I spun up a new server on AWS using the Ubuntu 14.04 Server AMI. I'm intending to build a public DNS server for our sites. We currently have two others running CentOS, but I was informed that one will be shutdown because it's on old hardware. If nothing else, a good opportunity to learn about BIND!
Here's my current set up on this new (non-functioning) DNS server:
named.conf.options:
options {
directory "/var/cache/bind";
dnssec-validation auto;
auth-nxdomain no; # conform to RFC1035
listen-on-v6 { any; };
listen-on port 53 { any; };
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { any; };
allow-transfer { none; };
recursion no;
allow-query-cache { none; };
};
zone "test.edu" IN {
type master;
file "/var/named/testedu.db";
allow-update { none; };
};
Then, /var/named/testedu.db:
$TTL 3600
$ORIGIN test.edu.
@ IN SOA dns3.test.edu. isdept.test.edu. (
20150413 ;Serial
10800 ; Refresh after 6 hours
3600 ;Retry
604800 ;Expire
3600 ;TTL
)
;NS Records
IN NS dns3.test.edu.
;mail records
IN MX 5 mail.test.edu.
;Host A records
dns2 IN A 50.19.235.118
dns1 IN A 100.100.219.12
dns3 IN A 52.5.59.8
www IN A 100.100.219.21
test.edu. IN A 100.100.219.21
mail IN A 100.100.219.6
facultyportal IN A 100.100.219.4
So, named-checkconf /etc/bind/named.conf.options
returns nothing, so no errors there.
And named-checkzone test.edu /var/named/testedu.db
returns that it loaded the serial and is OK.
If I run: netstat -an | grep ^udp | grep 53
, I get:
udp 0 0 172.30.1.115:53 0.0.0.0:*
udp 0 0 127.0.0.1:53 0.0.0.0:*
udp6 0 0 :::53 :::*
Which seems right - and shows that BIND is running.
But - when I run nslookup, I get SERVFAIL on any record that this server should be able to return:
user@dns3:/var/named$ nslookup
> server localhost
Default server: localhost
Address: 127.0.0.1#53
> facultyportal.test.edu
Server: localhost
Address: 127.0.0.1#53
** server can't find facultyportal.nwcu.edu: SERVFAIL
Output of named-checkconf -zj:
zone test.edu/IN: loaded serial 20150413
zone stead/IN: loaded serial 1
zone localhost/IN: loaded serial 2
zone 127.in-addr.arpa/IN: loaded serial 1
zone 0.in-addr.arpa/IN: loaded serial 1
zone 255.in-addr.arpa/IN: loaded serial 1
(the stead zone is one that I added as a testing measure. It appears that localhost CAN resolve entries from there)
Is there something I'm missing? Thank you!