Hot answers tagged

12

Short answer: A workaround is forcing glibc to reuse a socket for look up of the AAAA and A records, by adding a line to /etc/resolv.conf: options single-request-reopen The real cause of this issue might be: malconfigured firewall or a router (e.g. a Juniper firewall configuration described here) which causes dropping AAAA DNS packets bug in DNS server ...


10

NS Records in the zone file specify which hosts are authoritive for the domain. One of the NS records will point back to the server you are querying once recursion has provided the NS records to get you to the authoritive Name Servers. NS records are pointer records for more information about a zone (non-authoritive NS records). When you query an ...


10

So, changing my wired eth0 interface to be managed solved this issue for me. Changing ifupdown to managed=true in /etc/NetworkManager/NetworkManager.conf [ifupdown] managed=true Then restart NetworkManager sudo systemctl restart NetworkManager After this it works flawlessly.. This was not 100%. I also applied theses changes to try and kill resolver ...


9

It is not working because you have commented out the allow-query and goodclients directives. You should uncomment them and populate goodclients with the IPs/networks BIND is supposed to answer queries. acl goodclients { localhost; x.x.x.0/24; }; options { ... allow-query { goodclients; }; } From http://www.zytrax.com/books/dns/ch7/queries....


8

I have found the answer: my problem was that BIND can't rndc reload zone with the dynamic zones so BIND won’t allow us to reload a dynamic zone. So we have to tell bind to temporarily stop allowing dynamic updates. This is handled with the freeze option. rndc freeze example.com then reloading rndc reload example.com then allowing dynamic updates ...


8

You can do however you please, the only thing you must make sure is that the new serial number is greater than the old one. Having said that, I would recommend a timestamp based approach following a scheme like: YYYYMMDDxx where xx starts at 00 and is incremented for all edits on that specific day (when editing on another day, you reset xx to 00) The ...


8

My guess is that your systemd-resolved service is configured correctly, but it never gets to see the request. The .local domain is treated specially by systems running mDNS. avahi-daemon, which provides mDNS/DNS-SD services (aka "Bonjour" on Apple products) can be configured to take precedence over DNS during name resolution; it appears that Ubuntu does this....


7

It’s actually an alternative repository for trusted keys, where one can submit their zone keys, if there is no fully signed path from root zone down to your own zone. The functional DLV registry is dlv.isc.org. By default the root zone key and the dlv.isc.org key are included in /etc/named.iscdlv.key and that goes as a value to bindkeys-file attribute in ...


7

A bind mount is equivalent to the original. There isn't one that's marked as the original and one that's marked as a copy. Bind mounts are like hard links in this respect, not like symbolic links. Since GNU coreutils 8.21 (if I read the changelog correctly), df strives to report each filesystem only once. Older versions included one entry per non-ignored ...


7

I have seen your zone file: it appears to be a list of more than 350k domains, at the moment, where it is defined the local BIND server as the master. The domains are with the following format: zone "xxxx.com" { type master; notify no; file "null.zone.file"; }; As per memory requirements, I would say as a ballpark figure you might need around 40MB-80MB of ...


7

BIND configuration indeed does, when the forwarders are defined, send all the requests that were not satisfied by the local BIND to the forwarders. More so, that when forward only; is used the local zones are ignored, and all requests are satisfied only from cache or by the forwarders. If you need to have local zones (i.e. private IP addresses from RFC ...


7

I guess localhost refer to one IP address which is by default 127.0.0.1, but, localnet refer to every network that you have an IP address from it on interface on your machine. For example, if you have two interfaces and every one have its IP from different network so localnets can match all networks. eth0 ip 10.0.0.1 netmask 255.0.0.0 eth1 ip 192.168.0....


6

This looks to be a bug. See this ticket titled: Bug 984764 - bind-chroot-9.9.3-3.P1.fc19.x86_64 failed to start. The fix is to add this to your named.conf file: pid-file "/var/run/named/named.pid"; There are additional tips in the ticket with respect to getting your system back into a state where you can successfully run Bind afterwards.


6

I test with a command like: host 2001:41d0:2:d447:0:0:0:ddc0 localhost This looks good, but your default acl may prevent access. Try adding allow-query { any; }; to the zone definition. You may also want to enable zone transfers If you enable zone transfers you can test with a command like: host -t axfr 2.2.b.0.1.1.f.1.0.7.4.0.1.0.0.2.ip6.arpa ...


6

By default, dnsec-keygen uses /dev/random - the generation is slow, so much more in less busy systems. One of the alternatives is trying to make the system more busy running more processes in the background. It will be still a bit slow, but less slow. Virtual machines are usually less impacted in entropy when using more I/O. Other alternative is using /dev/...


6

To minimize DNS leaks, it is indeed possible to resolve DNS via Tor. For that, add to your /etc/tor/torrc the line: DNSPort 9053 And restart the tor service with: service tor restart To test it out, do: $nslookup set port=9053 server 127.0.0.1 www.cnn.com If using resolvconf/dnsmasq, change your /etc/dnsmasq.conf: no-resolv server=127.0.0.1#9053 ...


6

You have to use what's called a Split Horizon or Split View DNS. https://en.wikipedia.org/wiki/Split-horizon_DNS Not all servers support this. You might have to use ISC BIND in order to accomplish this, as NSD from NLnet Labs and most other modern rewrites don't advertise support for this. From the practical perspective, I'd recommend looking into ...


5

One method would be to make use of this directive in the squid.conf file to get the log file to show FQDNs instead of the IPs: log_fqdn on Source: http://www.squid-cache.org/Doc/config/log_fqdn/ But this will omit the <IP> <Name> format that you're showing in your question. For that if you look at the documentation for the logformat directive ...


5

Does dig +search dns01 give you what you want? If so, it it possible that +nosearch somehow got added to your ~/.digrc ? ETA: Or, if you're like me, maybe the dig fairies failed to come and add +search to your ~/.digrc.


5

Bind is needed if you have multiple computers and you want your computer to act as a name server (DNS server) for other computers, i.e. those computers contact yours to translate host names (what users type and applications type) into IP addresses (how computers actually designate each other under the hood). Even if you do have multiple computers, Bind is ...


5

As @Tombart says, the delay is due to waiting for the IPv6 resolution timeout. Another possible course of action is giving precedence to IPv4 in /etc/gai.conf From comments in /etc/gai.conf # For sites which prefer IPv4 connections change the last line to # precedence ::ffff:0:0/96 100 After changing gai.conf, you need to restart any app using the DNS ...


5

He is completely and utterly wrong. The serial number is part of the zone; it is no more unique between separate zones than any other record. RFC 1035, section 5, states this clearly: SERIAL The unsigned 32 bit version number of the original copy of the zone. Zone transfers preserve this value. This value wraps ...


5

There are no provisions in BIND to log answers for queries at all with the logging directive. Furthermore, aside privacy considerations, it can be more efficient for the DNS service to log them remotely instead of in a file. Often people are running dnscap to capture/sniff DNS queries for security analysis. dnscap is a network capture utility designed ...


5

This is a known (and fixed in later versions) bug in bind9: https://gitlab.isc.org/isc-projects/bind9/issues/752 Note that bind9 9.11 continues to be supported as the long-term support branch, the fix is in 9.13 and later. A workaround appears to be to run dig +trace on any domain frequently enough (every 8–12 hours) that the cache doesn't expire.


5

You have created the zone '0.142.10.in-addr.arpa', so you have to check that one: named-checkzone 0.142.10.in-addr.arpa /var/named/zones/0.142.10.in-addr.arpa.db


4

DISCLAIMER: use this script on your own risk What it does ? As O/P wants, lat say he want to add somedomain.bar44.com and the somedomain44.bar44.com exists in zone then it should remove somedomain44.bar44.com and should be add somedomain.bar44.com into zone. this process will done using this script. Tested on Ubuntu bind9. in short it will add xyz.bar....


4

I have solved it: dnssec-keygen -a HMAC-MD5 -b 128 -n HOST example.com. editing conf. file: // TSIG Key key "example.com." { algorithm hmac-md5; secret "THE KEY GENERATED ABOVE"; }; zone "example.com" IN { type master; file "example.com.zone"; allow-update{ key "example.com."; }; }; This is the step that you have to add give the named ...


4

Before named reads it's configuration file, it drops all but the necessary capabilities. The capability that allows root to bypass all file permission checks is CAP_FOWNER - see capabilities(7) if you're curious. If you check the bind source code, in bin/named/unix/os.c you'll find the functions linux_initialprivs() linux_minprivs() and others responsible ...


4

Perl to the rescue: perl -pe 's/(20[0-9]{3,})/$1+1/e' file


4

Found it. The solution is to add: allow-query { any; }; EDIT: The solution of Rui F Ribeiro works, but I need to create a public server. If you would like to avoid the security issues, please see the comments.


Only top voted, non community-wiki answers of a minimum length are eligible