<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto">Cross zone CNAMEs cause accidental cache poisoning with some clients when both zones are on the same server. Named no longer follows the CNAME for non-recursive requests to prevent this. More security aware clients will restart the query after processing the CNAME. <br><br><div dir="ltr">-- <div>Mark Andrews</div></div><div dir="ltr"><br><blockquote type="cite">On 31 Oct 2022, at 09:34, Nagesh Thati <tcpnagesh@gmail.com> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr"><div dir="ltr">Hello,<div>I am facing an issue with CNAME and PTR records resolution issues when classless reverse zones are defined in the BIND 9.16.* version (Without recursion), but it used to work in 9.11.* version (Without recursion). Below example shows what reverse zones are created and how the dig output is giving,</div><div><br></div><div><b>named.conf:</b></div><div><i>recursion no;</i></div><div><i><br></i></div><div><i>zone "22.10.13.in-addr.arpa" IN {<br> type master;<br> file "/var/named/zones/masters/db.22.10.13.in-addr.arpa";<br> check-names ignore;<br> zone-statistics yes;<br>};</i></div><div><i>zone "0-25.22.10.13.in-addr.arpa" IN {<br> type master;<br> file "/var/named/zones/masters/db.0-25.22.10.13.in-addr.arpa";<br> check-names ignore;<br> zone-statistics yes;<br>};</i><br></div><div><i><br></i></div><div><div><u><b><i>db.</i><i>22.10.13.in-addr.arpa:</i></b></u></div><div><i>$TTL 1200<br>$ORIGIN 22.10.13.in-addr.arpa.<br>22.10.13.in-addr.arpa. IN SOA <a href="http://remote1.india.com">remote1.india.com</a>. <a href="http://admin.india.com">admin.india.com</a>. (<br> 2022102807 ; serial<br> 21600 ; refresh<br> 3600 ; retry<br> 604800 ; expire<br> 86400 ; minimum<br> )<br> IN NS <a href="http://remote1.india.com">remote1.india.com</a>.<br>0-25.22.10.13.in-addr.arpa. IN NS <a href="http://remote1.india.com">remote1.india.com</a>.<br>2.22.10.13.in-addr.arpa. 1200 IN CNAME 2.0-25.22.10.13.in-addr.arpa.</i><u><i><br></i></u></div><div><br></div></div><div><b><u><i>db.0-25.22.10.13.in-addr.arpa</i></u></b><br></div><div><i>$TTL 1200<br>$ORIGIN 0-25.22.10.13.in-addr.arpa.<br>0-25.22.10.13.in-addr.arpa. IN SOA <a href="http://remote1.india.com">remote1.india.com</a>. <a href="http://admin.india.com">admin.india.com</a>. (<br> 2022102808 ; serial<br> 21600 ; refresh<br> 3600 ; retry<br> 604800 ; expire<br> 86400 ; minimum<br> )<br> IN NS <a href="http://remote1.india.com">remote1.india.com</a>.<br>2.0-25.22.10.13.in-addr.arpa. 1200 IN PTR <a href="http://3G00051Phone.india.com">3G00051Phone.india.com</a>.</i><b><u><i><br></i></u></b></div><div><i><br></i></div><div><i><b><u>DIG Output:</u></b></i></div><div><i>[root@remote1]# dig @localhost -x 13.10.22.2<br><br>; <<>> DiG 9.16.30 <<>> @localhost -x 13.10.22.2<br>; (2 servers found)<br>;; global options: +cmd<br>;; Got answer:<br>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32110<br>;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1<br>;; WARNING: recursion requested but not available<br><br>;; OPT PSEUDOSECTION:<br>; EDNS: version: 0, flags:; udp: 1232<br>; COOKIE: f29427e34cd79c0101000000635fe20b8accc09065ab6b33 (good)<br>;; QUESTION SECTION:<br>;2.22.10.13.in-addr.arpa. IN PTR<br><br>;; ANSWER SECTION:<br><b>2.22.10.13.in-addr.arpa. 1200 IN CNAME 2.0-25.22.10.13.in-addr.arpa.</b><br><br>;; Query time: 1 msec<br>;; SERVER: 127.0.0.1#53(127.0.0.1)<br>;; WHEN: Mon Oct 31 14:56:11 GMT 2022<br>;; MSG SIZE rcvd: 122</i><br></div><div><i><br></i></div><div>I am getting the answer as only CNAME, not getting the exact A record for that IP address. This used to work in BIND 9.11.* version, recently I upgraded to 9.16.* latest version and from that I am facing this issue.</div><div><br></div><div><br></div><div>But when I enable the recursion on BIND 9.16.* then I am getting the expected answer as below,</div><div><i>[root@remote1]# dig @localhost -x 13.10.22.2<br><br>; <<>> DiG 9.16.30 <<>> @localhost -x 13.10.22.2<br>; (2 servers found)<br>;; global options: +cmd<br>;; Got answer:<br>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40386<br>;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1<br><br>;; OPT PSEUDOSECTION:<br>; EDNS: version: 0, flags:; udp: 1232<br>; COOKIE: 8cee7aad934beda401000000635fe32bf7ce38d08006dbd1 (good)<br>;; QUESTION SECTION:<br>;2.22.10.13.in-addr.arpa. IN PTR<br><br>;; ANSWER SECTION:<br>2.22.10.13.in-addr.arpa. 1200 IN CNAME 2.0-25.22.10.13.in-addr.arpa.<br>2.0-25.22.10.13.in-addr.arpa. 1200 IN PTR <a href="http://3G00051Phone.india.com">3G00051Phone.india.com</a>.<br><br>;; Query time: 0 msec<br>;; SERVER: 127.0.0.1#53(127.0.0.1)<br>;; WHEN: Mon Oct 31 15:00:59 GMT 2022<br>;; MSG SIZE rcvd: 165</i><br><br></div><div>Can someone help me why this behaviour is seen on BIND 9.16.* version.</div><div>Thanks,</div><div>Nagesh</div></div>
<span>-- </span><br><span>Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list</span><br><span></span><br><span>ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.</span><br><span></span><br><span></span><br><span>bind-users mailing list</span><br><span>bind-users@lists.isc.org</span><br><span>https://lists.isc.org/mailman/listinfo/bind-users</span><br></div></blockquote></body></html>