<div dir="ltr">If you want it to chase down the CNAME target data from another zone, you're asking for recursion, not authoritative-only, so those results make perfect sense.<div><br></div><div>Think of it this way. The fact both zones happen to be served by the same name server is irrelevant. You should get the same authoritative answer if the zones are different servers or the same servers.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Oct 3, 2024 at 5:44 PM 大浦 義 <<a href="mailto:oourat@sandi.co.jp">oourat@sandi.co.jp</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Are searches from one authoritative zone to another authoritative zone using cname no longer allowed?<br>
<br>
/etc/named.conf<br>
acl "local" {<br>
xxx.xxx.xxx.xxx; 127.0.0.1; <br>
};<br>
・<br>
・<br>
・<br>
allow-recursion { local; };<br>
<br>
--<br>
Client xxx.xxx.xxx.xxx→9.9.4:OK 9.9.18:OK<br>
Client yyy.yyy.yyy.yyy(not include acl) →9.9.4:OK 9.9.18:NG<br>
<br>
<br>
-----Original Message-----<br>
From: 大浦 義 <br>
Sent: Friday, October 4, 2024 9:35 AM<br>
To: Matus UHLAR - fantomas <<a href="mailto:uhlar@fantomas.sk" target="_blank">uhlar@fantomas.sk</a>>; <a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><br>
Subject: RE: Referencing by cname from one authoritative zone to another authoritative zone<br>
<br>
Dear.<br>
<br>
・9.9.4<br>
Master<br>
<a href="http://ns0.bbb.co.jp" rel="noreferrer" target="_blank">ns0.bbb.co.jp</a><br>
Slave<br>
<a href="http://ns1.bbb.co.jp" rel="noreferrer" target="_blank">ns1.bbb.co.jp</a><br>
<a href="http://ns2.bbb.co.jp" rel="noreferrer" target="_blank">ns2.bbb.co.jp</a><br>
<br>
・9.18.28<br>
Master<br>
<a href="http://ns0-2024.bbb.co.jp" rel="noreferrer" target="_blank">ns0-2024.bbb.co.jp</a><br>
Slave<br>
<a href="http://ns1-2024.bbb.co.jp" rel="noreferrer" target="_blank">ns1-2024.bbb.co.jp</a><br>
<a href="http://ns2-2024.bbb.co.jp" rel="noreferrer" target="_blank">ns2-2024.bbb.co.jp</a><br>
<br>
# dig @<a href="http://ns1-2024.bbb.co.jp" rel="noreferrer" target="_blank">ns1-2024.bbb.co.jp</a> <a href="http://ns2.bbb.co.jp" rel="noreferrer" target="_blank">ns2.bbb.co.jp</a>.<br>
<br>
; <<>> DiG 9.18.28 <<>> @<a href="http://ns1-2024.bbb.co.jp" rel="noreferrer" target="_blank">ns1-2024.bbb.co.jp</a> <a href="http://ns2.bbb.co.jp" rel="noreferrer" target="_blank">ns2.bbb.co.jp</a>.<br>
; (1 server found)<br>
;; global options: +cmd<br>
;; Got answer:<br>
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12653 ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; WARNING: recursion requested but not available<br>
<br>
;; OPT PSEUDOSECTION:<br>
; EDNS: version: 0, flags:; udp: 4096<br>
; COOKIE: 86a5aef292eec6700100000066ff3765baf0fbd3340da90b (good) ;; QUESTION SECTION:<br>
;<a href="http://ns2.bbb.co.jp" rel="noreferrer" target="_blank">ns2.bbb.co.jp</a>. IN A<br>
<br>
;; ANSWER SECTION:<br>
<a href="http://ns2.bbb.co.jp" rel="noreferrer" target="_blank">ns2.bbb.co.jp</a>. 900 IN A 1.2.3.5<br>
<br>
;; Query time: 6 msec<br>
;; SERVER: 1.2.3.14#53(<a href="http://ns1-2024.bbb.co.jp" rel="noreferrer" target="_blank">ns1-2024.bbb.co.jp</a>) (UDP) ;; WHEN: Fri Oct 04 09:31:33 JST 2024 ;; MSG SIZE rcvd: 89<br>
<br>
<br>
<br>
-----Original Message-----<br>
From: bind-users <<a href="mailto:bind-users-bounces@lists.isc.org" target="_blank">bind-users-bounces@lists.isc.org</a>> On Behalf Of Matus UHLAR - fantomas<br>
Sent: Thursday, October 3, 2024 6:50 PM<br>
To: <a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><br>
Subject: Re: Referencing by cname from one authoritative zone to another authoritative zone<br>
<br>
On 03.10.24 09:21, 大浦 義 wrote:<br>
>・9.9.4→OK<br>
># dig @<a href="http://ns1.bbb.co.jp" rel="noreferrer" target="_blank">ns1.bbb.co.jp</a> <a href="http://time1.aaa.ne.jp" rel="noreferrer" target="_blank">time1.aaa.ne.jp</a><br>
<br>
>;; ANSWER SECTION:<br>
><a href="http://time1.aaa.ne.jp" rel="noreferrer" target="_blank">time1.aaa.ne.jp</a>. 3600 IN CNAME <a href="http://ns2.bbb.co.jp" rel="noreferrer" target="_blank">ns2.bbb.co.jp</a>.<br>
><a href="http://ns2.bbb.co.jp" rel="noreferrer" target="_blank">ns2.bbb.co.jp</a>. 900 IN A 1.2.3.5<br>
><br>
>;; AUTHORITY SECTION:<br>
><a href="http://bbb.co.jp" rel="noreferrer" target="_blank">bbb.co.jp</a>. 900 IN NS <a href="http://ns6-tk02.ccc.ad.jp" rel="noreferrer" target="_blank">ns6-tk02.ccc.ad.jp</a>.<br>
><a href="http://bbb.co.jp" rel="noreferrer" target="_blank">bbb.co.jp</a>. 900 IN NS <a href="http://ns2.bbb.co.jp" rel="noreferrer" target="_blank">ns2.bbb.co.jp</a>.<br>
><a href="http://bbb.co.jp" rel="noreferrer" target="_blank">bbb.co.jp</a>. 900 IN NS <a href="http://ns1.bbb.co.jp" rel="noreferrer" target="_blank">ns1.bbb.co.jp</a>.<br>
><br>
>;; ADDITIONAL SECTION:<br>
><a href="http://ns1.bbb.co.jp" rel="noreferrer" target="_blank">ns1.bbb.co.jp</a>. 900 IN A 1.2.3.4<br>
<br>
>・9.18.28→NG<br>
># dig @<a href="http://ns1-2024.bbb.co.jp" rel="noreferrer" target="_blank">ns1-2024.bbb.co.jp</a> <a href="http://time1.aaa.ne.jp" rel="noreferrer" target="_blank">time1.aaa.ne.jp</a><br>
<br>
>;; ANSWER SECTION:<br>
><a href="http://time1.aaa.ne.jp" rel="noreferrer" target="_blank">time1.aaa.ne.jp</a>. 3600 IN CNAME <a href="http://ns2.bbb.co.jp" rel="noreferrer" target="_blank">ns2.bbb.co.jp</a>.<br>
<br>
<br>
Now do:<br>
dig @<a href="http://ns1-2024.bbb.co.jp" rel="noreferrer" target="_blank">ns1-2024.bbb.co.jp</a> <a href="http://ns2.bbb.co.jp" rel="noreferrer" target="_blank">ns2.bbb.co.jp</a>.<br>
<br>
what records does <a href="http://ns2.bbb.co.jp" rel="noreferrer" target="_blank">ns2.bbb.co.jp</a>. have on <a href="http://ns1-2024.bbb.co.jp" rel="noreferrer" target="_blank">ns1-2024.bbb.co.jp</a> ?<br>
<br>
<br>
>On 03.10.24 08:40, 大浦 義 wrote:<br>
>>Referencing by cname from one authoritative zone to another authoritative zone may not work properly depending on the version.<br>
>>Is this due to a specification change? Is there a way to handle this?<br>
>>I am running nslookup from a client that is not included in acl respectively.<br>
>>I would like to make the NG part become OK.<br>
>><br>
>>--<br>
>>One Server Has Two Zone.<br>
>><a href="http://aaa.ne.jp" rel="noreferrer" target="_blank">aaa.ne.jp</a> & <a href="http://bbb.co.jp" rel="noreferrer" target="_blank">bbb.co.jp</a><br>
>><br>
>>・<a href="http://aaa.ne.jp" rel="noreferrer" target="_blank">aaa.ne.jp</a><br>
>>time1 CNAME <a href="http://ns2.bbb.co.jp" rel="noreferrer" target="_blank">ns2.bbb.co.jp</a>.<br>
>>time2 CNAME <a href="http://ns1.bbb.co.jp" rel="noreferrer" target="_blank">ns1.bbb.co.jp</a>.<br>
>><br>
>>・<a href="http://bbb.co.jp" rel="noreferrer" target="_blank">bbb.co.jp</a><br>
>>ns1 A 1.2.3.4<br>
>>ns2 A 1.2.3.5<br>
>>time CNAME ns2<br>
>><br>
>>・Bind9.9.4→OK<br>
>>>nslookup <a href="http://time2.aaa.ne.jp" rel="noreferrer" target="_blank">time2.aaa.ne.jp</a><br>
>>名前: <a href="http://ns1.bbb.co.jp" rel="noreferrer" target="_blank">ns1.bbb.co.jp</a><br>
>>Address: 1.2.3.4<br>
>>Aliases: <a href="http://time2.aaa.ne.jp" rel="noreferrer" target="_blank">time2.aaa.ne.jp</a><br>
>><br>
>>・Bind9.18.28→NG<br>
>>>nslookup <a href="http://time2.aaa.ne.jp" rel="noreferrer" target="_blank">time2.aaa.ne.jp</a><br>
>>名前: <a href="http://ns1.bbb.co.jp" rel="noreferrer" target="_blank">ns1.bbb.co.jp</a><br>
><br>
>nslookup is NOT a good tool to resolve DNS problems. Use "dig" instead.<br>
><br>
><br>
>dig <a href="http://time2.aaa.ne.jp" rel="noreferrer" target="_blank">time2.aaa.ne.jp</a> @"IP of Bind9.9.4"<br>
><br>
><br>
>dig <a href="http://time2.aaa.ne.jp" rel="noreferrer" target="_blank">time2.aaa.ne.jp</a> @"IP of Bind9.18.28"<br>
<br>
--<br>
Matus UHLAR - fantomas, <a href="mailto:uhlar@fantomas.sk" target="_blank">uhlar@fantomas.sk</a> ; <a href="http://www.fantomas.sk/" rel="noreferrer" target="_blank">http://www.fantomas.sk/</a><br>
Warning: I wish NOT to receive e-mail advertising to this address.<br>
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.<br>
How does cat play with mouse? cat /dev/mouse<br>
--<br>
Visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br>
<br>
ISC funds the development of this software with paid support subscriptions. Contact us at <a href="https://www.isc.org/contact/" rel="noreferrer" target="_blank">https://www.isc.org/contact/</a> for more information.<br>
<br>
<br>
bind-users mailing list<br>
<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
-- <br>
Visit <a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a> to unsubscribe from this list<br>
<br>
ISC funds the development of this software with paid support subscriptions. Contact us at <a href="https://www.isc.org/contact/" rel="noreferrer" target="_blank">https://www.isc.org/contact/</a> for more information.<br>
<br>
<br>
bind-users mailing list<br>
<a href="mailto:bind-users@lists.isc.org" target="_blank">bind-users@lists.isc.org</a><br>
<a href="https://lists.isc.org/mailman/listinfo/bind-users" rel="noreferrer" target="_blank">https://lists.isc.org/mailman/listinfo/bind-users</a><br>
<br>
</blockquote></div>