Re: problem with zone delegation
Igor Serebryany <[email protected]>
| Newsgroups | gmane.network.dns.bind9.dlz |
|---|---|
| Message-ID | <[email protected]> |
On Fri, 23 May 2008, Rob Butler wrote: > Update your authority query to only return results where host = '@'. > select ttl, type, data, resp_person, serial, refresh, retry, expire, minimum > from dns_records where zone = '%zone%' and (type = 'SOA' or type='NS') > and host ='@' I can try this later today, however I can't think of why this would work. The result seems to be that I would be getting (from the example in my email below) only the two nameservers for my actual zone instead of all four for my zone and for the delegated zone. There is still no way for the authority query to return only the results for host 'sub' in zone 'example.com'... > I believe you also need the IP's for ns1.external.com & ns2.external.com in your example.com zone for delegation to work. Otherwise you get into a catch-22 where the resolver knows the name of the external.com name servers, but not the IP so it can't get to the name servers. I can try putting that in there but this also doesn't make sense. How would dlz resolve ns1.external.com. from zone example.com ? Or should I put the ip address in my zone as ns1.external.com.example.com ? > Rob > > ----- Original Message ---- > From: Igor Serebryany <[email protected]> > To: [email protected] > Sent: Thursday, May 22, 2008 6:28:02 PM > Subject: [Bind-dlz-testers] problem with zone delegation > > > hi, > > i think i may have discovered a bug in bind-dlz. I am attempting to > delegate a zone to outside nameservers. my mysql database has data > that looks like this (irrelevant fields omited): > host type data zone > @ ns ns1.myserver.com. example.com > @ ns ns2.myserver.com. example.com > sub ns ns1.external.com. example.com > sub ns ns2.external.com. example.com > > What i am not hosting any other records for sub.example.com, however > n1 and ns2.external.com have the complete zone. > > this is the appropriate way to delegate zones in bind. however, > this does not work with dlz. i think this is because, for the > authority query, no host is returned. when i dig the authority > section for example.com from the dlz server, i get all 4 nameservers > listed like this: > > ;; AUTHORITY SECTION: > example.com. 600 IN NS ns1.myserver.com. > example.com. 600 IN NS ns2.myserver.com. > example.com. 600 IN NS ns1.external.com. > example.com. 600 IN NS ns2.external.com. > > where i would expect to see only the two nameservers for the host @ > and not any of the servers for the host 'sub'. > > This causes other problems as well. for instance, suppose i have NS > records for both @ and sub with different TTL values. because > they're both returned in one result, i get the bind error 'bad TTL' > since bind expects all RRSETs to have the same TTL. but the > nameservers for sub are not part of the RRSET for @! > > this is a pretty major problem. i had to move the zone for an > affected (major) client back to a bind file to fix the delegation > issue, so this is pretty much a showstopper for DLZ. Any > workarounds would be appreciated. > > Here is my named.conf file and db scheme, just in case: > > dlz "Mysql zone" { > database "mysql > {host=localhost dbname=mydb user=bind pass=mypass socket=/var/lib/mysql/mysql.sock} > {select zone from dns_records where zone = '%zone%'} > {select ttl, type, mx_priority, data from dns_records where zone = '%zone%' and host = '%record%' > and not (type = 'SOA' or type = 'NS')} > {select ttl, type, data, resp_person, serial, refresh, retry, expire, minimum > from dns_records where zone = '%zone%' and (type = 'SOA' or type='NS')} > {} > {} > {}"; > }; > > mysql> describe dns_records; > +-------------+------------------------------------------------------------+------+-----+---------+----------------+ > | Field | Type | Null | Key | Default | Extra | > +-------------+------------------------------------------------------------+------+-----+---------+----------------+ > | id | int(10) unsigned | NO | PRI | NULL | auto_increment | > | zone | text | NO | MUL | NULL | | > | host | text | YES | | NULL | | > | type | enum('AAAA','PTR','SOA','NS','MX','A','CNAME','TXT','KEY') | NO | | NULL | | > | data | varchar(256) | YES | | NULL | | > | ttl | int(11) | NO | | 86400 | | > | mx_priority | text | YES | | NULL | | > | refresh | int(11) | YES | | NULL | | > | retry | int(11) | YES | | NULL | | > | expire | int(11) | YES | | NULL | | > | minimum | int(11) | YES | | NULL | | > | serial | bigint(20) | YES | | NULL | | > | resp_person | text | YES | | NULL | | > | uberid | int(11) | NO | MUL | NULL | | > +-------------+------------------------------------------------------------+------+-----+---------+----------------+ > 14 rows in set (0.00 sec) > > Thanks! > > --Igor > ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/