4

For my home network I've got DNS setup so that internally names resolve to the local private address of my reverse proxy, and externally they resolve via a CNAME to my external IP (which port forwards) so:

  • Externally cloud.mydomain.com = CNAME to server.mydomain.com
  • home.mydomain.com = dynamicDNS entry to my broadband IP address
  • Internally cloud.mydomain.com = A-record to 172.16.1.10

However since I've upgraded to 17.04 sometimes I'll get my broadband IP popping up in response to an internal query. Here's a couple of Digs:

me@desktop:~$ dig cloud.mydomain.com

; <<>> DiG 9.10.3-P4-Ubuntu <<>> cloud.mydomain.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28907
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;cloud.mydomain.com.        IN  A

;; ANSWER SECTION:
cloud.mydomain.com. 267 IN  CNAME   home.mydomain.com.
home.mydomain.com.  175 IN  A   #My external IP#

;; Query time: 0 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Sun Apr 16 19:42:24 BST 2017
;; MSG SIZE  rcvd: 81

me@desktop:~$ dig cloud.mydomain.com @172.16.0.254

; <<>> DiG 9.10.3-P4-Ubuntu <<>> cloud.mydomain.com @172.16.0.254
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27183
;; flags: qr aa rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;cloud.mydomain.com.        IN  A

;; ANSWER SECTION:
cloud.mydomain.com. 0   IN  A   172.16.1.10

;; Query time: 0 msec
;; SERVER: 172.16.0.254#53(172.16.0.254)
;; WHEN: Sun Apr 16 19:42:33 BST 2017
;; MSG SIZE  rcvd: 51

So if I just dig it has the external CNAME from somewhere, and then resolves the home.mydomain.com locally. If I point the dig at my home DNS server, then it gets the right address.

The home DNS server is the one the system is using to resolve most things (and is the address provided over DHCP)

I have no idea what's wrong, I'm going to try setting up a monitor port to see how the system is resolving cloud.mydomain.com externally.

Can anyone shed any light on this issue?

4

do this:

sudo mkdir -p /etc/systemd/resolved.conf.d
printf "[Resolve]\nDNSSEC=no\n" | sudo tee /etc/systemd/resolved.conf.d/no-dnssec.conf

and restart

  • Is this needed despite /etc/systemd/resolved.conf saying DNSSEC=off is compiled in as default, even if you do set it off can't you just do it in the resolved.conf file? – pbhj Jun 5 '17 at 21:23
  • this answer, with additional details, also at superuser (by same author), linking here for reference: superuser.com/questions/1153203/… – michael Jun 16 '17 at 12:52
  • 2
    dear god it just took me an hour of internet digging to find these two magic lines... – wordsforthewise Jul 22 '17 at 7:55
1

Ok, probably should have debugged this before posting, but hopefully someone can learn from this.

I have IPv6, and I didn't setup local resolution of the IPv6 address in response to a AAAA request.

Ubuntu is making both A and AAAA requests for cloud.mydomain.com. It receives both an IP response to the A and a CNAME to the AAAA, following the CNAME to the AAAA doesn't work, as that's not setup, however the CNAME response is cached.

So subsequent requests for cloud.mydomain.com follow the cached CNAME and request home.mydomain.com, which resolves to my external IP.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.