set up to forward the replies from the public interface to the bridge. Try iptables-save | grep FORWARD to see what is being forwarded.
Depending on what is there currently, you might need to add something like:
iptables -A FORWARD -p udp -m udp --dport 53 -j ACCEPT
It looks like you may be using NAT (given ...
1
Can you have a Microsoft DNS server send zone updates to a DNS server running on a nonstandard port?
As you have already noticed Windows DNS server only allows settings IP addresses in the list of servers to be notified. That's pretty much dead end. (Frankly, at first the question sounded like a bad idea, but as the goal is to enable gradual transition towards better practices, it's really a good question.)
In BIND, you don't need use any more complex ...
0
Are you writing a recursive resolver? You should not expect every possible scenario to be covered in RFCs, especially when they deal with people doing unexpected things. While they try to cover everything, this is impossible. You should do something reasonable given the circumstances.
What I expect to happen with real nameservers is that the recursive ...
2
DNS doesn't propagate, but is cached. Every recursive name server first looks from it's own cache if it has already resolved the record within its TTL and then asks for the authoritative servers. That's why you should always start debugging by querying the authoritative servers, and then the parents.
DNSSEC enabled, but Hostinger DNS doesn't support it
In ...
0
When ping makes a DNS query for ns1.example.com, it requests A record for ns1.example.com.
Glue records only tell the IP address of the DNS server that can respond to example.com zone DNS queries, including the A record query.
So the answer is no, glue record IP addresses are not supposed to be pingable.
0
I left a big piece of this out, to simplify.
There is Saltstack automation running on app server. The actual app itself calls Saltstack code as an api (tho you could call it a RPC). Running "above" this is a process that controls the api and associated code. It was last restarted three weeks before the DNS problem started. Intend to restart this ...
1
As mentioned by @PatrickMevzek this wasn't a network or DNS issue.
I checked the logs with debug level enabled and noticed this error:
[Fri Jul 24 12:33:11.463639 2020] [ssl:info] [pid 9792:tid 139651482162944] [client clientip:26294] AH01964: Connection to child 441 established (server default.virtual.host:443)
[Fri Jul 24 12:33:11.463917 2020] [ssl:debug] [...
1
You actually partly answer your own question:
when I send a wget from the client to my proxy on Port 443 it is
correctly forwarded to the virtual host and logged in my custom log
The incorrect Apache redirect is the issue you have, because you're relying on the explicit port number, and that's not very common.
RewriteCond %{SERVER_PORT} !^443$
This ...
0
Here are some interesting methods I found via experiments (using xxd to see tabs).
echo -e \\033c
s=$(echo -e "a\t\tb\t\tc\t\td\t\te\tf")
echo 'original string with tabs:'
echo "$s"
echo "$s" | xxd
echo -e '\nusing: \techo "$s" | tr -s \\\\t " "'
echo "$s" | tr -s \\t " "
echo "$s&...
2
Your domain's nameservers are set through your domain registrar, and only the registrars can change them. Thus the nameserver addresses returned in "Step 2" were sent to the root nameservers by your domain registrar when you change them at their web site. The root nameservers will only accept updates from the domain's listed registrar.
2
The main problem in terms of caching is that this some form of a broken response (I would think broken NODATA based on the suggested intent).
DNS caching is done based on some TTL, for positive responses the RRSet TTL and for negative responses the cache TTL is based on the SOA record in the AUTHORITY section (specifically the TTL used is MIN(SOA TTL, SOA....
0
In case there's no reverse ptr for ping -a <ip> or nslookup <ip> to show, you can run ipconfig /displaydns | clip, open a text editor, paste, and search for the IP there.
Note that this will work only if the original DNS query was done via the Windows DNS resolver - some apps do their own DNS queries, like newer browsers using DNS-over-HTTPS.
...
0
Check once the status of your SSL certificate . Whether root and intermediate SSL certificate and linked and installed properly or not check with you url in" SSL checker" website
And futher check in your web server whether your are application is accessible within server if yes . Further check with network engineer whether traffic is seen or dns is ...
google-cloud-platform
0
Thanks to @MichaelHampton that pointed out this fact that my local resolver has been configured to use a DNS server our side of the network that I had set up bind9 DNS server.
So after not configuration my local resolver using systemd-resolver and enabling DHCP of my modem, now a query from dig gives the right answer.
dig ppod.ir
; <<>> DiG 9.11....
2
Please look here for Option 2
https://docs.microsoft.com/en-us/archive/blogs/josebda/multiple-names-for-one-computer-consolidate-your-smb-file-servers-without-breaking-unc-paths
The problem is that client, when using Kerberos Auth (by default for domain shares) checks server for its name to avoid authenticating to wrong/fake server, and server responds with ...
0
Turns out it was because I had a CNAME for mail.domain.com and it was being proxied by Cloudflare. When I switched it to DNS only, nslookup returned the correct mail exchanger: mail.domain.com instead of randomletters.domain.com.
27
All your clients would wait for a few seconds on every DNS lookup, for starters. IPv6 is not optional and modern operating systems treat it as such. A client looking for an address will look up both AAAA and A records, even if it does not seem to have any IPv6 connectivity at that exact moment. If you drop one of the queries, the client software doing the ...
1
The CNAME is set for the subdomain, not for the root domain, so if you want to query the CNAME you have to query the subdomain itself, for example: k1._domainkey.example.com.
0
In a DNS resolution (converting domain name to IP address), is the order of IP addresses meaningful?
There is no order in the DNS which is why we say there are record sets, instead of saying record lists.
But your question is vague and depends of the record type. For SRV and MX records for example, there is an order, depending on various parameters in the record.
For A or AAAA record type that you may be thinking about, you get back (potentially) a set of ...
0
In a DNS resolution (converting domain name to IP address), is the order of IP addresses meaningful?
If you have multiple records that are responsive to a DNS request, the DNS server itself returns them in an unpredictable order. This is by design and is known as round robin DNS. Typically the client will only use the first record returned, but it could use more than one of the records if programmed to try them in turn, e.g. if a connection attempt fails.
1
For your first question, I'm not sure what you're getting at. Are you saying that you don't think it's necessary to have a public DNS record for your domain? You're right, you don't, technically. The thing is, your domain namespace should be unique worldwide, and if it's subordinate to a namespace you already own, then you can be guaranteed it is unique. It ...
1
I suspect your two-way trust might be the problem here. I can't think of a way to "hide" a trusted domain name even with the jiggery-pokery with CNAMEs.
You may notice a different result if you use FQDNs. What happens when you try "OLD.TEST.TLD"? I'd expect that to hit the new location. Perhaps.
Here's something to try: set up your CNAMEs ...
0
When you prepare an environment for redundancy, you should create some scenarious for which you want to protect your environment. Also you should have a budget as time and money for what you need to do.
You can use an http load balancer (reverse proxy) like haproxy, varnish...
You can use a CDN if you have more traffic.
More complex solutions involving BGP ...
0
I encountered this problem when I allowed the Ubuntu installer to install the Docker snap package. When I ditched that and switched to the official Docker package the problem resolved itself.
sudo snap remove docker
curl -fsSL https://get.docker.com -o get-docker.sh
sh get-docker.sh
1
TLDR; Delete your DS records at Godaddy
Looks like Hostinger does not support external registrar's with DNSSEC, you'll need to disable DNSSEC at godaddy
If DNSSECis important to you, transfer registrars to Hostinger to enable DNSSEC
https://dns.google/query?name=ecoguardfilters.com&type=A&dnssec=true
{
"Status": 2,
"TC": false,...
0
It's the owner of the IP address that controls the reverse DNS records, i.e.
for the 62.x.y.z it's "ISP A"
for the 154.x.y.z it's "ISP B".
If you need send mail from both, you could e.g. name one mail-a.example.com and the other mail-b.example.com, but it's best you don't use the same name for both, as the receiving mail system may ...
Top 50 recent answers are included
