0

Today the master dns server of an internal network subdomain failed and the slave server cannot find names in the replicated zone

Querying the server

nslookup ns1.sis.trt 10.3.190.61
Server:     10.3.190.61
Address:    10.3.190.61#53

** server can't find ns1.sis.trt: NXDOMAIN

nslookup gitlab.sis.trt 10.3.190.61
Server:     10.3.190.61
Address:    10.3.190.61#53

** server can't find gitlab.sis.trt: NXDOMAIN

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.68.rc1.el6_10.1 <<>> @10.3.190.61 gitlab.sis.trt
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 1832
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;gitlab.sis.trt.            IN  A

;; Query time: 0 msec
;; SERVER: 10.3.190.61#53(10.3.190.61)
;; WHEN: Thu Dec 19 09:33:22 2019
;; MSG SIZE  rcvd: 32

My bind9 slave configurations

/etc/named.conf

options {
        listen-on port 53 { any; };
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        allow-query     { any; };
        allow-transfer { none; };
        recursion yes;
        dnssec-validation no;

        /* Path to ISC DLV key */
        bindkeys-file "/etc/named.iscdlv.key";
        managed-keys-directory "/var/named/dynamic";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "." IN {
        type hint;
        file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

zone "sis.trt" {
    type slave;
    file "/etc/named/zones/db.sis.trt";
    masters { 10.3.190.60; };
};

zone "3.10.in-add.arpa" {
    type slave;
    file "/etc/named/zones/db.10.3";
    masters { 10.3.190.60; };
};

/etc/named/zones/db.sis.trt

ORIGIN .
$TTL 3600       ; 1 hour
sis.trt                 IN SOA  ns1.sis.trt. soa.sis.trt. (
                                2019121101 ; serial
                                600        ; refresh (10 minutes)
                                300        ; retry (5 minutes)
                                3600       ; expire (1 hour)
                                3600       ; minimum (1 hour)
                                )
                        NS      ns1.sis.trt.
                        NS      ns2.sis.trt.
$ORIGIN sis.trt.
gitlab                  A       10.3.190.62
ns1                     A       10.3.190.60
ns2                     A       10.3.190.61

/etc/named/zones/db.10.3

$ORIGIN .
$TTL 3600       ; 1 hour
3.10.in-add.arpa        IN SOA  ns1.sis.trt. admin.sys.trt. (
                                2019112001 ; serial
                                600        ; refresh (10 minutes)
                                300        ; retry (5 minutes)
                                3600       ; expire (1 hour)
                                3600       ; minimum (1 hour)
                                )
                        NS      ns1.sis.trt.
                        NS      ns2.sis.trt.
$ORIGIN 190.3.10.in-add.arpa.
60                      PTR     ns1.sis.trt.
61                      PTR     ns2.sis.trt.
62                      PTR     gitlab.sis.trt.

My master dns configuration

The master is offline so I can't post any information. I'll add this information as soon as I have the server back. But it's a slave problem and the synchronized files are ok (as I remember the server zone files).

Zandao
  • 103
  • 3
  • How long was the master offline? You have an '_expire_' value of only 1 hour in your `SOA` record. This means the slave will stop answering requests quite fast. – Piotr P. Karwasz Dec 19 '19 at 19:06
  • Yes, only 1 hour, since it was still in testing, but the slave should be responding to queries correctly – Zandao Dec 19 '19 at 23:27
  • So you tried within 1 hour from the disconnection of the master? `dig` gave you a `SERVFAIL`. – Piotr P. Karwasz Dec 20 '19 at 05:35
  • Unrelated to your problem, but DLV is now obsolete, you should not have configuration parameters for it. Also you should not use fake internal TLDs like `trtz or any other name, this will only lead to problems later on. – Patrick Mevzek Dec 20 '19 at 10:08

0 Answers0