Re: dns port parameter in smb.conf

Hello,

I have a setup with two domain controllers (dc1 and dc2) using the 
samba_internal DNS backend.

On both servers, I configured Samba to listen on a non-standard DNS port 
(5353):

dns port = 5353

Samba is correctly listening on port 5353 (TCP/UDP on all interfaces).

I then installed BIND (named) and configured it to run on the standard 
port 53. For my AD zone, I set up forwarding to the local Samba DNS 
instance:

zone "myzone.alt." {
     type forward;
     forwarders { 127.0.0.1 port 5353; };
};

So effectively:

BIND handles all incoming DNS requests on port 53

Requests for the AD zone are forwarded to Samba DNS on 127.0.0.1:5353

Replication between dc1 and dc2 is working correctly, and samba-tool drs 
showrepl reports no errors.

My question is: is this architecture valid and recommended in 
production? Are there any known pitfalls or better practices for 
combining BIND with the samba_internal DNS backend in this way?

Thank you.




19.03.2026 16:05, Anton Shevtsov via samba пишет:
> Dear colleagues,
>
> I would like to clarify the purpose and intended use of the |dns port| 
> parameter in |smb.conf|.
>
> In my setup, I changed this parameter on a domain controller to a 
> non-standard port (e.g., 5353). When querying this port explicitly, 
> DNS resolution works as expected. However, DNS replication between 
> domain controllers no longer functions.
>
> Below is a relevant excerpt from the configuration and socket status:
>
> [root@dc ~]# grep 'dns port' /etc/samba/smb.conf dns port = 5353 
> [root@dc ~]# netstat -anp | grep 5353 tcp 0 0 192.168.150.10:5353 
> 0.0.0.0:* LISTEN 2393/samba tcp 0 0 192.168.171.10:5353 0.0.0.0:* 
> LISTEN 2393/samba tcp 0 0 127.0.0.1:5353 0.0.0.0:* LISTEN 2393/samba 
> tcp 0 0 ::1:5353 :::* LISTEN 2393/samba udp 0 0 192.168.171.10:5353 
> 0.0.0.0:* 2393/samba udp 0 0 192.168.150.10:5353 0.0.0.0:* 2393/samba 
> udp 0 0 127.0.0.1:5353 0.0.0.0:* 2393/samba udp 0 0 0.0.0.0:5353 
> 0.0.0.0:* 771/avahi-daemon: r udp 0 0 ::1:5353 :::* 2393/samba udp 0 0 
> :::5353 :::* 771/avahi-daemon: r
>
> From my understanding, this behavior is expected, as standard DNS 
> replication mechanisms assume the use of port 53.
>
> As a possible workaround, I am considering deploying a caching DNS 
> server (such as BIND) on the same host, listening on port 53, and 
> configuring it to forward DNS requests to Samba on port 5353.
>
> Could you please confirm whether such a configuration is supported and 
> would function correctly in terms of DNS replication?
>
> Thank you in advance for your assistance.
>
>
-- 
Anton
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba