|
Well, my network, breaffly looks like: (We are an
ISP down here in Medellin Colombia).
1 Primary DNS Server (Imail Server we are talking
about).
1 Secondary DNS Server (Win 2k )
2 External Routers
2 Internal Routers.
1 L4 switch
4 l2 switchs.
36 Extra servers
Both servers are at the same subnet (200.124.168.0
/24) wich is authoritative for us, we have this subnet assigned (200.124.160.0
/20).
I did cut out the file of geo.net.co because some
AD servers publish to this zone dynamically so its very large!
Really im not a GURU with this DNS stuff (Trully,
networking is my stuff), but i receive A LOT of messages at my event viewer
about event id 7062:
The DNS server encountered a packet addressed to itself
-- IP address 200.124.168.11.
The DNS server should never be sending a packet to
itself. This situation usually indicates a configuration error.
Check the following areas for possible self-send
configuration errors:
1) Forwarders list. (DNS servers should not forward to
themselves).
2) Master lists of secondary zones.
3) Notify lists of primary zones.
4) Delegations of subzones. Must not contain NS record
for this DNS server unless subzone is also on this server.
Example of self-delegation:
-> This DNS server dns1.foo.com is the primary for the
zone foo.com.
-> The foo.com zone contains a delegation of
bar.foo.com to dns1.foo.com,
(bar.foo.com NS dns1.foo.com)
-> BUT the bar.foo.com zone is NOT on this server.
Note, you should make this delegation check (with
nslookup or DNS manager) both on this DNS server and on the server(s) you
delegated the subzone to. It is possible that the delegation was done correctly,
but that the primary DNS for the subzone, has any incorrect NS record pointing
back at this server. If this incorrect NS record is cached at this server, then
the self-send could result. If found, the subzone DNS server admin should remove
the offending NS record.
I dont get it, but well, i can live with it!
This a DNS Zone of one of our clients:
; Database file ademinas.com.dns for ademinas.com
zone.
; Zone version: 11
;@
IN SOA ns1.geonetsa.com. hostmaster.geo.net.co.
(
11 ; serial
number
10800 ;
refresh
3600 ;
retry
604800 ;
expire
3600 ) ; minimum TTL
; Zone NS records
@
NS ns1.geonetsa.com.
ns1.geonetsa.com.
23243 A 200.124.168.11
@
NS ns2.geonetsa.com.
ns2.geonetsa.com.
A 200.124.168.12
; Zone records
;
@
MX 10 smtp.geonetsa.com.
ftp
CNAME hosting.geonetsa.com.
pop3
CNAME mail.geonetsa.com.
smtp
CNAME mail.geonetsa.com.
www
CNAME hosting.geonetsa.com.
@
MX 50
smtp-relay.geonetsa.com.
So what about geonetsa.com ?
here it goes:
;
; Database file geonetsa.com.dns for
geonetsa.com zone.
; Zone version:
239
;
@
IN SOA ns1.geonetsa.com. hostmaster.geo.net.co.
(
239 ; serial
number
10800 ;
refresh
3600 ;
retry
86400 ;
expire
3600 ) ; minimum TTL
;
; Zone NS records
;
@
NS ns1.geonetsa.com.
@
NS ns2.geonetsa.com.
;
; Zone records
;
alerting
A 200.124.168.30
bwmgr
A 200.124.168.6
central
A 200.124.168.1
cobalt
A 200.124.168.14
dns1
A 200.124.168.11
dns2
A 200.124.168.12
hosting
A 200.124.168.10
hosting1
CNAME linux.geonetsa.com.
imail
A 200.124.168.11
linux
A 200.124.168.15
mail
A 200.124.168.11
ns1
A 200.124.168.11
ns2
A 200.124.168.12
smtp
A 200.124.168.11
smtp-back
A 200.124.168.41
smtp-relay
A 200.124.168.42
sql
A 200.124.168.13
sroom
A 200.124.171.34
streaming
A 200.124.168.9
SWITCH-L4
A 200.124.160.4
tco01
86400 A 200.124.168.21
tco02
86400 A 200.124.168.22
tco03
86400 A 200.124.168.23
tco04
86400 A 200.124.168.24
web
A 200.124.168.16
webcache
A 200.124.160.3
Is this the way to manage those dns files?? whats
the best method to create a zone for Imail MTA interaction?
Thanks!
Sergio Rinc�n Jaramillo
Ingeniero Telem�tica
GeoNet S.A.
TEL (574) 5104701
Fax (574) 2350160
L�nea �nica de Atenci�n al Cliente 3500111
Calle 34B N�
66� 42, Medell�n, Colombia
Ya visit� nuestro sitio www.geo.net.co
Las opiniones que
se expresan en este e-mail son personales y no necesariamente coinciden con las
de GeoNet S.A. Este e-mail y todos los archivos transmitidos en �l, incluidas
las respuestas y los reenv�os (que pueden incluir modificaciones) son
confidenciales y de uso exclusivo del destinatario original, no se debe revelar
ni utilizar por una persona distinta al destinatario ni copiar por medio
alguno.
----- Original Message -----
Sent: Thursday, October 14, 2004 6:15
PM
Subject: RE: [IMail Forum] Bizarre
problem with WebMail + DNS + W2k
Just
show us any other zone (or a couple). The DNS records necessary to "walk
through" a DNS lookup, and maybe spot a loop or something.
As
to to he Host Aliases on the virtual domain definition "General" page,
it does indeed make the host header get honored. It sure isn't in the
book or help! THANKS MUCHO! I'm so tired of having to type the domain when I
can see it in the browser address line. btw, all my (20 or so) domains are on
port 80, on the same IP. I use port 81 for management (I couldn't remember
8181 either!). Interestingly, this server is a W2K server with DNS on
it<g>. I have 3 DNS, the Imail box (Primary DNS - public
63.171.93.0/27), another member server (Secondary DNS Public
63.171.93.0/27) and a Domain Controller (Active Directory Integrated
Primary - Private 172.27.0.xx - DNS), all behind a firewall. Except
for the firewall, sounds like your place!
The
CNAME for Administration Ease is definitely a good thing. But crossing Zones,
it's an even better thing. I was thinking your "client" domains were
sub-zones of geo.net.co, not independent (you said you had other zone files. I
just thought you'd cut off your ONLY zone file before the "clients" got
defined).
In a
large zone file with CNAMES only to itself, you'd be polite to use A records.
In a distrubuted system where zone files use names in a different zone,
the CNAME is very appropriate (Unless one is debugging a performance
issue<g>). Might try a zone with all A records, just for
grins.
SPF
is an upcoming Sender Policy Framework to stamp out spam. It's trivial to
publish your authorized sender IPs in DNS. It's somewhat more involved to
actually read other folks SPF records, but publishing is easy and should be
done.
Did
you read the DNS Report? There are some other pointers about your zone you may
want to address. Here's a link on SPF (http://spf.pobox.com/)
Is
.12 in the same box as .11? You got any routers? Have you checked the event
logs for IP conflicts?
Dan
Hi Dan, well, just tell me wich zon you need
the extra info.
About using webmail at 80 port, we had it that
way and same thing, had to pass it to 8383 again this week, so we can
redirect all th MAIL aliases from our customers to other WEB:80 that
currently redirects to our IMAIL:8383 server so we can "force" the users to
get catched up with the geo.net.co:8383 webmail, wich doesnt hangs the
CPU.
About the host headers, i think thats an extra
from Imail, you just put at the vhost configuration screen, at the HOST
ALIASES, imail.domain.com and you put a CNAME (OR A-RECORD) pointing to your
servers IP address. At that stage, everytime a user goes to
http://imail.domain.com :8383 (or any of your imail webmail setting port),
imail will catch the headers (And add them to the logging proceess), wich
simplifies the loggin stage (Try it, its cool if your system doesnt behave
like mine! now i have to make all of them type their domain).
Basically I use CNAMES because if we have some
migration, we only need to change 1 record, basically thats the
reason.
I dont get this (sorry!)
No SPF text seen. (A simple TXT
record of "v=spf1 +mx -all" will do.
----- Original Message -----
Sent: Thursday, October 14, 2004 5:26
PM
Subject: RE: [IMail Forum] Bizarre
problem with WebMail + DNS + W2k
Several things come to mind.
a) No Firewall? Sounds risky.
b) You don't show any examples of the other DNS entries. You
stopped just when it was about to get interesting.
c) If there's not a webserver on this do-everything box, you can
put IMail on port 80 and simplify everybodies life.
d) Your zone serial number should be in the form yyyymmddxx, looks
like the 4 got dropped.
e) CNAMES cost extra references. Unless there is a good
administrative reason for using them (like you don't control both the name
and alias), you should just use A records.
f) No SPF text seen. (A simple TXT record of "v=spf1 +mx -all" will
do.
h) How do you get IMail to notice the Host headers? I'd like to do
that. I make my users type the whole thing! I thought you had to use
separat IPs but that would be A records, no CNAMEs.
Dan
Hi there:
Well, after a full week reinstalling and
reinstalling and looking up for some help, we found the following
strange thing with our system.
We do a clean installation of webmail on
our server (IBM Xserier 235, 2 Xeon x 3.2 Ghz, 2GB RAM), with Windows
2000 Server, MS DNS Server, Fprot, Declude AV, Declude
Hijack.
The server is the Primary DNS Server of our
Network.
The Imail server, responds to hostname
(geo.net.co)
(geo.net.co) is configured as a Primary
zone in our DNS. (Remember that the DNS server runs on the SAME Imail
Server).
geo.net.co has the following created
records (I think this is not ok, so if you see some missleading,
thanks!, )
;
; Database file geo.net.co.dns
for geo.net.co zone.
; Zone
version: 2001042332
;
@
IN SOA ns1.geo.net.co. hostmaster.geo.net.co.
(
2001042332 ; serial
number
3600 ;
refresh
3600 ;
retry
86400 ;
expire
86400 ) ; minimum TTL
; Zone NS records
@
NS dns1.geo.net.co.
@
NS ns1.geo.net.co.
@
NS ns2.geo.net.co.
@
NS imail.noc-geonet.com.
@
NS dns2.geo.net.co.
; Zone records
@
A 200.124.168.11
@
MX 10 ns1.geo.net.co.
dns1
A 200.124.168.11
dns2
A 200.124.168.11
ns1
A 200.124.168.11
ns2
A 200.124.168.12
smtp
CNAME dns1.geonetsa.com.
pop3
CNAME dns1.geonetsa.com.
So, at this server, i have like 200 Virtual
domains, i make an CNAME record at each one, pointing at geo.net.co so
when they log in to the webmail, they dont have to use @domain.com
appended to the username.
The strange thing
is:
When i use http://200.124.168.11:8383 for
logging in to my Webmail, using the perfmon i see that iwebmsg only uses
like 10% of the cpu for the complete logon process, but if i use for
example http://mail.domain.com:8383, the
cpu goes nuts, like 90-100% of ussage for like 3 seconds that is the
time of the complete logon process.
So, the only way that the cpu, doesnt hang
is if I use: http://200.124.168.11:8383 or
Any ideas???
Sergio Rinc�n Jaramillo
Ingeniero Telem�tica
GeoNet S.A.
TEL (574)
5104701 Fax (574) 2350160
L�nea �nica de Atenci�n al Cliente
3500111
Calle 34B N� 66� 42, Medell�n, Colombia
Ya
visit� nuestro sitio www.geo.net.co
Las
opiniones que se expresan en este e-mail son personales y no
necesariamente coinciden con las de GeoNet S.A. Este e-mail y todos los
archivos transmitidos en �l, incluidas las respuestas y los reenv�os
(que pueden incluir modificaciones) son confidenciales y de uso
exclusivo del destinatario original, no se debe revelar ni utilizar por
una persona distinta al destinatario ni copiar por medio
alguno.
|
