1

I'm trying to re-lean how to set up a bind named server after many years. I set up a simulated local LAN and ISP using GNS3. I have an internal and external view for DNS. no errors in zone configuration as verified named-checkzone plus no errors in logs

I can't resolve any domain name outside the local zone. on a test box in local zone I tried:

$ dig +trace ns1.comp2.org

; <<>> DiG 9.10.3-P4-Debian <<>> +trace ns1.comp2.org
;; global options: +cmd
.                       3600000 IN      NS      ns1.isp1.org.
.                       3600000 IN      NS      ns1.isp2.org.
couldn't get address for 'ns1.isp1.org': failure
couldn't get address for 'ns1.isp2.org': failure
dig: couldn't get address for 'ns1.isp1.org': no more

root hints file (copied the format of the original file, I don't quite know how this is supposed to be formatted):

. 3600000 IN NS ns1.isp1.org.
ns1.isp1.org. 3600000 A 1.0.0.14
. 3600000 IN NS ns1.isp2.org.
ns1.isp2.org. 3600000 A 2.0.0.14

since this is debian named.conf is split into various files.

named.conf:

//... (logging)

include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
//include "/etc/bind/named.conf.default-zones";

and named.conf.default-zones:

zone "." {
        type hint;
        file "/var/bind/db.root";
};
...

named.conf.options:

options {
        directory "/var/cache/bind";
        ...
        dnssec-validation auto;

        auth-nxdomain no;    # conform to RFC1035
        listen-on-v6 { any; };
};

named.conf.local:

view "internal" {
    match-clients { 192.168.1.0/24; };
    include "/etc/bind/named.conf.default-zones";
    recursion yes;
    zone "comp1-internal" {
        type master;
        file "/var/bind/db.comp1-internal";
        allow-update { none; };
    };
    zone "1.168.192.in-addr.arpa" {
        type master;
        file "/var/bind/db.1.168.192";
        allow-update { none; };
    };
};
view "external" {
    match-clients { "any"; };
    include "/etc/bind/named.conf.default-zones";
    recursion yes;
    zone "comp1.org" {
        type master;
        file "/var/bind/db.comp1.org";
    };
    zone "16-31.0.0.1.in-addr.arpa" {
        type master;
        file "/var/bind/db.16-31.0.0.1";
        allow-update { none; };
    };
    zone "16-31.0.0.2.in-addr.arpa" {
        type slave;
        file "/var/bind/db.16-31.0.0.2";
        masters { 2.0.0.17; };
    };
};

I assume this is correct since the fact dig +trace shows returns some data from the root hints file means it appears to attempt a recursive search, but then gives up without reading the A record right in the roots file. I'm still looking through the log file for clues. I'm not currently using DNSSEC. could this be the issue?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.