samba - Jun 2015 - IPv6 DNS Confusion

I am using Samba 4.2.2 with Internal DNS.

I haven't deliberately set up IPv6, but I know our ISP allocates us a 64
block and auto-configuration seems to be doing the rest. Generally machines seem
to be able to ping using IPv6 and Windows seems to be using that by default.

But looking in DNS there seem to be around 100 IPv6 addresses showing for the
domain controller server, which surely cannot be healthy? And hundreds more with
the hostname "(same as parent folder)".

Is this normal or is there something I should be doing to correct this?

Thanks,

Chris.

Hi Chris,

This sounds like a bug and a configuration issue ;-) .

You are correct your domain controller IPv6 address should not change.

Is your /64 a static prefix that does not change with time? If it is, 
then this probably means that you have temporary addresses configured on 
your DC. Either scenarios are likely to cause a DNS update and add new 
records. The old records should be deleted first. However, there are 
issues with DDNS in the Samba Internal DNS server. This could be the 
reason that they are not being deleted and old records remain in in DNS. 
This is a bad thing. It is likely that this will not be a problem if you 
were using BIND.

There are some IPv6/DNS related patches coming up but I suspect that 
they might not fix this problem.

In the first instance, I would make sure that you have static addresses 
on your DC and manually remove the old addresses.

Be aware then when deleting IPv6 addresses in DNS using the samba-tool 
you cannot use the canonical form of the IPv6 address, you must write it 
out in full. See my presentation from Samba XP 2015 at 
http://www.ipv6consultancy.com/ipv6blog/?p=100.

I am out of the office for a while but when I get back I will take a 
look at this.

Best Regards,
David
------------------------------------------------------------------------
Dr David Holder CEng FIET MIEEE

Erion Ltd, An Cala, Inverkirkaig, Lochinver, Sutherland, IV27 4LR, UK

Reception: +44 (0)1422 207000

Direct Dial: +44 (0)131 2026317

http://www.erion.co.uk


Registered in England and Wales. Registered Number 3521142
Registered Office: Newtons, 49 Coniscliffe Road, Darlington, County 
Durham, DL3 7EH, UK
VAT Number: GB 698 3633 78

On 20/06/2015 15:33, Christopher Roberts wrote:
> I am using Samba 4.2.2 with Internal DNS.
>
> I haven't deliberately set up IPv6, but I know our ISP allocates us a
64 block and auto-configuration seems to be doing the rest. Generally machines
seem to be able to ping using IPv6 and Windows seems to be using that by
default.
>
> But looking in DNS there seem to be around 100 IPv6 addresses showing for
the domain controller server, which surely cannot be healthy? And hundreds more
with the hostname "(same as parent folder)".
>
> Is this normal or is there something I should be doing to correct this?
>
> Thanks,
>
> Chris.

David

Thank you so much for your reply and my apologies for the lack of an
acknowledgment, whilst I made the necessary changes.
> Is your /64 a static prefix that does not change with time?
Yes.
> If it is, 
> then this probably means that you have temporary addresses configured 
> on your DC. Either scenarios are likely to cause a DNS update and add 
> new records. The old records should be deleted first. However, there 
> are issues with DDNS in the Samba Internal DNS server. This could be 
> the reason that they are not being deleted and old records remain in in
DNS.
> This is a bad thing. It is likely that this will not be a problem if 
> you were using BIND.
So would you recommend moving over to BIND?
> In the first instance, I would make sure that you have static 
> addresses on your DC and manually remove the old addresses.
Okay, that's done.
> Be aware then when deleting IPv6 addresses in DNS using the samba-tool 
> you cannot use the canonical form of the IPv6 address, you must write 
> it out in full. See my presentation from Samba XP 2015 at 
> http://www.ipv6consultancy.com/ipv6blog/?p=100.
I used the Windows MMC DNS snap in, and deleted all the relevant records in
one hit. Seems to have worked, at least no obvious issues so far and I seem
to be pinging happily via ipv6 now.

Thank you so much for your help.

Kind regards,

Chris.