SERVFAIL on stub zone (WAS: dig @server foobar +trace +recurse)
Tony Finch enlightens me thus:
> The difference between stub and static-stub is that stub works like the
> root zone hints, i.e. the servers in the zone override the ones that you
> configure for a stub zone, whereas the servers you configure for a
> static-stub zone override the servers in the zone.
... so, since I want my parent zone to be able to give me the
set of servers it wants me to use, I configured my resolver
to have (this snippet from "named-checkconf -p" to deal with
include files and such):
zone "concordia.ca" {
type stub;
file "StubData/concordia.ca.SEC";
masters {
132.205.1.1 ;
132.205.7.51 ;
};
multi-master yes;
};
"named-checkconf" gave no errors. I issued a "reconfig", again
no errors logged or reported. I can confirm that the zone was
transferred correctly (showing me the internal view), because
I have "masterfile-format text" as a general option (small
enough number of zones that performance is not an issue, but
human ability to debug *is*), and "StubData/concordia.ca.SEC"
contains a perfectly normal-looking zone "stub":
--
$ORIGIN .
$TTL 86400 ; 1 day
concordia.caIN SOA ns1.concordia.ca. hostmaster.concordia.ca. (
2028969738 ; serial
43200 ; refresh (12 hours)
1800 ; retry (30 minutes)
2592000; expire (4 weeks 2 days)
1800 ; minimum (30 minutes)
)
NS ns1.concordia.ca.
NS ns2.concordia.ca.
--
It all looks just peachy, but when I issued:
dig @localhost -t ns concordia.ca.
it gave me a SERVFAIL. I couldn't find anything abnormal
in the syslogs. I can't for the life of my figure out why
it's unhappy. How can I debug this? Is it normal that a
zone could be badly enough out of whack to SERVFAIL, yet
the named would syslog nothing?
(I'm syslogging default "syslog_all", minus edns-disabled,
lame-servers, rpz, and unmatched.)
Anne.
--
Ms. Anne Bennett, Senior Sysadmin, ENCS, Concordia University, Montreal H3G 1M8
a...@encs.concordia.ca+1 514 848-2424 x2285
___
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe
from this list
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
dnssec-enable made named stop working
Suddenly server stop working ; on logs following messages appeared :
alidating @0x7f2c60591400: . NS: got insecure response; parent indicates
it should be secure
error (insecurity proof failed) resolving './NS/IN': 199.7.83.42#53
validating @0x7f2c60528430: net SOA: verify failed due to bad signature
(keyid=48497): RRSIG validity period has not begun
validating @0x7f2c60528430: net SOA: no valid signature found
After add
dnssec-enable = no ;
and restart the server, it began working again.
a)Why did it happen if server was already working ?
In my original named.conf I had default settings like this:
the include statement:
include "/etc/named.root.key";
and the file named.root.key containing:
managed-keys {
# DNSKEY for the root zone.
# Updates are published on root-dnssec-annou...@icann.org
. initial-key 257 3 8
"AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF
FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX
bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD
X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz
W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS
Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq QxA+Uk1ihz0=";
};
b) Is it bad practice to disable dnssec option ?
c) Which is a good practice about dnssec use ?
e) Named using dnssec have problems very often ?
c) Using dnssec will decrease server performance ?
Sorry for the questions battery butIm very concerned about it, my server
was ready to go on production but now I have to figure out this issue.
I am reading some docs and researching about this.
Any comments or thought would be wellcome
Leandro.
___
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe
from this list
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
make test fails without Net::DNS::Nameserver
I don't see this mentioned anywhere else, although I'm suprised by that so maybe I'm missing something. When I build bind-9.10.2-P2 I find that "make test" fails for reclimit with "Couldn't start server ans2" if I don't have Net::DNS::Nameserver installed. After I install it the testing is successful. Maria ___ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users
Re: dnssec-enable made named stop working
In message <55a57b9c.6050...@gmail.com>, Leandro writes:
> Suddenly server stop working ; on logs following messages appeared :
>
> alidating @0x7f2c60591400: . NS: got insecure response; parent indicates
> it should be secure
> error (insecurity proof failed) resolving './NS/IN': 199.7.83.42#53
> validating @0x7f2c60528430: net SOA: verify failed due to bad signature
> (keyid=48497): RRSIG validity period has not begun
> validating @0x7f2c60528430: net SOA: no valid signature found
> After add
> dnssec-enable = no ;
> and restart the server, it began working again.
It looks like the clock is wrong based on "RRSIG validity period has
not begun". Run "date -u" and check everything.
> a)Why did it happen if server was already working ?
> In my original named.conf I had default settings like this:
> the include statement:
> include "/etc/named.root.key";
> and the file named.root.key containing:
>
> managed-keys {
> # DNSKEY for the root zone.
> # Updates are published on root-dnssec-annou...@icann.org
> . initial-key 257 3 8
> "AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF
> FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX
> bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD
> X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz
> W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS
> Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq QxA+Uk1ihz0=";
> };
>
> b) Is it bad practice to disable dnssec option ?
> c) Which is a good practice about dnssec use ?
> e) Named using dnssec have problems very often ?
> c) Using dnssec will decrease server performance ?
>
>
> Sorry for the questions battery butIm very concerned about it, my server
> was ready to go on production but now I have to figure out this issue.
> I am reading some docs and researching about this.
> Any comments or thought would be wellcome
> Leandro.
>
>
>
>
>
>
>
> ___
> Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe
> from this list
>
> bind-users mailing list
> bind-users@lists.isc.org
> https://lists.isc.org/mailman/listinfo/bind-users
--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742 INTERNET: ma...@isc.org
___
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe
from this list
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
Re: make test fails without Net::DNS::Nameserver
On Tue, 14 Jul 2015, Maria Iano wrote: > I don't see this mentioned anywhere else, although I'm suprised by that > so maybe I'm missing something. When I build bind-9.10.2-P2 I find > that "make test" fails for reclimit with "Couldn't start server ans2" if > I don't have Net::DNS::Nameserver installed. After I install it the > testing is successful. We recently added a bin/tests/system/reclimit/prereq.sh script to check for it. CHANGES entry: 4113. [test] Check for Net::DNS is some system test prerequisites. [RT #39369] ___ Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list bind-users mailing list bind-users@lists.isc.org https://lists.isc.org/mailman/listinfo/bind-users
Re: SERVFAIL on stub zone (WAS: dig @server foobar +trace +recurse)
> zone "concordia.ca" {
> type stub;
> file "StubData/concordia.ca.SEC";
> masters {
> 132.205.1.1 ;
> 132.205.7.51 ;
> };
> multi-master yes;
> };
[results in transferring:]
> --
> $ORIGIN .
> $TTL 86400 ; 1 day
> concordia.caIN SOA ns1.concordia.ca. hostmaster.concordia.ca. (
> 2028969738 ; serial
> 43200 ; refresh (12 hours)
> 1800 ; retry (30 minutes)
> 2592000; expire (4 weeks 2 days)
> 1800 ; minimum (30 minutes)
> )
> NS ns1.concordia.ca.
> NS ns2.concordia.ca.
> --
[but querying it for NS gives SERVFAIL]
Midnight insight: glue records??? The two listed NS are below the
zone cut. How can a stub zone work in those circumstances, if at all?
Anne.
--
Ms. Anne Bennett, Senior Sysadmin, ENCS, Concordia University, Montreal H3G 1M8
a...@encs.concordia.ca+1 514 848-2424 x2285
___
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe
from this list
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
