Re: Help requested for zone delegation using DLZ
"Mike Toler" <[email protected]> Fri, 6 Nov 2009 16:02:18 -0600
| Newsgroups | gmane.network.dns.bind9.dlz |
|---|---|
| Message-ID | <56DA5079467D1C48B857C6FE59D5D4FC03234516@prodeaserve.prodea.local> |
Ok, I just went through my data again and can find no instances of fully
qualified zones that are not terminated with a period "."
All lookups to the two servers for Records that are on that server work
100% of the time.
According to Todd, the NS for the secondary domain can't be within the
sub-domain, but has to be in the primary domain.
ns1.us.example.com won't work, but ns1-us.example.com should.
What follows in a complete lookup of all entries on ServerA and ServerB.
These are the commands I entered:
host -v -t soa example.com 127.0.0.1
host -v -t ns example.com 127.0.0.1
host -v -t a ns1.example.com 127.0.0.1
host -v -t a ns1-us.example.com 127.0.0.1
host -v -t ns us.example.com 127.0.0.1
host -v -t soa us.example.com 172.24.1.93
host -v -t ns us.example.com 172.24.1.93
host -v -t a ns1-us.example.com 172.24.1.93
host -v -t a test1.us.example.com 172.24.1.93
host -v -t soa us.example.com 127.0.0.1
host -v -t ns us.example.com 127.0.0.1
host -v -t a test1.us.example.com 127.0.0.1
The results follow below.
The tests are run ON ServerA (hence the 127.0.0.1 IP for the server in
the first and last section of commands). ServerB is 172.24.1.93, which
is the server used in the middle set of commands.
What I see is:
All "example.com" entries work fine on ServerA. (@ SOA, @ NS, ns1 A,
ns1-us A)
The lookup for the NS record for us.example.com works fine on ServerA.
(returns ns1-us.example.com)
Lookups directly to ServerB work as expected
@ SOA returns SOA record.
@ NS returns ns1-us.example.com
ns1-us.example.com A returns IP
test1.us.example.com returns correct IP.
The hangup, as it has been all along, is when I attempt to use zone
delegation.
SOA Fails: Host us.example.com not found: 2(SERVFAIL)
NS works because it's the same query from the first section.
test1.us.example.comf fails: Host test1.us.example.com not found:
2(SERVFAIL)
I think I'm beginning to believe that this is just not going to work
with DLZ.
These are the raw results of the "host -v" commands.:
[root@int-svc-11 ~]# host -v -t soa example.com 127.0.0.1
Trying "example.com"
Using domain server:
Name: 127.0.0.1
Address: 127.0.0.1#53
Aliases:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8992
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;example.com. IN SOA
;; ANSWER SECTION:
example.com. 300 IN SOA ns1.example.com.
hostmaster.example.com. 2009091600 900 2800 8640 1080
;; AUTHORITY SECTION:
example.com. 300 IN NS ns1.example.com.
Received 94 bytes from 127.0.0.1#53 in 5 ms
[root@int-svc-11 ~]# host -v -t ns example.com 127.0.0.1
Trying "example.com"
Using domain server:
Name: 127.0.0.1
Address: 127.0.0.1#53
Aliases:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31144
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;example.com. IN NS
;; ANSWER SECTION:
example.com. 300 IN NS ns1.example.com.
Received 47 bytes from 127.0.0.1#53 in 45 ms
[root@int-svc-11 ~]# host -v -t a ns1.example.com 127.0.0.1
Trying "ns1.example.com"
Using domain server:
Name: 127.0.0.1
Address: 127.0.0.1#53
Aliases:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38408
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;ns1.example.com. IN A
;; ANSWER SECTION:
ns1.example.com. 300 IN A 172.24.2.196
;; AUTHORITY SECTION:
example.com. 300 IN NS ns1.example.com.
Received 63 bytes from 127.0.0.1#53 in 4 ms
[root@int-svc-11 ~]# host -v -t a ns1-us.example.com 127.0.0.1
Trying "ns1-us.example.com"
Using domain server:
Name: 127.0.0.1
Address: 127.0.0.1#53
Aliases:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53566
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;ns1-us.example.com. IN A
;; ANSWER SECTION:
ns1-us.example.com. 300 IN A 172.24.1.93
;; AUTHORITY SECTION:
example.com. 300 IN NS ns1.example.com.
Received 70 bytes from 127.0.0.1#53 in 6 ms
[root@int-svc-11 ~]# host -v -t ns us.example.com 127.0.0.1
Trying "us.example.com"
Using domain server:
Name: 127.0.0.1
Address: 127.0.0.1#53
Aliases:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57567
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;us.example.com. IN NS
;; ANSWER SECTION:
us.example.com. 300 IN NS ns1-us.example.com.
Received 53 bytes from 127.0.0.1#53 in 5 ms
[root@int-svc-11 ~]#
[root@int-svc-11 ~]# host -v -t soa us.example.com 172.24.1.93
Trying "us.example.com"
Using domain server:
Name: 172.24.1.93
Address: 172.24.1.93#53
Aliases:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 35127
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;us.example.com. IN SOA
;; ANSWER SECTION:
us.example.com. 300 IN SOA ns1-us.example.com.
hostmaster.us.example.com. 2009091600 900 2800 8640 1080
;; AUTHORITY SECTION:
us.example.com. 300 IN NS ns1-us.example.com.
Received 100 bytes from 172.24.1.93#53 in 2 ms
[root@int-svc-11 ~]# host -v -t ns us.example.com 172.24.1.93
Trying "us.example.com"
Using domain server:
Name: 172.24.1.93
Address: 172.24.1.93#53
Aliases:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21957
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;us.example.com. IN NS
;; ANSWER SECTION:
us.example.com. 300 IN NS ns1-us.example.com.
Received 53 bytes from 172.24.1.93#53 in 1 ms
[root@int-svc-11 ~]# host -v -t a ns1-us.example.com 172.24.1.93
Trying "ns1-us.example.com"
Using domain server:
Name: 172.24.1.93
Address: 172.24.1.93#53
Aliases:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37465
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;ns1-us.example.com. IN A
;; ANSWER SECTION:
ns1-us.example.com. 300 IN A 172.24.1.93
Received 52 bytes from 172.24.1.93#53 in 1 ms
[root@int-svc-11 ~]# host -v -t a test1.us.example.com 172.24.1.93
Trying "test1.us.example.com"
Using domain server:
Name: 172.24.1.93
Address: 172.24.1.93#53
Aliases:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53493
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;test1.us.example.com. IN A
;; ANSWER SECTION:
test1.us.example.com. 300 IN A 1.2.3.4
;; AUTHORITY SECTION:
us.example.com. 300 IN NS ns1-us.example.com.
Received 75 bytes from 172.24.1.93#53 in 1 ms
[root@int-svc-11 ~]#
[root@int-svc-11 ~]# host -v -t soa us.example.com 127.0.0.1
Trying "us.example.com"
Received 32 bytes from 127.0.0.1#53 in 10 ms
Trying "us.example.com"
Using domain server:
Name: 127.0.0.1
Address: 127.0.0.1#53
Aliases:
Host us.example.com not found: 2(SERVFAIL)
Received 32 bytes from 127.0.0.1#53 in 5 ms
[root@int-svc-11 ~]# host -v -t ns us.example.com 127.0.0.1
Trying "us.example.com"
Using domain server:
Name: 127.0.0.1
Address: 127.0.0.1#53
Aliases:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49146
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;us.example.com. IN NS
;; ANSWER SECTION:
us.example.com. 300 IN NS ns1-us.example.com.
Received 53 bytes from 127.0.0.1#53 in 3 ms
[root@int-svc-11 ~]# host -v -t a test1.us.example.com 127.0.0.1
Trying "test1.us.example.com"
Received 38 bytes from 127.0.0.1#53 in 4 ms
Trying "test1.us.example.com"
Using domain server:
Name: 127.0.0.1
Address: 127.0.0.1#53
Aliases:
Host test1.us.example.com not found: 2(SERVFAIL)
Received 38 bytes from 127.0.0.1#53 in 4 ms
Michael
-----Original Message-----
From: Michael Kirkpatrick [mailto:[email protected]]
Sent: Wednesday, November 04, 2009 10:08 PM
To: [email protected]
Subject: Re: [Bind-dlz-testers] Help requested for zone delegation using
DLZ
Here is what I have found with sub delegation.
All requests initially go to the name servers of example.com.
They pick up the name servers to look at for us.example.com.
Then they query the name servers of us.example.com. Basically a little
recursion is going on.
I can't stress this enough. Always follow the name with a "period".
It dawned on me when I looked over your settings again that you had
entries
as example.com without a trailing period. In bind it interprets that as
example.com.example.com if you don't have that period. Basically
shorthand
so you can just enter @ or www without having to spell out the entire
domain
name.
On server A:
You need an NS record pointing to server B for us.example.com
On Server B:
Don't forget to have the same NS record pointing to itself.
Basically the NS records on server A and server B are going to be the
same
for us.example.com.
This is how I sub delegated one of my domains (Raw File Format):
Primary: ns1.example.com (10.0.0.1)
Secondary: ns2.example.com (10.0.0.2)
Sub Primary: sub1.example.com (192.168.0.1)
Sub Primary: sub2.example.com (192.168.0.2)
Primary & secondary servers:
@ IN SOA example.com. ns1.example.com. hostmaster.example.com.
(.....)
@ NS ns1.example.com.
@ NS ns2.example.com.
us NS sub1.example.com.
us NS sub2.example.com.
sub1 A 192.168.0.1
sub2 A 192.168.0.2
ns1 A 10.0.0.1
ns2 A 10.0.0.2
Sub Primary (192.168.0.1) & Secondary (192.168.0.2) servers:
@ IN SOA us.example.com. sub1.example.com. hostmaster.example.com.
(.....)
@ NS sub1.example.com.
@ NS sub2.example.com.
@ A 127.0.0.1
www A 127.0.0.2
Hopefully this will shed a little light on what you may be doing wrong.
If you do an nslookup on www.us.example.com and get 127.0.0.2 back, then
the
sub delegation is working properly. Make sure you do the nslookup
against
ns1.example.com or ns2.example.com. That will force nslookup to recurse
to
sub1.example.com or sub2.example.com for the final answer.
Dig on the other hand will often refer to the root servers on the web
and if
you are tinkering around with this and literally using example.com then
there is a good change dig will hit the true name servers for that
domain
instead of your local domain servers. Also depending on your
distribution
dig may not be set up to do automatic recursion by default. You may
have to
supply the proper flag to get dig to recurse.
On Wed, Nov 4, 2009 at 1:16 PM, Mike Toler
<[email protected]>
wrote:
> Well, still no luck.
>
<SNIP>
------------------------------------------------------------------------
------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008
30-Day
trial. Simplify your report design, integration and deployment - and
focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
_______________________________________________
Bind-dlz-testers mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bind-dlz-testers
This message is confidential to Prodea Systems, Inc unless otherwise indicated
or apparent from its nature. This message is directed to the intended recipient
only, who may be readily determined by the sender of this message and its
contents. If the reader of this message is not the intended recipient, or an
employee or agent responsible for delivering this message to the intended
recipient:(a)any dissemination or copying of this message is strictly
prohibited; and(b)immediately notify the sender by return message and destroy
any copies of this message in any form(electronic, paper or otherwise) that you
have.The delivery of this message and its information is neither intended to be
nor constitutes a disclosure or waiver of any trade secrets, intellectual
property, attorney work product, or attorney-client communications. The
authority of the individual sending this message to legally bind Prodea Systems
is neither apparent nor implied,and must be independently verified.
------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what's new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july