1

We have hard times setting up a DNS Zone Delegation for one of our subdomains.

We have one DNS record "_acme-challenge" that will change frequently, and this DNS record is defined directly on our server, which acts as a SECONDARY Name Server only for this record.

Our need is to have this record delegated to our SECONDARY Name Server, instead of having to change it manually in our MAIN DNS zone.

Please note that our SECONDARY Name Server is the same domain "example.com".

Our domain name is registered at OVH : example.com

Our MAIN DNS Servers are at OVH :

  • ns15.ovh.net
  • dns15.ovh.net

Our example.com content is hosted on a web server (not on OVH) having the following IP : 212.123.456.789

We do not have any problem with this DNS zone : our domain and emails are working correctly.

Our MAIN DNS zone is defined at OVH like this (shortened for brevity) :

$TTL 3600
@   IN SOA dns15.ovh.net. tech.ovh.net. (2019111705 86400 3600 3600000 300)
                       IN NS     ns15.ovh.net.
                       IN NS     dns15.ovh.net.
                       IN A      212.123.456.789
ftp                    IN CNAME  example.com.
mail                   IN A      212.123.456.789
www                    IN CNAME  example.com.

Our second DNS Server have these always existing records :

example.com.            NS      ns1.example.com.
ns1.example.com.        A       212.123.456.789
example.com.            NS      ns2.example.com.
ns2.example.com.        A       212.123.456.789

Our second DNS Server will regularly update the following record in its zone :

_acme-challenge.example.com     TXT     HereIsTheTextContent

We tried to add the following records to our MAIN DNS zone at OVH, in order to delegate this record to the SECONDARY Name Server, but had no success : _acme-challenge.example.com does not ping at all.

ns1                    IN A      212.123.456.789
ns2                    IN A      212.123.456.789
_acme-challenge        IN NS     ns1.example.com.
_acme-challenge        IN NS     ns2.example.com.

We guessed that some kind of records are missing, but where ?

  • Did we forget to add some records to ou MAIN DNS zone ? (defined at OVH)
  • Did we forget to add some records to ou SECONDARY DNS zone ? (defined on our "example.com" hosted on our server)

I would be happy if you could pinpoint the error, and give us a clue to make it work :-)

Thanks

Patrick Mevzek
  • 9,273
  • 7
  • 29
  • 42
AlexLaforge
  • 206
  • 1
  • 12
  • Why is your secondary name server not identical to your primary? This is typically done by AXFR/IFXR zone transfers without any manual intervention when setup properly. Any why would your secondary nameservers have different NS records than your primary? – Ryan Bolger Nov 17 '19 at 18:35
  • Can you please clarify what you're trying to do, it sounds to me as if you're not trying to set up a secondary name server at all but a primary nameserver for a subdomain. See, e.g., [this article](https://networkencyclopedia.com/secondary-name-server/) to clarify what a secondary name server is. – Harry Johnston Nov 17 '19 at 18:55
  • ... were you already using this server to provide an alternative source of DNS service before wanting to add the `_acme-challenge` record? – Harry Johnston Nov 17 '19 at 18:58
  • Also, could you clarify what you mean by "does not ping at all" please? Since `_acme-challenge` is a text record, pinging it won't work, you would need an A record for that. – Harry Johnston Nov 17 '19 at 20:21
  • You do not need to delegate `_acme-challenge` just to add a TXT record. Also secondary/primary is on a zone base, not a record base. Delegating a zone to a set of nameservers is not the same as setting a primary/secondary link for synchronization and load balancing. – Patrick Mevzek Nov 18 '19 at 23:04

1 Answers1

0

Thank you for your comments ! Here a re some answers, and the solution.

TL;DR : The initial DNS configuration posted in my question is fully functional. We were unduly thinking it was not functional because we forgot that TXT records cannot be pinged ! (Shame on us)

Detailed explanations and answers :

  • @Ryan Bolger : What we call our "MAIN DNS server" : ns15.ovh.net AND dns15.ovh.net. They are managed by a machine hosted on OVH.
  • @Ryan Bolger : What we call our "SECONDARY DNS server" : ns1.example.com AND ns2.example.com. They are managed by a machine hosted on our own infrastructure. The correct term for this seems to be "a subdelegate DNS zone".
  • @Ryan Bolger : These MAIN and SECONDARY Name Servers have different names because they are not managed by the same machine.
  • @Ryan Bolger : We did not choose to use AXFR/IFXR zone transfers without any manual intervention, because our knowledge to set them up properly is not enough.
  • @Harry Johnston : Yes, what we are trying to achieve is to set up a primary nameserver for a subdomain. This one is called our "SECONDARY DNS server". Sorry for the confusion and wording !
  • @Harry Johnston : No, we wera not using this "SECONDARY DNS server" before. We are only using it to contain, and supply the _acme-challenge record
  • @Harry Johnston : Sorry when we said that the _acme-challenge record "does not ping at all" : You are right, and we made a mistake, forgetting that TXT records cannot be pinged ! (Shame on us again)

So to wrap up all info about the current situation :

=> The _acme-challenge TXT record is defined on our "SECONDARY DNS server" (AKA. our subdelegate DNS Zone) (which, in fact, acts as a Primary Name Server as noted by @Harry Johnston). More information about this technique can be found in the Use a "Throwaway" Validation Domain section of this article : https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation

=> Our "MAIN DNS server", hosted at OVH, have the following zone :

$TTL 3600
@   IN SOA dns15.ovh.net. tech.ovh.net. (2019111705 86400 3600 3600000 300)
                       IN NS        ns15.ovh.net.
                       IN NS        dns15.ovh.net.
                       IN A         212.123.456.789
ftp                    IN CNAME     example.com.
mail                   IN A         212.123.456.789
www                    IN CNAME     example.com.
ns1                    IN A         212.123.456.789
ns2                    IN A         212.123.456.789
_acme-challenge        IN NS        ns1.example.com.
_acme-challenge        IN NS        ns2.example.com.

=> Our "SECONDARY DNS server", hosted on our own infrastructure, have the following zone, with a regularly changing _acme-challenge TXT record :

HOST                                Record Type         Value
example.com.                        NS                  ns1.example.com.
ns1.example.com.                    A                   212.123.456.789
example.com.                        NS                  ns2.example.com.
ns2.example.com.                    A                   212.123.456.789
_acme-challenge.example.com.        TXT                 k9ieQiTudAC7XydqdG7UIOtJn0PPC4brDK7e_zOC-7m

The conclusion is that it's working :

  • The _acme-challenge TXT record is correctly retrieved from our "SECONDARY DNS server", meaning that the zone delegation for the _acme-challenge subdomain is operational.

We do not see any error in this configuration : can you all confirm ?

AlexLaforge
  • 206
  • 1
  • 12
  • " is defined on our "SECONDARY DNS server" (AKA. our subdelegate DNS Zone)" No, you are mixing two concepts that are unrelated (except that they apply to the DNS), please do not reinvert terms. Look at https://tools.ietf.org/html/rfc8499 and how secondary or delegation are defined there. – Patrick Mevzek Nov 18 '19 at 23:09
  • `212.123.456.789` is not an IPv4 address, please do not obfuscate so badly. You can use guidance from RFC 5737 if you really need to hide IP addresses. TL;DR: use `192.0.2.0/24` – Patrick Mevzek Nov 18 '19 at 23:10
  • 2
    " forgetting that TXT records cannot be pinged ! " In every cases, to debug DNS problems, `ping` is NEVER the tool to use. You should use `dig` or at least `nslookup`. These tools do DNS queries which is what you need to debug DNS problems. `ping` is not a tool for that. – Patrick Mevzek Nov 18 '19 at 23:11
  • Yes @Patrick Mevzek, I used `dig` to check that this TXT record is correctly retrieved. Sorry again (3rd time) for that mistake. – AlexLaforge Nov 19 '19 at 10:10