Hi,
I've got a very strange problem that has emerged somehow after migrating
my isp.
My setup previously used 2x servers in master/slave configuration for my
public "view" and then had 3x servers for the "internal" view. This was
working fine for years and I have been regularly testing using online
dns healthcheck sites such as mxtoolbox etc...
Now when I try to run any type of check from mxtoolbox or other site eg.
https://dnschecker.org/ I am getting my private IP's showing instead of
the public ones?
Initially it started off by my external zone files not transferring
which I managed to see that the information was trying to traverse my
NAT (I know, not the best practice to have all dns servers on the same
network).
As a result external emails from my mail server are not working too well
with a hit and miss type thing going on right now.
Just to go over, my zone files are fine as the 'external' ones only have
public ip addresses in them and do not include any type of internal
addressing whatsoever.
Here's an example of the config in named.conf for the master:
view "external" {
match-clients { !internals; any; };
allow-recursion {
127.0.0.1;
};
zone "domain.com" {
type master;
file "/var/named/var/named/domain-external.db";
notify yes;
also-notify { pub_dns2; pub_dns3; };
allow-transfer { pub_dns2; pub_dns3; };
allow-query { pub_dns2; pub_dns3; !internals; any; };
};
...
;
This shows the slave:
view "external" {
match-clients { !internals; any; };
allow-recursion {
127.0.0.1;
};
zone "domain.com" {
type slave;
file "/var/named/var/named/domain-external.db";
masters { pub_dns1; };
allow-notify { pub_dns1; };
allow-query { pub_dns1; !internals; any; };
};
...
;
Both have the !internals macro there, so the servers should not throw up
anything from the 'internal' view. It doesn't make sense that mxtoolbox
and others, even sending mail from Google sees the private address of
the machine? There's no chroot environment either contrary to the file
path... I converted this back to normal many years ago when I started
using Jails.
Additionally for the domain to transfer using the internal (private)
network, do I need to change the 'allow-transfer' portion to the private
addresses? I have read around a little bit but wasn't quite sure, though
someone did suggest to use the 'notify explicit' statement, though I'm
not sure of the difference exactly. Closest read on that I could find is
from here: https://www.zytrax.com/books/dns/ch7/xfer.html#notify
Is it possible to suggest anything to get my servers working properly
again? I'm running version 9.16.40 on the master and 9.16.39 on both
slaves all built from FreeBSD ports.
Regards,
Kaya
--
Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from
this list
ISC funds the development of this software with paid support subscriptions.
Contact us at https://www.isc.org/contact/ for more information.
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
