4

For my home network I've got DNS setup so that internally names resolve to the local private address of my reverse proxy, and externally they resolve via a CNAME to my external IP (which port forwards) so:

  • Externally cloud.mydomain.com = CNAME to server.mydomain.com
  • home.mydomain.com = dynamicDNS entry to my broadband IP address
  • Internally cloud.mydomain.com = A-record to 172.16.1.10

However since I've upgraded to 17.04 sometimes I'll get my broadband IP popping up in response to an internal query. Here's a couple of Digs:

me@desktop:~$ dig cloud.mydomain.com

; <<>> DiG 9.10.3-P4-Ubuntu <<>> cloud.mydomain.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28907
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;cloud.mydomain.com.        IN  A

;; ANSWER SECTION:
cloud.mydomain.com. 267 IN  CNAME   home.mydomain.com.
home.mydomain.com.  175 IN  A   #My external IP#

;; Query time: 0 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Sun Apr 16 19:42:24 BST 2017
;; MSG SIZE  rcvd: 81

me@desktop:~$ dig cloud.mydomain.com @172.16.0.254

; <<>> DiG 9.10.3-P4-Ubuntu <<>> cloud.mydomain.com @172.16.0.254
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27183
;; flags: qr aa rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;cloud.mydomain.com.        IN  A

;; ANSWER SECTION:
cloud.mydomain.com. 0   IN  A   172.16.1.10

;; Query time: 0 msec
;; SERVER: 172.16.0.254#53(172.16.0.254)
;; WHEN: Sun Apr 16 19:42:33 BST 2017
;; MSG SIZE  rcvd: 51

So if I just dig it has the external CNAME from somewhere, and then resolves the home.mydomain.com locally. If I point the dig at my home DNS server, then it gets the right address.

The home DNS server is the one the system is using to resolve most things (and is the address provided over DHCP)

I have no idea what's wrong, I'm going to try setting up a monitor port to see how the system is resolving cloud.mydomain.com externally.

Can anyone shed any light on this issue?

Improve this question

2 Answers 2

Reset to default
4

do this:

sudo mkdir -p /etc/systemd/resolved.conf.d
printf "[Resolve]\nDNSSEC=no\n" | sudo tee /etc/systemd/resolved.conf.d/no-dnssec.conf

and restart

Improve this answer
3
  • Is this needed despite /etc/systemd/resolved.conf saying DNSSEC=off is compiled in as default, even if you do set it off can't you just do it in the resolved.conf file?
    – pbhj
    Jun 5, 2017 at 21:23
  • this answer, with additional details, also at superuser (by same author), linking here for reference: superuser.com/questions/1153203/…
    – michael
    Jun 16, 2017 at 12:52
  • 2
    dear god it just took me an hour of internet digging to find these two magic lines...
    – wordsforthewise
    Jul 22, 2017 at 7:55
1

Ok, probably should have debugged this before posting, but hopefully someone can learn from this.

I have IPv6, and I didn't setup local resolution of the IPv6 address in response to a AAAA request.

Ubuntu is making both A and AAAA requests for cloud.mydomain.com. It receives both an IP response to the A and a CNAME to the AAAA, following the CNAME to the AAAA doesn't work, as that's not setup, however the CNAME response is cached.

So subsequent requests for cloud.mydomain.com follow the cached CNAME and request home.mydomain.com, which resolves to my external IP.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .