-2

I have domain registered with godaddy. I had set up custom hostname on godaddy and used same nameservers for the domain. ns1.domain.com and ns2.domain.com (both hostnames are pointing to same ip)

Now I had configured my server with Centos 7 and centos web panel. Below are data of few files which is necessary for setting up DNS. The problem is with DNS that nameserver is not working. Please help me solve this issue. IP: 142.54.176.130 and Domain: getfreereallikes.com

/etc/named.conf:

//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a any DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
// See the BIND Administrator's Reference Manual (ARM) for details about the
// configuration located in /usr/share/doc/bind-{version}/Bv9ARM.html

options {
    listen-on port 53 { any; };
    listen-on-v6 port 53 { ::1; };
    directory   "/var/named";
    dump-file   "/var/named/data/cache_dump.db";
    statistics-file "/var/named/data/named_stats.txt";
    memstatistics-file "/var/named/data/named_mem_stats.txt";
    recursing-file  "/var/named/data/named.recursing";
    secroots-file   "/var/named/data/named.secroots";
    allow-query     { any; };

    /* 
     - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
     - If you are building a RECURSIVE (caching) DNS server, you need to enable 
       recursion. 
     - If your recursive DNS server has a public IP address, you MUST enable access 
       control to limit queries to your legitimate users. Failing to do so will
       cause your server to become part of large scale DNS amplification 
       attacks. Implementing BCP38 within your network would greatly
       reduce such attack surface 
    */
    recursion no;

    dnssec-enable yes;
    dnssec-validation no;

    /* Path to ISC DLV key */
    bindkeys-file "/etc/named.iscdlv.key";

    managed-keys-directory "/var/named/dynamic";

    pid-file "/run/named/named.pid";
    session-keyfile "/run/named/session.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
    type hint;
    file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";


zone "ns1.getfreereallikes.com" {type master;file "/var/named/ns1.getfreereallikes.com.db";};
zone "ns2.getfreereallikes.com" {type master;file "/var/named/ns2.getfreereallikes.com.db";};

/var/named/ns1.getfreereallikes.com.db:

; Panel %version%
; Zone file for ns1.getfreereallikes.com
$TTL 14400
ns1.getfreereallikes.com.      86400      IN      SOA      ns1.getfreereallikes.com.      info.centos-webpanel.com.      (
                    2013071600 ;serial, todays date+todays
                    86400 ;refresh, seconds
                    7200 ;retry, seconds
                    3600000 ;expire, seconds
                    86400 ;minimum, seconds
      )
ns1.getfreereallikes.com. 86400 IN NS ns1.getfreereallikes.com.
ns1.getfreereallikes.com. 86400 IN NS ns2.getfreereallikes.com.
ns1.getfreereallikes.com. 14400 IN A 142.54.176.130

/var/named/getfreereallikes.com.db:

; Generated by CWP
; Zone file for krushimitra.co.in
$TTL 14400
getfreereallikes.com.      86400      IN      SOA      ns1.getfreereallikes.com.      email.gmail.com.      (
                    2019050200 ;serial, todays date+todays
                        86400 ;refresh, seconds
                        7200 ;retry, seconds
                        3600000 ;expire, seconds
                        86400 
      )


getfreereallikes.com.      86400      IN      NS      ns1.getfreereallikes.com.
getfreereallikes.com.      86400      IN      NS      ns2.getfreereallikes.com.
getfreereallikes.com.      0      IN      A      142.54.176.130
localhost.getfreereallikes.com.      0      IN      A      127.0.0.1
getfreereallikes.com.      0      IN      MX      5      getfreereallikes.com.
mail      0      IN      CNAME      getfreereallikes.com.
www      0      IN      CNAME      getfreereallikes.com.
ftp      0      IN      CNAME      getfreereallikes.com.
;      Add      additional            below      this      line
_dmarc      14400      IN      TXT      "v=DMARC1; p=none"
ns1      14400      IN      A      142.54.176.130
ns2      14400      IN      A      142.54.176.130

/etc/resolv.conf:

# Generated by NetworkManager
search getfreereallikes.com
nameserver 127.0.0.1

dig @ 142.54.176.130 www.getfreereallikes.com:

; <<>> DiG 9.9.4-RedHat-9.9.4-73.el7_6 <<>> @142.54.176.130 www.getfreereallikes.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 2624
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.getfreereallikes.com.      IN      A

;; Query time: 0 msec
;; SERVER: 142.54.176.130#53(142.54.176.130)
;; WHEN: Thu May 02 05:56:26 CDT 2019
;; MSG SIZE  rcvd: 53
Patrick Mevzek
  • 9,273
  • 7
  • 29
  • 42
  • Your `/etc/resolv.conf` is mostly irrelevant here. You should indeed as you show always use `dig` with the `@` flag to query a specific nameserver. – Patrick Mevzek May 02 '19 at 19:08
  • Two tools that can be useful also: `named-checkconf` to check your whole configuration, and `named-checkzone` to test a specific zone, and make sure its content is ok. – Patrick Mevzek May 02 '19 at 19:09

1 Answers1

2

You set up an authoritative only name server by disabling recursion with recursion no;

That means that your name server will only respond to queries for the domain names it considers itself authoritative.
That is a good thing!

The only domain names, "zones" in bind jargon, that you declare are:

zone "ns1.getfreereallikes.com" ...
zone "ns2.getfreereallikes.com" ...

Therefor a query for www.getfreereallikes.com will be refused as that is not a domain hosted by your name server.


You probably don't need separate zone files for ns[1-2].getfreereallikes.com and your intended config should probably be:

zone "getfreereallikes.com" {type master;file "/var/named/getfreereallikes.com.db";};
HBruijn
  • 72,524
  • 21
  • 127
  • 192
  • ok lte me try and thanks for your reply – user521817 May 02 '19 at 12:04
  • it's still not working while executing dig @ 142.54.176.130 www.getfreereallikes.com – user521817 May 02 '19 at 12:11
  • ; <<>> DiG 9.9.4-RedHat-9.9.4-73.el7_6 <<>> @142.54.176.130 www.getfreereallikes.com ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 7686 ;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; WARNING: recursion requested but not available ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;www.getfreereallikes.com. IN A ;; Query time: 0 msec ;; SERVER: 142.54.176.130#53(142.54.176.130) ;; WHEN: Thu May 02 07:13:57 CDT 2019 ;; MSG SIZE rcvd: 53 – user521817 May 02 '19 at 12:14
  • @user521817 Please post your updates inside your first post not as comments, with full details (did you change the zonefile path? Did you restart bind? etc.). Also "both hostnames are pointing to same ip" is not a good idea. Are you absolutely sure you need to handle the DNS service for your domain? Why not use a specialized provider for that (either your registrar or a third pary) as it seems you are starting on that and hence playing with production zones is not a good idea, you should try to start learning on local toy zones to understand how the DNS and bind work. – Patrick Mevzek May 02 '19 at 19:06
  • @user521817 Also did you look at your logfile? REFUSED from the nameserver clearly means it will not process the request, based on its current configuration. This should be marked in the logfile with some extra data that could help you. Note that your title is wrong, the nameserver DO reply, just with return code REFUSED. It is different from a server not replying at all (timeout) or a nameserver not reachable (refused connection at the IP level). I edited it. – Patrick Mevzek May 02 '19 at 19:07