1

I setup DNS which will act as external DNS server. All settings are default , administrator told me to use Root hints file which is located under /var/named/named.ca. And root zone is mentioned in /etc/named.conf file

options {
        listen-on port 53 { 127.0.0.1; 192.168.161.1; };
        #listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        recursing-file  "/var/named/data/named.recursing";
        secroots-file   "/var/named/data/named.secroots";
        allow-query     { any; };
        filter-aaaa-on-v4 yes;
        #OPTIONS = "-4"
        /*
         - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
         - If you are building a RECURSIVE (caching) DNS server, you need to enable
           recursion.
         - If your recursive DNS server has a public IP address, you MUST enable access
           control to limit queries to your legitimate users. Failing to do so will
           cause your server to become part of large scale DNS amplification
           attacks. Implementing BCP38 within your network would greatly
           reduce such attack surface
        */
        recursion yes;

        dnssec-enable yes;
        dnssec-validation yes;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.iscdlv.key";

        managed-keys-directory "/var/named/dynamic";

        pid-file "/run/named/named.pid";
        session-keyfile "/run/named/session.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
        type hint;
        file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

I restart named service but when i do ping to any domain system is not able to resolve it

After removing Google DNS

when i add "127.0.0.1" and "192.168.161.1" and restart network service. and do dig google.com @localhost. It gives this reply

dig google.com @localhost

; <<>> DiG 9.9.4-RedHat-9.9.4-72.el7 <<>> google.com @localhost
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 24654
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;google.com.                    IN      A

;; Query time: 4001 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sun Mar 22 16:46:48 +03 2020
;; MSG SIZE  rcvd: 39
  • SERVFAIL means your local nameserver had a problem big enough that it should have logged locally some details, so you need to have a look at its logfiles... – Patrick Mevzek Mar 24 at 0:32
  • In your configuration, do not use DLV, this is a deprecated mechanism. – Patrick Mevzek Mar 24 at 0:32
  • "I setup DNS which will act as external DNS server." So does that mean it is an authoritative nameserver for some zones? If so, it should not be a recursive nameserver. And if it is a recursive one, it shouldn't be public without a lot of precautions. – Patrick Mevzek Mar 24 at 0:34
1

First off, ping isn't the best way to diagnose dns issues; you want dig:

shadur@vigil:~$ dig google.com @localhost

; <<>> DiG 9.10.3-P4-Debian <<>> google.com @localhost
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 55786
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;google.com.                    IN      A

;; ANSWER SECTION:
google.com.             22      IN      A       216.58.211.110

;; Query time: 90 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sun Mar 22 14:02:39 CET 2020
;; MSG SIZE  rcvd: 55

This yields a lot more information that - even if it isn't yet helpful to you - is much more likely to be informative to people trying to help you figure out what's going wrong.

Second off, judging by the configuration snippet you put up there and the description of what you're trying to do, your problem is the line that goes

recursion no;

Because that tells BIND9 that it should only answer queries for domains that are in its own internal known list ( what the comments just above it call an AUTHORITATIVE server), and what you describe trying to do with your ping attempts is to us it as a RECURSING server.

(It's generally not recommended to run both on the same machine, or if you do to be very careful about who you let recurse; open recursors are bad news for your network).

Also, if all of the above is too technical to understand, I highly recommend installing pdns-recursor from PowerDNS project instead.

| improve this answer | |
  • yes, i was testing now i set the recursion to yes, when i add 8.8.8.8 in resolv.conf everything starts working, But administrator is saying it should not use 8.8.8.8 – OmiPenguin Mar 22 at 13:24
  • resolv.conf is what your system consults to decide what DNS server to use. When you add 8.8.8.8 to that it means you're using google's open DNS server rather than your own. This is why I said to use dig rather than ping to diagnose DNS server issues. – Shadur Mar 22 at 13:25
  • Ok i will replace 8.8.8.8 with the dns server's ip in resolv.conf which in this case is localhost where bind is configured – OmiPenguin Mar 22 at 13:31
  • When you do, run the dig command like I demonstrated, and add the output to the question. – Shadur Mar 22 at 13:32
  • i removed "8.8.8.8" and added "nameserver 127.0.0.1 and nameserver 192.168.161.1" but it didnt resolve it, i added output at end of question – OmiPenguin Mar 22 at 13:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.