I am trying to replicate a working configuration on an older host
that has a caching server that forwards to an Active Directory DNS
server at 172.18.0.2 that is part of a split-brain setup with a public
copy of its zone hosted with Goggle.
When I attempt to resolve a record on the new caching server, it works
fine only if the record is not part of the zone hosted by the Active
Directory
server. For example, `dig lists.isc.org` works fine.
When I attempt to resolve a record in the zone hosted on the forwarder, it
fails with SERVFAIL and I get the following errors in the logs:
named[1158]: chase DS servers resolving 'example.com/DS/IN': 172.18.0.2#53
named[1158]: no valid DS resolving 'name.example.com/A/IN': 172.18.0.2#53
The configuration I am using is shown below, any ideas as to what I am
overlooking?
options {
listen-on port 53 { 127.0.0.1; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
secroots-file "/var/named/data/named.secroots";
recursing-file "/var/named/data/named.recursing";
allow-query { localhost; };
recursion yes;
forward only;
forwarders {
172.18.0.2;
};
dnssec-enable yes;
dnssec-validation yes;
managed-keys-directory "/var/named/dynamic";
pid-file "/run/named/named.pid";
session-keyfile "/run/named/session.key";
include "/etc/crypto-policies/back-ends/bind.config";
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
--
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from
this list
ISC funds the development of this software with paid support subscriptions.
Contact us at https://www.isc.org/contact/ for more information.
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
