On 3/30/17 6:02 AM, Mark Elkins wrote: > Stopping right here, Recursive lookup and Authoritative services are > completely different services - and require different servers > (preferably, though you could run multiple incidents of nameservers on a > single server - but that can get ugly).
Actually, no. Running both recursive and authoritative does not require different servers and does not require running multiple instances of bind. It's not recommended, but it's not hard, and it has worked for lots of people for lots of years. > Your two recursive servers should remain as recursive servers, only > giving replies to your customer base. When you start running DNSSEC, > this becomes even more important, a recursive server running as an > authoritative server for a zone can not give a proper DNSSEC reply when > asked about Zones carried in its config. Actually, the only thing it doesn't do is the validation. It gives responses just fine as long as you aren't validating your own data. Trusting the "AD" bit is a great concept, but you really want to validate as close to the end-point as possible. > Rather keep things simple. > > I would presume that you have multiple authoritative servers for your > "vtt.net" domain. If you need more redundancy, add in more authoritative > nameservers or better still an AnyCast instance. Even any of your local > Authoritative Nameservers should ask your recursive servers when they > need to look up information that is not part of the Zones they manage. > Enough of the preaching. Interesting to go from "keep things simple" to "let's use anycast" in three sentences. Too many people are trying to solve problems that don't exist with additional complexity that cause additional issues elsewhere in the network stack. If your nameserver has issues with basic responses, good luck debugging that while also dealing with routing problems in your network and wondering which server you should actually be looking at. Sorry to sound like an old grouch, but I'm really feeling like and old grouch these days. > If you were to run IPv6, a number of errors would disappear, otherwise > force BIND not to do any IPv6. Adding IPv6 though would be preferable. ;-) Keep things simple... When your nameserver isn't responding, don't think about running IPv6, fix the problem at hand. And "if you run IPv6, a number of errors disappear". I'm just shaking my head. > Don't think though that any of this is causing your problem. You could > always upgrade your version of BIND. On my Gentoo Laptop, I'm running > BIND 9.11.0-P3, so you are a bit behind. And there is the useful nugget. Yes, OP, see if your problems continue once you upgrade. AlanC
signature.asc
Description: OpenPGP digital signature
_______________________________________________ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users
