i have several domains at Strato. I want set up my own external DNS to manage my domains.
To do this at Strato I used the option "Domainverwaltung: NS-Records ändern". I had to provide 2 Nameservers for this configuration. The system accepted my configuration.
I have a primary (master) and a secondary (slave) BIND9 DNS on DEBIAN9.
root@server1:/etc/bind# named -v
BIND 9.10.3-P4-Debian <id:ebd72b3>
The configuration of the MASTER
/etc/bind/named.conf.options
acl trusted {
127.0.0.1;
xxx.xxx.xxx.43; # NS1
xx.xx.xx.107; # NS2
81.169.148.38; # Strato DNS
};
options {
directory "/var/cache/bind";
// If there is a firewall between you and nameservers you want
// to talk to, you may need to fix the firewall to allow multiple
// ports to talk. See http://www.kb.cert.org/vuls/id/800113
// If your ISP provided one or more IP addresses for stable
// nameservers, you probably want to use them as forwarders.
// Uncomment the following block, and insert the addresses replacing
// the all-0's placeholder.
// forwarders {
// 0.0.0.0;
// };
//========================================================================
// If BIND logs error messages about the root key being expired,
// you will need to update your keys. See https://www.isc.org/bind-keys
//========================================================================
dnssec-validation auto;
listen-on port 53 { any; };
recursion no;
allow-query { any; };
auth-nxdomain no; # conform to RFC1035
listen-on-v6 { any; };
allow-notify { trusted; };
allow-transfer { trusted; };
};
/etc/bind/named.conf.local
//
// Do any local configuration here
//
// Consider adding the 1918 zones here, if they are not used in your
// organization
//include "/etc/bind/zones.rfc1918";
zone "my-domain.com" {
type master;
file "/etc/bind/forward.my-domain.com";
allow-transfer { xx.xx.xx.107; };
};
/etc/bind/forward.my-domain.com
$TTL 604800
@ IN SOA primary.my-domain.com. root.primary.my-domain.com. (
6 ; Serial
604820 ; Refresh
86600 ; Retry
2419600 ; Expire
604600 ) ; Negative Cache TTL
;Name Server Information
@ IN NS primary.my-domain.com.
@ IN NS secondary.my-domain.com.
;IP address of Your Domain Name Server(DNS)
primary IN A xxx.xxx.xxx.43
secondary IN A xx.xx.xx.107
;A Record for Host names
@ IN A xxx.xxx.xxx.43
www IN A xxx.xxx.xxx.43
;CNAME Record
ftp IN CNAME www.my-domain.com.
The configuration of the Slave
/etc/bind/named.conf.options
acl trusted {
127.0.0.1;
xxx.xxx.xxx.43; # NS1
xx.xx.xx.107; # NS2
81.169.148.38; # Strato DNS
};
options {
directory "/var/cache/bind";
// If there is a firewall between you and nameservers you want
// to talk to, you may need to fix the firewall to allow multiple
// ports to talk. See http://www.kb.cert.org/vuls/id/800113
// If your ISP provided one or more IP addresses for stable
// nameservers, you probably want to use them as forwarders.
// Uncomment the following block, and insert the addresses replacing
// the all-0's placeholder.
// forwarders {
// 0.0.0.0;
// };
//========================================================================
// If BIND logs error messages about the root key being expired,
// you will need to update your keys. See https://www.isc.org/bind-keys
//========================================================================
dnssec-validation auto;
listen-on port 53 { any; };
recursion no;
allow-query { any; };
auth-nxdomain no; # conform to RFC1035
listen-on-v6 { any; };
allow-notify { trusted; };
allow-transfer { trusted; };
};
/etc/bind/named.conf.local
//
// Do any local configuration here
//
// Consider adding the 1918 zones here, if they are not used in your
// organization
//include "/etc/bind/zones.rfc1918";
zone "my-domain.com" {
type slave;
file "/etc/bind/forward.my-domain.com";
masters { xxx.xxx.xxx.43; };
};
/etc/bind/forward.my-domain.com
$TTL 604800
@ IN SOA primary.my-domain.com. root.primary.my-domain.com. (
6 ; Serial
604820 ; Refresh
86600 ; Retry
2419600 ; Expire
604600 ) ; Negative Cache TTL
;Name Server Information
@ IN NS primary.my-domain.com.
@ IN NS secondary.my-domain.com.
;IP address of Your Domain Name Server(DNS)
primary IN A xxx.xxx.xxx.43
secondary IN A xx.xx.xx.107
;A Record for Host names
@ IN A xxx.xxx.xxx.43
www IN A xxx.xxx.xxx.43
;CNAME Record
ftp IN CNAME www.my-domain.com.
To test this i used:
DIG
~$ dig my-domain.com @xxx.xxx.xxx.43
; <<>> DiG 9.11.3-1ubuntu1.2-Ubuntu <<>> my-domain.com @xxx.xxx.xxx.43
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31536
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3
;; WARNING: recursion requested but not available
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;my-domain.com. IN A
;; ANSWER SECTION:
my-domain.com. 604800 IN A xxx.xxx.xxx.43
;; AUTHORITY SECTION:
my-domain.com. 604800 IN NS secondary.my-domain.com.
my-domain.com. 604800 IN NS primary.my-domain.com.
;; ADDITIONAL SECTION:
primary.my-domain.com. 604800 IN A xxx.xxx.xxx.43
secondary.my-domain.com. 604800 IN A xx.xx.xx.107
;; Query time: 16 msec
;; SERVER: xxx.xxx.xxx.43#53(xxx.xxx.xxx.43)
;; WHEN: Tue Oct 16 14:42:09 CEST 2018
;; MSG SIZE rcvd: 136
And NSLOOKUP:
~$ nslookup my-domain.com xxx.xxx.xxx.43
Server: xxx.xxx.xxx.43
Address: xxx.xxx.xxx.43#53
Name: my-domain.com
Address: xxx.xxx.xxx.43
But without pointing directly to my NS the NS of my provider is answering:
DIG:
~$ dig my-domain.com
; <<>> DiG 9.11.3-1ubuntu1.2-Ubuntu <<>> my-domain.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7286
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;my-domain.com. IN A
;; ANSWER SECTION:
my-domain.com. 69 IN A 81.169.145.157
;; Query time: 0 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Tue Oct 16 14:44:23 CEST 2018
;; MSG SIZE rcvd: 58
NSLOOKUP:
~$ nslookup my-domain.com
Server: 127.0.0.53
Address: 127.0.0.53#53
Non-authoritative answer:
Name: my-domain.com
Address: 81.169.145.157
Name: my-domain.com
Address: 2a01:238:20a:202:1157::
Strato stated: "Please note that due to the decentralized structure of DNS, changes to these settings will not be fully active until 24 hours after activation."
But even after 24h my check does not point to my NS-Server. Is there any test I can perform to find possible problems?
Strato is also pointing out: (sorry automatic translation) Original here.
Set Record (only for Dedicated Servers)
With a secondary name server you can create a backup if the primary name server should fail. This will ensure that the domain will still be reached. Primary and Secondary nameservers are redundant (by the zone transfer all configurations are synchronized concerning the domain), so that the second name server can issue the correct DNS records for the domain, such as A-Record, MX-Record, etc. The zone transfer must be allowed for the IP address of the STRATO Secondary Name Server 81.169.148.38. This IP address is static and therefore does not need to be changed in the future (for BIND, for example via allow-transfer).
When using STRATO Secondary Nameserver, it is not necessary to operate two own name servers. If you allow a zone transfer from your primary name server to sns.serverkompetenz.de, it will get the DNS configurations of the domains you have set up on your primary name server. In case of failure of the primary name server, the domains are still reachable.
In the domain zone, sns.serverkompetenz.de must also be listed as a name server in the NS set.
