3

I'm using CentOS 7 and want to configure Bind 9 to work on both simple queries & Reverse DNS lookups.
so far Bind works on queries but not on reverse ones.
this is part of "named.conf" file:

NOTE: sample IP: "a.b.c.d" sample doamin: "example.com"

zone "c.b.a.in-addr.arpa" IN {
    type master;
    file "rev.example.com.db";
    allow-update { "none"; };
};

and corresponding reverse zone file
"rev.example.com.db":

$TTL 3600
@   IN SOA      ns1.example.com.    admin.example.com. (
    2017061514
    10800
    1800
    43200
    3600
)

@       IN NS       ns1.example.com.
ns1     IN A        a.b.c.d
d       IN PTR      ns1.example.com.

but using dig command, I get empty answers:

$ dig -x a.b.c.d

; <<>> DiG 9.9.5-9+deb8u11-Debian <<>> -x a.b.c.d
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 57861
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;d.c.b.a.in-addr.arpa.  IN  PTR

;; Query time: 3 msec
;; SERVER: 192.168.43.1#53(192.168.43.1)
;; WHEN: Thu Jun 15 18:20:48 +0430 2017
;; MSG SIZE  rcvd: 45

When I try to query directly from my server I get following results:

$ dig @a.b.c.d -x a.b.c.d

; <<>> DiG 9.9.5-9+deb8u11-Debian <<>> @a.b.c.d -x a.b.c.d
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45281
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;d.c.b.a.in-addr.arpa.  IN  PTR

;; ANSWER SECTION:
d.c.b.a.in-addr.arpa. 3600 IN   PTR ns1.example.com.

;; AUTHORITY SECTION:
c.b.a.in-addr.arpa. 3600    IN  NS  ns1.example.com.

;; ADDITIONAL SECTION:
ns1.example.com.    3600    IN  A   a.b.c.d

;; Query time: 42 msec
;; SERVER: a.b.c.d#53(a.b.c.d)
;; WHEN: Thu Jun 15 18:33:20 +0430 2017
;; MSG SIZE  rcvd: 116

What am I missing in zone file?

  • @RuiFRibeiro I updated the question, rev.example.com.db is located in /var/named/ and I mentioned it as zone file in my question. – Brian SP2 Jun 15 '17 at 14:01
  • If you are asking about reverse problems I would advise adding the reverse zone to the question. Where are you doing dig, inside or outside your network? – Rui F Ribeiro Jun 15 '17 at 18:17
  • @RuiFRibeiro I dig from outside of network, on my Debian, and DNS server is a VPS out side of my country. I already mentioned my reverse zone file in the question, second field. – Brian SP2 Jun 15 '17 at 18:33
4

Your reverse seems to be well setup in your BIND/side.

However, your problem about solving "your own" DNS reverse names is a very common doubt for small installation/customers/VPS customers (that I have seen countless times).

If you do not own the reverse address space, or even if you own it, but have not request at country level to activate it by their own mechanisms, the root DNS server won't know to which name servers they have to talk ultimately, in an hierarchical process much similar to when you resolve your domain name.

So ultimately the symptom of this is that locally when inside your local network/VPSs you can solve the reverse zone, outside you cannot with your reverse domain as you wished.

I managed an ISP for years, and while small customers had their own domain(s)/DNS servers, for the reverse zones they had to ask us to register their names, as we were the owner of those netblocks.

We obviously, complied, it their tier had a fixed/static IP address, or the possibility of buying one. Otherwise, we would advise them to upgrade to an upper tier, and if they wished, buying our DNS services. (actually the lower tiers with dynamic customer range had the SMTP port blocked to the world due to endemic malware/zombie abuse).

From the IP address you gave me, I can see it belongs to "Kabardian-Balkar Telecommunications Company", which is a similar story, and which is confirmed by the reverse that is defined by them as "net-x-x-x-x.kbrnet.ru."

As for running an email server with such setup, it would be necessary to ask to register the reverse with the correct name. When the name and reverse does not match, you will suffer in spam points, or with some more zealous sysadmins, your email can be refused in some email servers.

In what touches DNS, that is the answer of the question.

As an additional caution warning:

Beware when using VPSes whether your terms of service allow email servers, and whether or not the SMTP port is blocked by default, or if you have to ask them to unblock it.

It is also possible due to your provider being located in the Russian federation, that you have a somewhat bigger probability of their netblock being blacklisted.

I would look for hosted domain services as a whole package, nowadays is too much a hassle to run your own email server.

I actually have bad news; I ran your IP address in a known service for checking spam blacklists, and your IP address is on the BARRACUDA, Rats Dyna and Spamhaus ZEN blacklists. This issue will have to be dealt with with the heldesk of your provider.

  • short and clear, thanks. due to restrictions made in my country, Iran, I can't contant companies like Kabardian-Balkar Telec, anyway, one more question to make sure I'm on the right track, do I need reverse zones to have my email service working? – Brian SP2 Jun 15 '17 at 18:52
  • @BrianSP2 I added a few more comments that I hope will set you in the right track. – Rui F Ribeiro Jun 15 '17 at 18:58
  • 1
    ran outta luck! it's probably because of mail service testing a while ago. anyway thank you for your great explanations, helped a lot. I'll contact my service provider and ask them for more technical solutions. – Brian SP2 Jun 15 '17 at 19:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.