53

Here is the command to modify an existing connection. nmcli con mod $connectionName ipv4.dns "8.8.8.8 8.8.4.4" connectionName can be found by command: nmcli con. In the question case, it will be "System eth0" If you want to ignore automatically configured nameservers and search domains, ie the settings passed from DHCP. nmcli con mod $...


30

This is an old question, but I think the other answers aren't really touching on the source of the confusion. NS records at the apex follow a different set of rules than NS records beneath the apex. The NS records at the apex do not define a referral. Instead, they provide the authoritative definition for those NS records. Any NS records beneath the apex do ...


16

In BIND 9, you can define multiple "views": in effect, BIND shows one version of a DNS zone to specified clients and another version to others. This seems to be exactly what you'll need. Here is a nice introduction to using views in BIND 9: https://kb.isc.org/article/AA-00851/0/Understanding-views-in-BIND-9-by-example.html In your case, though, the ...


14

Typically you would explicitly configure the DNS root servers similar to the snippet below: zone "." { type hint; file "/etc/bind/db.root"; }; Where you observe that zone type is not the common master nor slave but a special zone type called hint. When the name server starts up, it only uses the root hints to find a responding root name server and ...


12

A SERVFAIL answer tells you there's an issue reaching the DNS server for your domain, or that it isn't set up properly. It looks like you're only replying to A queries from your DNS server, which might explain why some nameservers don't like your domain. A trace outputs the following: dig +trace iwanhae.ga ; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.23....


11

This looks to me like an AppArmor problem. Try setting it to permissive temporarily and see if the problem goes away. By default, the Bind/Named daemon does not have permission to write to the zone files in /etc. It can only read them. Therefore, the nsupdate process cannot write to them either. If you're dynamically updating your DNS, you should store ...


11

Another way of tracing DNS resolution without using the local resolver for anything except finding the root nameservers, is using dnsgraph (Full disclosure: I wrote this). It has a command line tool and a web version, of which you can find an instance at http://ip.seveas.net/dnsgraph/ Example for serverfault.com, which actually has a DNS problem right now:


11

the search indicate what domain(s) to append to your host name in a search. for example if you run this command : ping myserver if you do not have anything in the search domain, it will search for "myserver" in your hostfile, and if nothing there, it will return unknown host but if you add search mydomain.com then the same ping would return 64 bytes ...


11

If you are running a public accessible DNS server then other clients may be start using you. Maybe to use you as a public resolver or maybe to abuse your service for an DNS amplification attack. If you are not running a public server and have 127.0.0.1 setup as your resolver on that server: It's most likely queries your applications make to resolve ...


11

High performance and low memory usage + short cache time are conflicting requirements. However, what should happen when hitting the max-cache-size limit is that it should start (prematurely) evicting entries from the cache (LRU). Forcing shorter TTLs (max-cache-ttl) sacrifices performance in favor of quicker convergence. (Probably a bad idea as this will ...


11

I'm basically parroting Michael here, but this is too much to paste into a comment: ;sai.ngo. IN A ngo. 172800 IN NS b0.nic.ngo. ngo. 172800 IN NS d0.nic.ngo. ngo. 172800 IN NS a2.nic.ngo. ngo. 172800 IN NS a0....


10

The error messages and the referenced RFC2181 5.4.1 pretty much already tells what's wrong: you are having conflicting NS records in your zone and in the parent zone as "glue" records. "Glue" above includes any record in a zone file that is not properly part of that zone, including nameserver records of delegated sub- zones (NS records), address ...


10

there is good TUI tool developed by red hat named nmtui that you really should try. it is pre-installed on various distros, nowadays, but if it is not on yours, try: sudo yum install networkmanager-tui it uses a curses based text interface - accessible from the command line. nmcli is only especially necessary when writing scripts, and has larger room for ...


9

There is such a thing as "too many nameservers", but not for the reasons you're concerned with. The others have covered the irrelevance of latency concerns and I won't beat that horse to death. The real problem with adding too many nameservers is authority bloat. A reply to a SOA record request should not exceed 512 bytes if at all possible, including both ...


9

Ok it seems I can now give a rough answer to my own question. Anurag Bhatia says that there exist two methods how a CDN works: DNS Have DNS to do the magic i.e when users from network ISP A lookup for cdn.website.com, they should get a unicast IP address of Cache A in return, similarly for users coming from ISP B network, Cache B’s unicast IP should return. ...


9

From the Route 53 documentation on record values: CNAME — Canonical name The fully qualified domain name (for example, www.example.com) that you want Amazon Route 53 to return in response to DNS queries for this resource record set. A trailing dot is optional; Amazon Route 53 assumes that the domain name is fully qualified. This means that ...


8

The DNS Response message header contains a bit indicating whether the resolved name came from an authoritative server, this would be the field called AA in the header reference table listed below: +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ | ID | +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ |QR| ...


8

The two error messages are both indications of the same misconfiguration. In the com. zone, you have two NS records pointing to ns51.domaincontrol.com. and ns52.domaincontrol.com. Both respond to queries for the zone, however when either of those servers are queried for NS records for the zone, they only report ns51.domaincontrol.com. The likely ...


7

The nameservers currently listed at the .pt top level registry are ns1.esoterica.com and ns2.esoterica.com. When I query those two servers, neither of them has any information about your domain, so they can't answer DNS queries. Obviously I can't know whether esoterica.com are your old or your new provider, but it's obvious that the .pt registry is not in ...


7

The change in behaviour seems to be related to this changelog (from RedHat's site): 2015-02-19 12:00:00 Tomas Hozza <thozza@redhat.com> 32:9.8.2-0.35.rc1: - Enable RPZ-NSIP and RPZ-NSDNAME during compilation (#1176476) NSDNAME enables a filtering policy based on authoritative nameserver, one can write for example: a.ns.facebook.com.rpz-nsdname CNAME ...


7

Let's be clear. Ever since the outage of a low cost low end provider of whatever you do not trust a technology that is proven. Why? You think everyone is as incompetent as GoDaddy? Never had a DNS issue in years. I'm thinking of using Route 53, CloudFlare DNS, and another provider. This means I'd probably end up with about 13 name servers attached to ...


7

RFC2182 section 5 recommends at least 3 nameservers, and preferably no more than 7.


7

Focusing on the actual problem with your domains: Following the chain of delegations for lamardesigngroup.com you'll see a delegation to ns1.lamardesigngroup.com and ns2.lamardesigngroup.com with glue referring to 212.1.213.8. lamardesigngroup.com. 172800 IN NS ns1.lamardesigngroup.com. lamardesigngroup.com. 172800 IN NS ns2....


7

There are several things to address here: Zones vs files It's probably more relevant to talk about how many zones they have, rather than how many files they have. It will depend on the nameserver software how zone data is stored. (Eg individual files, data for all zones compiled into a combined file, an RDBMS, something else.) What matters is the responses ...


6

I was having very similar issues until I changed the location of where I stored my zone files. Bind had permission to write to /var/cache/bind, but your zone files are stored in /etc/bind/.... Bind does not currently have permission to write to files in /etc/bind/..., so you would need to update Bind's permissions or store the zone files in a directory ...


6

The nameservers appear to be somewhat less than optimally set up. Looking at the output from DNSCheck for volumeone.org, there are a few things that stand out. The two name servers are both on the same AS. This means that if there is any problem reaching that AS, then neither of your nameservers will be accessible. It's generally recommended to have name ...


6

The error messages in the question actually say it all, the problem is simply that the names ns{1,2}.mediamechanic.net referenced in your NS records do not resolve at this point in time. For .com/.net it "kind of works" despite there being an obvious problem because many resolvers just use the received glue without looking up the authoritative records. Both ...


6

Either specify notify master-only; in the options section or specify notify no; in the slave zone definitions if you do not want notify messages to be sent. Notify messages are by default sent to all the zone's nameservers (based on NS records in zone data) except that of SOA MNAME (also see notify-to-soa).


6

The problem is that websitewelcome.com effectively delegated the domain to 1and1: $ dig NS uptowngreenville.com @ns1144.websitewelcome.com ... ;; ANSWER SECTION: uptowngreenville.com. 86400 IN NS ns58.1and1.com. uptowngreenville.com. 86400 IN NS ns57.1and1.com. Also weird, when you trace the resolution, the upstream resolver gives ...


6

No, you should not add RFC1918 IP addresses to public glue records. There are a few reasons for this: If your internal hosts use a DNS server outside the LAN where the RFC1918-addressed authoritative nameservers are, a SERVFAIL will result for obvious reasons It adds garbage to the set of glue records It will have unintended consequences if a resolver in a ...


Only top voted, non community-wiki answers of a minimum length are eligible