Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I'm trying to set up an authoritative DNS server with bind9 (9.8.1-P1) on Ubuntu 12.04.2 LTS (upgraded from Ubuntu 11.04) and I am encountering some problems.

External problem

When trying to check my DNS configuration with the following tools solvedns.com/biotechnics.ro and dnscheck.pingdom.com/?domain=biotechnics.ro they fail with output messages like "Name server ns1.biotechnics.ro (89.36.94.53) does not answer queries" or "Your name server ns1.biotechnics.ro is NOT responding to NS record queries!"

Also, external online dig tools such as this give back the following output:

; <<>> DiG 9.8.4-P1 <<>> @ns1.biotechnics.ro -t NS biotechnics.ro

; (1 server found)

;; global options: +cmd

;; connection timed out; no servers could be reached

Primary TLD from Parent

The parent is set up the following way:

; <<>> DiG 9.8.4-P1 <<>> @primary.rotld.ro -t NS biotechnics.ro
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7740
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 2, ADDITIONAL: 2
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;biotechnics.ro.            IN  NS

;; AUTHORITY SECTION:
biotechnics.ro.     10800   IN  NS  ns2.biotechnics.ro.
biotechnics.ro.     10800   IN  NS  ns1.biotechnics.ro.

;; ADDITIONAL SECTION:
ns1.biotechnics.ro. 10800   IN  A   89.36.94.53
ns2.biotechnics.ro. 10800   IN  A   141.85.169.100

;; Query time: 279 msec
;; SERVER: 192.162.16.18#53(192.162.16.18)
;; WHEN: Tue Feb 12 05:40:50 2013
;; MSG SIZE  rcvd: 100

Configuration on ns1

rsavu@host:/etc/bind$ head -40 named.conf
// ----------------------- Options -----------------------
options {
    // all relative paths use this directory as a base
    directory "/var/cache/bind";
    // version statement changed for security (to avoid hacking known weaknesses)
    version "not currently available";
    // This prevents bind from serving other than authoritative requests:
    recursion no;
    // disables all zone transfer requests for performance as well as security reasons
    allow-transfer{none;};
    dnssec-enable no; // zone not signed
    minimal-responses yes; // optional - improved performance
    additional-from-auth no; // optional - improved performance
    additional-from-cache no; // optional - minimal performance change
};

// ----------------------- Logging -----------------------
// log to /var/log/named/zytrax-named all events from info UP in severity (no debug)
// uses 3 files in rotation swaps files when size reaches 250K
// failure messages up to this point are in (syslog) /var/log/messages
logging{
    channel custom_log{
        file "/var/log/bind9_info.log" versions 3 size 250k;
        severity debug;
    };
    category default{
        custom_log;
    };
};

// ----------------------- Zones -----------------------
zone "biotechnics.ro" in{
    type master;
    file "/etc/bind/db.biotechnics.ro";
    allow-transfer { 141.85.169.100; };
    also-notify {141.85.169.100; };
    allow-query { any; };
};

Zone file

$ORIGIN .
$TTL 36000      ; 10 hours
biotechnics.ro          IN SOA  ns1.biotechnics.ro. admin.biotechnics.ro. (
                                2013021201 ; serial
                                28800      ; refresh (8 hours)
                                7200       ; retry (2 hours)
                                604800     ; expire (1 week)
                                86400      ; minimum (1 day)
                                )
                        NS      ns1.biotechnics.ro.
                        NS      ns2.biotechnics.ro.
                        A       81.181.152.23
 $ORIGIN biotechnics.ro.
ftp                     A       81.181.152.23
ns1.biotechnics.ro.                     A       89.36.94.53
ns2.biotechnics.ro.                     A       141.85.169.100
www                     A       81.181.152.23

What I checked

  • There is no problem with the firewall (i disabled it for the moment)
  • Dig from inside the hosts work
  • Dig from slave works
  • Putting recursion yes; doesn't solve the problem
  • Netstat shows that port 53 is in use on UDP and TCP by named
  • named-checkconf and named-checkzone issue no warning.

What can be the problem? Any ideas? I don't understand what's happening and why isn't my host replying to queries.

[Later edit] The slave is on Debian 4.0 and works very well (as you can see in the dns solvers above.

share|improve this question
    
Have you used tcpdump to verify that the query is arriving on your server? –  Robie Basak Feb 12 '13 at 16:47
    
tcpdump udp and port 53 doesn't show any packages received. What can be the problem? –  rsavu Feb 12 '13 at 19:01
    
tcpdump shows packets arriving before any internal (iptables) firewall. It seems likely that your problem is outside Ubuntu. To be absolutely sure, run a tcpdump on a port configured with mirroring on the same switch that your server is connected to. –  Robie Basak Feb 12 '13 at 19:12
add comment

1 Answer 1

Try adding the option

listen-on { 127.0.0.0/8; exter.nalip.addr.ess; };
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.