1

I setup DNS which will act as external DNS server. All settings are default , administrator told me to use Root hints file which is located under /var/named/named.ca. And root zone is mentioned in /etc/named.conf file

options {
        listen-on port 53 { 127.0.0.1; 192.168.161.1; };
        #listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        recursing-file  "/var/named/data/named.recursing";
        secroots-file   "/var/named/data/named.secroots";
        allow-query     { any; };
        filter-aaaa-on-v4 yes;
        #OPTIONS = "-4"
        /*
         - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
         - If you are building a RECURSIVE (caching) DNS server, you need to enable
           recursion.
         - If your recursive DNS server has a public IP address, you MUST enable access
           control to limit queries to your legitimate users. Failing to do so will
           cause your server to become part of large scale DNS amplification
           attacks. Implementing BCP38 within your network would greatly
           reduce such attack surface
        */
        recursion yes;

        dnssec-enable yes;
        dnssec-validation yes;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.iscdlv.key";

        managed-keys-directory "/var/named/dynamic";

        pid-file "/run/named/named.pid";
        session-keyfile "/run/named/session.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
        type hint;
        file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

I restart named service but when i do ping to any domain system is not able to resolve it

After removing Google DNS

when i add "127.0.0.1" and "192.168.161.1" and restart network service. and do dig google.com @localhost. It gives this reply 

dig google.com @localhost

; <<>> DiG 9.9.4-RedHat-9.9.4-72.el7 <<>> google.com @localhost
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 24654
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;google.com.                    IN      A

;; Query time: 4001 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sun Mar 22 16:46:48 +03 2020
;; MSG SIZE  rcvd: 39
Improve this question
3
  • SERVFAIL means your local nameserver had a problem big enough that it should have logged locally some details, so you need to have a look at its logfiles... Commented Mar 24, 2020 at 0:32
  • In your configuration, do not use DLV, this is a deprecated mechanism. Commented Mar 24, 2020 at 0:32
  • "I setup DNS which will act as external DNS server." So does that mean it is an authoritative nameserver for some zones? If so, it should not be a recursive nameserver. And if it is a recursive one, it shouldn't be public without a lot of precautions. Commented Mar 24, 2020 at 0:34

1 Answer 1

Reset to default
1

First off, ping isn't the best way to diagnose dns issues; you want dig:

shadur@vigil:~$ dig google.com @localhost

; <<>> DiG 9.10.3-P4-Debian <<>> google.com @localhost
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 55786
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;google.com.                    IN      A

;; ANSWER SECTION:
google.com.             22      IN      A       216.58.211.110

;; Query time: 90 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sun Mar 22 14:02:39 CET 2020
;; MSG SIZE  rcvd: 55

This yields a lot more information that - even if it isn't yet helpful to you - is much more likely to be informative to people trying to help you figure out what's going wrong.

Second off, judging by the configuration snippet you put up there and the description of what you're trying to do, your problem is the line that goes

recursion no;

Because that tells BIND9 that it should only answer queries for domains that are in its own internal known list ( what the comments just above it call an AUTHORITATIVE server), and what you describe trying to do with your ping attempts is to us it as a RECURSING server.

(It's generally not recommended to run both on the same machine, or if you do to be very careful about who you let recurse; open recursors are bad news for your network).

Also, if all of the above is too technical to understand, I highly recommend installing pdns-recursor from PowerDNS project instead.

Improve this answer
5
  • yes, i was testing now i set the recursion to yes, when i add 8.8.8.8 in resolv.conf everything starts working, But administrator is saying it should not use 8.8.8.8 Commented Mar 22, 2020 at 13:24
  • resolv.conf is what your system consults to decide what DNS server to use. When you add 8.8.8.8 to that it means you're using google's open DNS server rather than your own. This is why I said to use dig rather than ping to diagnose DNS server issues. Commented Mar 22, 2020 at 13:25
  • Ok i will replace 8.8.8.8 with the dns server's ip in resolv.conf which in this case is localhost where bind is configured Commented Mar 22, 2020 at 13:31
  • When you do, run the dig command like I demonstrated, and add the output to the question. Commented Mar 22, 2020 at 13:32
  • i removed "8.8.8.8" and added "nameserver 127.0.0.1 and nameserver 192.168.161.1" but it didnt resolve it, i added output at end of question Commented Mar 22, 2020 at 13:50

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.