[CentOS] DNS configuration problem

James B. Byrne
Mon, 09 May 2005 20:13:46 -0000

I have introduced some error in my dns resolution and I would like
some help fixing it as I cannot seem to detect what I have done
wrong.  Briefly the setup is this:

name servers:
DNS01	- 216.185.71.33
DNS02	- 209.47.176.33
DNS03	- 216.185.71.34
DNS04	- 209.47.176.34 - offline

DNS01 is a master
DNS02-04 are slaves of 216.185.71.33

All are listed as authoritative for the zone test.com

The following tests are run from a caching name server configured
to forward queries as follows:

/etc/resolv.conf
search hamilton.harte-lyne.ca harte-lyne.ca harte-lyne.com
halisp.net
nameserver 0.0.0.0
nameserver 216.185.71.33
nameserver 209.47.176.33


Extract from /etc/named.conf
...
        forwarders {
                216.185.71.33;
                209.47.176.33;
                216.185.71.34;
                209.47.176.34;
                };
        forward first;
        };
...

The intent of our setup is that if any server goes offline then the
remaining servers will continue to answer queries.  To further
protect against outages DNS02 and DNS04 (currently offline) are on
a separate netblock at a physically remote location. However, this
is not what appears to happen when I test it.  This are the results
that I get when DNS01-03 are all online together.

# dig @a.root-servers.net pop3.test.com +trace

; <<>> DiG 9.2.1 <<>> @a.root-servers.net pop3.test.com
+trace
;; global options:  printcmd
.                       518400  IN      NS      C.ROOT-SERVERS.NET.
.                       518400  IN      NS      G.ROOT-SERVERS.NET.
.                       518400  IN      NS      F.ROOT-SERVERS.NET.
.                       518400  IN      NS      B.ROOT-SERVERS.NET.
.                       518400  IN      NS      J.ROOT-SERVERS.NET.
.                       518400  IN      NS      K.ROOT-SERVERS.NET.
.                       518400  IN      NS      L.ROOT-SERVERS.NET.
.                       518400  IN      NS      M.ROOT-SERVERS.NET.
.                       518400  IN      NS      I.ROOT-SERVERS.NET.
.                       518400  IN      NS      E.ROOT-SERVERS.NET.
.                       518400  IN      NS      D.ROOT-SERVERS.NET.
.                       518400  IN      NS      A.ROOT-SERVERS.NET.
.                       518400  IN      NS      H.ROOT-SERVERS.NET.
;; Received 436 bytes from 198.41.0.4#53(a.root-servers.net) in 750
ms

com.                    172800  IN      NS      A.GTLD-SERVERS.NET.
com.                    172800  IN      NS      B.GTLD-SERVERS.NET.
com.                    172800  IN      NS      C.GTLD-SERVERS.NET.
com.                    172800  IN      NS      D.GTLD-SERVERS.NET.
com.                    172800  IN      NS      E.GTLD-SERVERS.NET.
com.                    172800  IN      NS      F.GTLD-SERVERS.NET.
com.                    172800  IN      NS      G.GTLD-SERVERS.NET.
com.                    172800  IN      NS      H.GTLD-SERVERS.NET.
com.                    172800  IN      NS      I.GTLD-SERVERS.NET.
com.                    172800  IN      NS      J.GTLD-SERVERS.NET.
com.                    172800  IN      NS      K.GTLD-SERVERS.NET.
com.                    172800  IN      NS      L.GTLD-SERVERS.NET.
com.                    172800  IN      NS      M.GTLD-SERVERS.NET.
;; Received 506 bytes from 192.33.4.12#53(C.ROOT-SERVERS.NET) in 38
ms

test.com.            172800  IN      NS      dns01.harte-lyne.ca.
test.com.            172800  IN      NS      dns02.harte-lyne.ca.
test.com.            172800  IN      NS      dns03.harte-lyne.ca.
;; Received 107 bytes from 192.5.6.30#53(A.GTLD-SERVERS.NET) in 41
ms

pop3.test.com.          38400   IN      CNAME   imap.test.com.
imap.test.com.          38400   IN      CNAME   imap.halisp.net.
imap.halisp.net.        38400   IN      CNAME   imap-07.halisp.net.
imap-07.halisp.net.     38400   IN      CNAME   imap-07.harte-
lyne.ca.
imap-07.harte-lyne.ca.  86400   IN      CNAME
inet07.hamilton.harte-lyne.ca.
inet07.hamilton.harte-lyne.ca. 86400 IN A       216.185.71.27
harte-lyne.ca.          86400   IN      NS      dns01.harte-
lyne.ca.
harte-lyne.ca.          86400   IN      NS      dns02.harte-
lyne.ca.
harte-lyne.ca.          86400   IN      NS      dns03.harte-
lyne.ca.
harte-lyne.ca.          86400   IN      NS      dns04.harte-
lyne.ca.
;; Received 329 bytes from 216.185.71.33#53(dns01.harte-lyne.ca) in
2 ms


However, if named on DNS01 is stopped and left running on DNS02 and
DNS03 then this happens:

]# dig @a.root-servers.net pop3.test.com +trace

; <<>> DiG 9.2.1 <<>> @a.root-servers.net pop3.test.com
+trace
;; global options:  printcmd
.                       518400  IN      NS      I.ROOT-SERVERS.NET.
.                       518400  IN      NS      E.ROOT-SERVERS.NET.
.                       518400  IN      NS      D.ROOT-SERVERS.NET.
.                       518400  IN      NS      A.ROOT-SERVERS.NET.
.                       518400  IN      NS      H.ROOT-SERVERS.NET.
.                       518400  IN      NS      C.ROOT-SERVERS.NET.
.                       518400  IN      NS      G.ROOT-SERVERS.NET.
.                       518400  IN      NS      F.ROOT-SERVERS.NET.
.                       518400  IN      NS      B.ROOT-SERVERS.NET.
.                       518400  IN      NS      J.ROOT-SERVERS.NET.
.                       518400  IN      NS      K.ROOT-SERVERS.NET.
.                       518400  IN      NS      L.ROOT-SERVERS.NET.
.                       518400  IN      NS      M.ROOT-SERVERS.NET.
;; Received 436 bytes from 198.41.0.4#53(a.root-servers.net) in 37
ms

dig: Couldn't find server 'I.ROOT-SERVERS.NET': Name or service not
known


So. The question is, what am I doing wrong?  It has to be something
simple but I cannot see it for the life of me.

Any and all help greatly appreciated.

Jim


--
     *** e-mail is not a secure channel ***
mailto:byrnejb.<token>@harte-lyne.ca
James B. Byrne                Harte & Lyne Limited
vox: +1 905 561 1241          9 Brockley Drive
fax: +1 905 561 0757          Hamilton, Ontario