DNS error, from a newbee to the real experts..

Weeltin weeltinl at gmail.com
Mon Jul 20 15:47:05 UTC 2020


Hi Josh,

Thanks for your answer, it made me go trough all the config again, just to
make sure that it wasnt pointing to the authoritative server anywhere but
in the configuration of the recursive server

I saw that "“recursion requested but not available" when i send the query
against the authoritative. Kind a expected that, since it aint allowed to
do recursion.

as requested i made the dig on the the authoritative server i get the
correct answer, so i expect it has loaded the zonefiles correctly.

ns2:/home/weeltin# dig @127.0.0.01 example.home

; <<>> DiG 9.14.12 <<>> @127.0.0.01 example.home
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45487
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: b9129ece5d9fbc3e6f01a2215f15a461388d4af048be37fa (good)
;; QUESTION SECTION:
;example.home. IN A

;; AUTHORITY SECTION:
example.home. 604800 IN SOA ns2.example.home. hostmaster.example.home. 2
604800 86400 2419200 604800

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Jul 20 14:04:17 UTC 2020
;; MSG SIZE  rcvd: 120


just to be sure, i rand the dig command again on my client

[weeltin at c1 ~]$ dig c1.example.home

; <<>> DiG 9.11.11-RedHat-9.11.11-1.fc31 <<>> c1.example.home
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 1787
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 862cc48a975a32a324cd14e65f15ba5e3f2c972d1f753586 (good)
;; QUESTION SECTION:
;c1.example.home. IN A

;; AUTHORITY SECTION:
. 10800 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2020072000 1800
900 604800 86400

;; Query time: 1043 msec
;; SERVER: 192.168.14.10#53(192.168.14.10)
;; WHEN: Mon Jul 20 11:38:06 EDT 2020
;; MSG SIZE  rcvd: 147


Log output from NS1 (recursive)
<truncate>
Jul 20 15:38:05 ns1 daemon.info named[4022]:   validating example.home/SOA:
got insecure response; parent indicates it should be secure
Jul 20 15:38:05 ns1 daemon.info named[4022]: no valid RRSIG resolving
'c1.example.home/DS/IN': 192.168.14.20#53
Jul 20 15:38:06 ns1 daemon.info named[4022]: insecurity proof failed
resolving 'c1.example.home/A/IN': 192.168.14.20#53
</truncate>

and there is no log entries on the authoritative server

/Weeltin

On Sun, Jul 19, 2020 at 6:05 AM Josh Kuo <josh.kuo at gmail.com> wrote:

> When querying your internal domain, I see the query actually ends with
> “recursion requested but not available”, it looks like you are querying
> directly against your auth server, so I would check the setting to ensure
> the zone file is actually loaded correctly.
>
> What Mark answered is assuming you are querying the recursive which then
> returned SERVFAIL due to DNSSEC validation, but I do not see that in the
> information you provided.
>
> Can you run dig on the auth server itself, dig @ 127.0.0.1 for
> example.home, and see what it returns?
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20200720/16e76b75/attachment.htm>


More information about the bind-users mailing list