In message <d4cab5be198fc64c3c372271709f4...@prod.iotk.net>, vr writes:
> Hello,
>
> I am trying to visit "http://communities.intel.com"; using Iceweasel on
> a Debian desktop PC. No proxies.
>
> My clients etc/resolv.conf point to my own Debian BIND 9.7.3 installed
> on a separate server and installed from distribution packages (bind9
> 1:9.7.3.dfsg-1~squeeze2).
>
> From myDesktop, NSLOOKUP fails but DIG shows a CNAME record. I see the
> same results from the BIND server so I've included just the output from
> myDesktop below. Also included below is my named.conf.
The answers are consistent. Nslookup searches and doesn't stop on
NODATA and it doesn't cope with a CNAME + referral response which
it interprets as a NODATA response.
> Do I have something obvious in BIND screwed up? Or is my client/browser
> broken? Or...?
Your allow-recursion acl is not broad enough.
> ----------------------------------------------------------
>
> me@myDesktop:~$ nslookup communities.intel.com ns.iotk.net
> Server: ns.iotk.net
> Address: 99.30.25.1#53
>
> ** server can't find communities.intel.com: NXDOMAIN
>
> ----------------------------------------------------------
>
> me@myDesktop:~$ dig communities.intel.com ns.iotk.net
Please learn how to drive dig. You wanted to do:
dig communities.intel.com @ns.iotk.net
> ; <<>> DiG 9.6-ESV-R3 <<>> communities.intel.com ns.iotk.net
> ;; global options: +cmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 7908
> ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0
The resolver is pointing at a nameserver that doesn't offer recursion
to this client (no "ra" in the flags section).
> ;; QUESTION SECTION:
> ;communities.intel.com. IN A
>
> ;; ANSWER SECTION:
> communities.intel.com. 207 IN CNAME intel-2.hs.llnwd.net.
>
> ;; AUTHORITY SECTION:
> llnwd.net. 604800 IN SOA localhost.
> root.localhost. 2008071301 604800 86400 2419200 604800
>
> ;; Query time: 2 msec
> ;; SERVER: 99.30.25.1#53(99.30.25.1)
> ;; WHEN: Mon Jul 4 22:51:42 2011
> ;; MSG SIZE rcvd: 123
>
> named.conf on 99.30.25.1
>
> controls {
> inet 127.0.0.1 port 953
> allow { 127.0.0.1; } keys { "rndc-key"; };
> };
>
> acl "iotk" {
> 127.0.0.1; // localhost
> 99.30.25.0/29; // static range
> !192.168.0.254; // not the router
> 192.168.0.0/24; // internal network
> 10.10.10.0/8; // backup network
> };
>
> options {
> directory "/etc/bind/";
> listen-on { 99.30.25.1; };
> allow-recursion { iotk; }; // ddos
> prevention
> interface-interval 0; // no dynamic
> ifaces
> // allow-query { iotk; }; // this limits
> ALL zones
> allow-transfer { iotk; }; // this limits
> ALL zones
> transfer-format many-answers; // faster
> transfers
> version "DNS Server"; // hides BIND
> version
> statistics-file "/var/log/bind/stats.log";
> auth-nxdomain yes;
> };
--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742 INTERNET: ma...@isc.org
_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe
from this list
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
