0

I'm currently setting a Bind 9 server on a CentOS 7 system, but I have some kind of unexpected behavior (even though it worked great in my VM).

When I want to retrieve records from the zones it is authoritative, it doesn't retrieve the IP nor other information. But there is no problem to resolve address with recursion.

There are ACLs wich are set, but they allow everyone to query for the zones the bind server is authoritative .

What is odd is that named-checkzone and named-checkcong say it's ok. No error or warning in journalctl or messages.

Here the dig answer:

; <<>> DiG 9.9.5-9-Debian <<>> @194.214.124.129 atilf.fr
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 24159
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;atilf.fr.          IN  A

;; Query time: 0 msec
;; SERVER: 194.214.124.129#53(194.214.124.129)
;; WHEN: Thu Jun 04 11:55:34 CEST 2015
;; MSG SIZE  rcvd: 37
</code>

Log from bind debug, level 3 

<code>
04-Jun-2015 11:55:19.633 queries: info: client 194.214.124.244#34474 (atilf.fr): view internal: query: atilf.fr IN A +E (194.214.124.129)
04-Jun-2015 11:55:19.633 client: debug 3: client 194.214.124.244#34474 (atilf.fr): view internal: error
04-Jun-2015 11:55:19.633 client: debug 3: client 194.214.124.244#34474 (atilf.fr): view internal: send
04-Jun-2015 11:55:19.633 client: debug 3: client 194.214.124.244#34474 (atilf.fr): view internal: sendto
04-Jun-2015 11:55:19.633 client: debug 3: client 194.214.124.244#34474 (atilf.fr): view internal: senddone
04-Jun-2015 11:55:19.633 client: debug 3: client 194.214.124.244#34474 (atilf.fr): view internal: next
04-Jun-2015 11:55:19.633 client: debug 3: client 194.214.124.244#34474 (atilf.fr): view internal: endrequest

Edit:

What it's weird is that either i try it in the local network (wich is part of the internal view) or outside (from a server on the internet- part of the external view) the view is correct but from the external view the dig output display me a warning that recursion doesn't work (it seems when i query him he want to search recursively the domain - the same he is supposed to resolve hhimselffrom his own RR ). Her is the output from the command :

; <<>> DiG 9.9.2-P2 <<>> @194.214.124.129 atilf.fr
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 36852
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;atilf.fr.          IN  A

;; Query time: 12 msec
;; SERVER: 194.214.124.129#53(194.214.124.129)
;; WHEN: Mon Jun  8 14:51:49 2015
;; MSG SIZE  rcvd: 37

in the named.conf is set an internal view which contain public and private zones and local clients ca do recursion and access the cache, and an exte:rnal view which only allow external clients to query the authoritative public zones.

  • The problem was the directory containing my zones's files, the 'x' right (execution) was not set on the directory, so named couldn't get in to read files. I have changed the right to 750 (ownership root:named) and everything now is working fine. – math Jun 18 '15 at 9:21
0

A SERVFAIL error will be accompanied with a log line saying exactly what went wrong, so you can grep for that in your log files.

  • This is the line you talk about. But i can't figure what [1au] is :( 14:45:58.847818 IP 194.214.124.244.43279 > 194.214.124.129.domain: 23450+ [1au] A? ortolang.fr. (40) – math Jun 4 '15 at 13:17
0

I found the issue. The directory which contain my zones files didn't have the correct rights.

  • 3
    Thanks for posting an answer. Could you edit it and explain how the permissions were wrong and what you did to fix them? That way, the next user with the same problem will know what to do. – terdon Jun 8 '15 at 15:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.