Mistake #1: looking up something using a shortname. Apparently
"rac2.local" is not in your stub resolver's local search list. Always
use fully-qualified domain names (FQDNs) for client lookups, and educate
your users to do so also. Using FQDNs is the most efficient, least
ambiguous, and easiest-to-troubleshoot form of resource lookup from DNS.
Mistake #2: trying to troubleshoot DNS using nslookup. With its default
output format, nslookup is hiding all of its disgusting suffixing
behavior from your eyes, thus leaving you in the dark as to what the
problem is. Consider using a real DNS troubleshooting tool like "dig",
which doesn't do suffixing garbage (it looks up exactly what you ask it
to look up, nothing more, nothing less), and with its default output
format, shows you the full DNS response from the nameserver
Mistake #3: the "connection timed out" error from nslookup implies that
one of the names it tried to look up (either "rac2-scan" appended with
some arbitrary suffix from your searchlist, or "rac2-scan" as a *root*
name), ended up in a part of the namespace that your DNS infrastructure
can't resolve at all. Most likely you have no direct connectivity to the
Internet, yet you have neglected to set up your own internal root zone.
So, your DNS infrastructure tries to go out and talk to the Internet
root nameservers, and beats its head bloody on your firewalls and/or
your routers and/or whatever, futilely trying to get response. Hence the
timeout. I'm surprised your firewall guys haven't complained to you yet
about all of the log noise you've been generating.
Mistake #4: from the logs below, it appears that you have no A or AAAA
records associated with the targets of certain NS records -- with a
first label of "apple" -- in each of several zones. Either change the
targets of those NS records to a fully-qualified name (instead of just
"apple"), or supply the A/AAAA records of apple.<zone> in each of those
zone files so that they are internally complete. This appears to be
another symptom of shortname-itis. Please learn the contexts in which
shortnames work, and the contexts in which they do not, or where extra
work is required to make them work. The safest thing is to always use
FQDNs, as suggested above.
- Kevin
On 4/1/2011 9:09 AM, Tony MacDoodle wrote:
I think it's something with one of the zone files, here is what I get....
nslookup rac-scan
Server: xxx.xxx.xxx.xxx
Address: xxx.xxx.xxx.xxx#53
Name: rac-scan.rac.local
Address: xxx.xxx.xxx.xxx
Name: rac-scan.rac.local
Address: xxx.xxx.xxx.xxx
Name: rac-scan.rac.local
Address: xxx.xxx.xxx.xxx
root:jabba:~# nslookup rac2-scan
;; connection timed out; no servers could be reached
/var/adm/messages
Apr 1 09:05:16 apple named[1695]: [ID 873579 daemon.info
<http://daemon.info>] shutting down
Apr 1 09:05:16 apple named[1695]: [ID 873579 daemon.notice] stopping
command channel on 127.0.0.1#953
Apr 1 09:05:16 apple named[1695]: [ID 873579 daemon.info
<http://daemon.info>] no longer listening on 127.0.0.1#53
Apr 1 09:05:16 apple named[1695]: [ID 873579 daemon.info
<http://daemon.info>] no longer listening on xxx.xxx.xxx.24#53
Apr 1 09:05:16 apple named[1695]: [ID 873579 daemon.notice] exiting
Apr 1 09:05:16 apple named[1715]: [ID 873579 daemon.notice] starting
BIND 9.6.1-P3 -4
Apr 1 09:05:16 apple named[1715]: [ID 873579 daemon.notice] built
with --prefix=/usr --with-libtool --bindir=/usr/sbin
--sbindir=/usr/sbin --libdir=/usr/lib/dns --sysconfdir=/etc
--localstatedir=/var --with-openssl=/usr/sfw --enable-threads=yes
--enable-devpoll=yes --enable-fixed-rrset
--disable-openssl-version-check -DNS_RUN_PID_DIR=0
Apr 1 09:05:16 apple named[1715]: [ID 873579 daemon.info
<http://daemon.info>] found 8 CPUs, using 8 worker threads
Apr 1 09:05:16 apple named[1715]: [ID 873579 daemon.info
<http://daemon.info>] using up to 4096 sockets
Apr 1 09:05:16 apple named[1715]: [ID 873579 daemon.info
<http://daemon.info>] loading configuration from '/etc/named.conf'
Apr 1 09:05:16 apple named[1715]: [ID 873579 daemon.info
<http://daemon.info>] using default UDP/IPv4 port range: [1024, 65535]
Apr 1 09:05:16 apple named[1715]: [ID 873579 daemon.info
<http://daemon.info>] using default UDP/IPv6 port range: [1024, 65535]
Apr 1 09:05:17 apple named[1715]: [ID 873579 daemon.info
<http://daemon.info>] no IPv6 interfaces found
Apr 1 09:05:17 apple named[1715]: [ID 873579 daemon.info
<http://daemon.info>] listening on IPv4 interface lo0, 127.0.0.1#53
Apr 1 09:05:17 apple named[1715]: [ID 873579 daemon.info
<http://daemon.info>] listening on IPv4 interface vnet0:1,
xxx.xxx.xxx.24#53
Apr 1 09:05:17 apple named[1715]: [ID 873579 daemon.info
<http://daemon.info>] automatic empty zone: 0.IN-ADDR.ARPA
Apr 1 09:05:17 apple named[1715]: [ID 873579 daemon.info
<http://daemon.info>] automatic empty zone: 127.IN-ADDR.ARPA
Apr 1 09:05:17 apple named[1715]: [ID 873579 daemon.info
<http://daemon.info>] automatic empty zone: 254.169.IN-ADDR.ARPA
Apr 1 09:05:17 apple named[1715]: [ID 873579 daemon.info
<http://daemon.info>] automatic empty zone: 2.0.192.IN-ADDR.ARPA
Apr 1 09:05:17 apple named[1715]: [ID 873579 daemon.info
<http://daemon.info>] automatic empty zone: 255.255.255.255.IN-ADDR.ARPA
Apr 1 09:05:17 apple named[1715]: [ID 873579 daemon.info
<http://daemon.info>] automatic empty zone:
0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA
Apr 1 09:05:17 apple named[1715]: [ID 873579 daemon.info
<http://daemon.info>] automatic empty zone:
1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA
Apr 1 09:05:17 apple named[1715]: [ID 873579 daemon.info
<http://daemon.info>] automatic empty zone: D.F.IP6.ARPA
Apr 1 09:05:17 apple named[1715]: [ID 873579 daemon.info
<http://daemon.info>] automatic empty zone: 8.E.F.IP6.ARPA
Apr 1 09:05:17 apple named[1715]: [ID 873579 daemon.info
<http://daemon.info>] automatic empty zone: 9.E.F.IP6.ARPA
Apr 1 09:05:17 apple named[1715]: [ID 873579 daemon.info
<http://daemon.info>] automatic empty zone: A.E.F.IP6.ARPA
Apr 1 09:05:17 apple named[1715]: [ID 873579 daemon.info
<http://daemon.info>] automatic empty zone: B.E.F.IP6.ARPA
Apr 1 09:05:17 apple named[1715]: [ID 873579 daemon.notice] command
channel listening on 127.0.0.1#953
Apr 1 09:05:17 apple named[1715]: [ID 873579 daemon.error] zone
xxx.10.10.in-addr.arpa/IN: NS 'apple.xxx.10.10.in-addr.arpa' has no
address records (A or AAAA)
Apr 1 09:05:17 apple named[1715]: [ID 873579 daemon.info
<http://daemon.info>] zone xxx.10.10.in-addr.arpa/IN: loaded serial 1
Apr 1 09:05:17 apple named[1715]: [ID 873579 daemon.error] zone
xxx.10.10.in-addr.arpa/IN: NS 'apple.xxx.10.10.in-addr.arpa' has no
address records (A or AAAA)
Apr 1 09:05:17 apple named[1715]: [ID 873579 daemon.info
<http://daemon.info>] zone xxx.10.10.in-addr.arpa/IN: loaded serial 1
Apr 1 09:05:17 apple named[1715]: [ID 873579 daemon.error] zone
0.0.127.in-addr.arpa/IN: NS 'apple.0.0.127.in-addr.arpa' has no
address records (A or AAAA)
Apr 1 09:05:17 apple named[1715]: [ID 873579 daemon.info
<http://daemon.info>] zone 0.0.127.in-addr.arpa/IN: loaded serial 1
Apr 1 09:05:17 apple named[1715]: [ID 873579 daemon.error] zone
rac.local/IN: NS 'apple.rac.local' has no address records (A or AAAA)
Apr 1 09:05:17 apple named[1715]: [ID 873579 daemon.info
<http://daemon.info>] zone rac.local/IN: loaded serial 2
Apr 1 09:05:17 apple named[1715]: [ID 873579 daemon.error] zone
rac2.local/IN: NS 'apple.rac2.local' has no address records (A or AAAA)
Apr 1 09:05:17 apple named[1715]: [ID 873579 daemon.info
<http://daemon.info>] zone rac2.local/IN: loaded serial 3
Apr 1 09:05:17 apple named[1715]: [ID 873579 daemon.notice] running
Thanks
On Fri, Apr 1, 2011 at 2:10 AM, Torinthiel <torinth...@data.pl
<mailto:torinth...@data.pl>> wrote:
On 04/01/11 03:47, Tony MacDoodle wrote:
> Hello,
>
> I am trying to configure 2 different domains on one host that
only has
> one physical interface plummed.
>
> I think I have an errorthat I list the hostname of the interface
in both
> zone files as below and this might be why I can't resolve
properly. Do
> you see any mistakes in the files below?
> The only active interface is 192.168.5.5
and you can't resolve properly from where? From localhost? That's
probably because you've configured BIND to only listen on external
address, not the local one. In this config (listen-on {
192.168.5.5; };)
it won't accept local queries, as these come to 127.0.0.1.
But from other box command
dig rac-scan.rac.local @192.168.5.5 <http://192.168.5.5> should work.
Are there any relevant messages in logs? What are the error
messages/results when you try to resolve? How you test if
resolution works?
Having bind run multiple zones is absolutely normal, and there are no
reasons to require more than one IP address with that.
Torinthiel
>
> root:/var/named# cat named.conf
> options {
> listen-on-v6 { none; };
> listen-on { 192.168.5.5; };
> directory "/var/named";
> };
> zone "0.0.127.in-addr.arpa" {
> type master;
> file "db.127.0.0";
> };
> zone "rac.local" {
> type master;
> file "db.rac";
> };
> zone "rac2.local" {
> type master;
> file "db.rac2";
> };
> zone "10.168.192.in-addr.arpa" {
> type master;
> file "db.192.168.10";
> };
> zone "20.168.192.in-addr.arpa" {
> type master;
> file "db.192.168.20";
> };
>
> root:jedi:/var/named# cat db.rac
> $TTL 86400
> @ SOA jedi root ( 2 10800 3600 604800 600 )
> NS jedi
> localhost A 127.0.0.1
> rac-scan A xxx.xxx.xxx.xxx
> A xxx.xxx.xxx.xxx
> A xxx.xxx.xxx.xxx
> MX 10 rac-scan
>
> root:jedi:/var/named# cat db.rac2
> $TTL 86400
> @ SOA jedi root ( 3 10800 3600 604800 600 )
> NS jedi
> localhost A 127.0.0.1
> rac2-scan A xxx.xxx.xxx.xxx
> A xxx.xxx.xxx.xxx
> A xxx.xxx.xxx.xxx
> MX 10 rac2-scan
_______________________________________________
bind-users mailing list
bind-users@lists.isc.org <mailto:bind-users@lists.isc.org>
https://lists.isc.org/mailman/listinfo/bind-users
_______________________________________________
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
_______________________________________________
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
