Re: [qmailtoaster] OT: Bind9 DNS question

[Maxwell Smart]

Dan, I don't have recursion on my DNS server and it resolves correctly from the server.  My internal LAN use the ISP DNS server. SNIP recursion no;     notify yes;     forwarders {         206.13.28.12;         206.13.30.12;         };                                             }; zone "." in {     type hint;     file "root.hint"; }; zone "localhost" in {     type master;     allow-update { none; };     allow-transfer { 173.164.181.57; };     file "localhost.zone"; }; zone "0.0.127.in-addr.arpa" in {         type master;         file "named.local";         allow-update { none; }; }; /SNIP CJ Dan McAllister wrote: You have only specified yourself as a recolving DNS server... and the configuration you have shown does not permit anyone (including yourself) to do recursion... thus, you will resolve domains for which you are a master server for, but nothing else (which is the RIGHT configuration for the Internet-facing DNS service). Here's how I do it... In $ROOTDIR/etc/named.conf you'll see the following (this is only a PARTIAL listing): acl locals {         127.0.0.0/8;                // loopbacks         192.168.0.0/24;         // My local LAN -- you may not need this }; ... view "authorized" {         match-clients   { locals; };         recursion       yes;         include         "basic.zones";         include         "local.zones";         include         "master.zones";         include         "slave.zones"; }; view "unauthorized" {         match-clients   { any; };         recursion       no;         include         "master.zones";         include         "slave.zones"; }; So then the operative question becomes, what's in those include files! basic.zones has the root-hints, plus the definitions for localdomain, localhost, etc that you'll see in any sample BIND config local.zones has the zone definitions for my local (intermal, LAN) zones (e.g.: mydomain.local) master.zones has the zone definitions for zones that this server is the MASTER server for (that is, REAL zones that I am authoritative for) slave.zones has the zone definitions for zones that this server is a SLAVE server for Now any of these *.zones files can be EMPTY (for example, on my real MASTER DNS server, master.zones has some 200 entries for domains I host, and an empty slave.zones file -- and my slave DNS servers have empty master.zones files, but 200 entries in the slave.zones files) The end result is that my internal LAN clients (those with an address of 192.168.0.x) have use of my BIND service for looking up external names (like google.com), as well as internal (like domain.local) and even my own "public" domain names.... but outsiders (any other IP address) can only see my "public" domain names -- they cannot resolve ANY name other than those for which I am an authoritative server.... At least that's the issue I THING you're having... Good Luck Dan IT4SOHO On 8/6/2011 11:04 PM, Maxwell Smart wrote: Scott Hughes wrote: For some weird reason my DNS (not on qmail) is not forwarding requests for zones that aren't in it's zone files (like google.com).  If I 'dig' one of my zones, I get all the correct information.  If I 'dig' something like www.google.com I get nothing.  Here are the two files that I think control this: # cat resolv.conf search renshawauto.org nameserver 66.255.244.213 nameserver 127.0.0.1 NOTE: Both of these IPs are the same interface.  I used to just have the 127.0.0.1 and nothing else, so I tried the live IP to see if that would help # cat named.conf // // named.conf // // Provided by Red Hat bind package to configure the ISC BIND named(8) DNS // server as a caching only nameserver (as a localhost DNS resolver only). // // See /usr/share/doc/bind*/sample/ for example named configuration files. // options {         listen-on port 53 { 127.0.0.1; };         listen-on port 53 { 66.255.244.213; }; #       listen-on-v6 port 53 { ::1; };         allow-query { 127.0.0.1; 66.255.244.213; };         allow-recursion { 127.0.0.1; 66.255.244.213; };         directory       "/var/named/chroot/var/named";         forward first;         forwarders { 8.8.8.8; 8.8.4.4; };         dump-file       "/var/named/chroot/var/named/data/cache_dump.db";         statistics-file "/var/named/chroot/var/named/data/named_stats.txt";         memstatistics-file "/var/named/chroot/var/named/data/named_mem_stats.txt"; //        allow-query     { 127.0.0.1; 66.255.244.213; localhost; };         recursion no;         transfers-out 100; }; logging {         channel default_debug {                 file "data/named.run";                 severity dynamic;         }; }; zone "." IN {         type hint;         file "/var/named/chroot/var/named/named.root"; }; include "/var/named/chroot/etc/named.conf.local"; Any ideas?  I've been searching on Google for HOURS on this one. I even replaced my named.root file with the latest from Internic, No Joy!  If I put an outside DNS server into the resolv.conf then it will work probably, but the forwarders in the named.conf should do this! Thanks, Scott Firewall port 53 open? -- Cecil Yother, Jr. "cj" cj's 2318 Clement Ave Alameda, CA 94501 tel 510.865.2787 http://yother.com Check out the new Volvo classified resource http://www.volvoclassified.com --------------------------------------------------------------------------------- Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! --------------------------------------------------------------------------------- Please visit qmailtoaster.com for the latest news, updates, and packages. To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com -- Cecil Yother, Jr. "cj" cj's 2318 Clement Ave Alameda, CA 94501 tel 510.865.2787 http://yother.com Check out the new Volvo classified resource http://www.volvoclassified.com --------------------------------------------------------------------------------- Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! --------------------------------------------------------------------------------- Please visit qmailtoaster.com for the latest news, updates, and packages. To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com