I'm running two machines with PowerDNS, one being the master (SQL) and one being the slave (Bind backend).
After I modify a domain and bump the serial, I get this in the log:
Sep 30 22:13:20 localhost pdns[6884]: 1 domain for which we are master needs notifications
Sep 30 22:13:20 localhost pdns[6884]: Queued notification of domain 'netly.io' to 146.185.146.149
Sep 30 22:13:20 localhost pdns[6884]: Queued notification of domain 'netly.io' to 146.185.147.74
Sep 30 22:13:20 localhost pdns[6884]: Received NOTIFY for netly.io from 146.185.146.149 but slave support is disabled in the configuration
Sep 30 22:13:21 localhost pdns[6884]: Received unsuccessful notification report for 'netly.io' from 146.185.146.149:53, rcode: 4
Sep 30 22:13:21 localhost pdns[6884]: Removed from notification list: 'netly.io' to 146.185.146.149:53
Sep 30 22:13:23 localhost pdns[6884]: No master domains need notifications
I understand it's notifying itself (146.185.146.149) because it is set as nameserver, and that those errors can be ignored. It (looks like) notifies the other server (146.185.147.74 or 162.243.29.199) as well.
However, the slave doesn't show anything in the log around that time frame, and when I cat the domain file, I can see the old serial and the subdomain not being updated.
dig @slave-server also shows the old settings.
telling it to reload also doesn't update the bind zone file:
slave-server # pdns_control reload
Ok
slave-server # tail -f /var/log/daemon.log
Sep 30 22:21:28 node-e31401 pdns[2259]: Zone 'netly.io' (/etc/powerdns/bind/netly.io.) needs reloading
Sep 30 22:21:28 node-e31401 pdns[2259]: Zone 'netly.io' (/etc/powerdns/bind/netly.io.) reloaded
However, when I entirely restart PDNS it finally figures out it is outdated and correctly fetches the updated zone:
slave-server # /etc/init.d/pdns restart
[ ok ] Restarting PowerDNS Authoritative Name Server: pdns.
slave-server # tail -f /var/log/daemon.log
Sep 30 22:23:48 node-e31401 pdns[2911]: 2 slave domains need checking, 0 queued for AXFR
Sep 30 22:23:48 node-e31401 pdns[2911]: Received serial number updates for 2 zones, had 0 timeouts
Sep 30 22:23:48 node-e31401 pdns[2911]: Domain netly.io is stale, master serial 2013093004, our serial 2013093003
Sep 30 22:23:48 node-e31401 pdns[2911]: Domain titify.com is fresh (not presigned, no RRSIG check)
Sep 30 22:23:48 node-e31401 pdns[2911]: No master domains need notifications
Sep 30 22:23:48 node-e31401 pdns[2911]: Initiating transfer of 'netly.io' from remote '146.185.146.149'
Sep 30 22:23:48 node-e31401 pdns[2911]: AXFR started for 'netly.io', transaction started
Sep 30 22:23:48 node-e31401 pdns[2911]: Zone 'netly.io' (/etc/powerdns/bind/netly.io.) reloaded
Sep 30 22:23:48 node-e31401 pdns[2911]: AXFR done for 'netly.io', zone committed with serial number 2013093004
Sep 30 22:23:48 node-e31401 pdns[2911]: Done launching threads, ready to distribute questions
What am I missing here? What is causing the master to correctly notify the slave, but the slave not to fetch the new zone?
Edit:
- Slave config: https://static.0x04.com/2013/10/slave.pdns_.txt
- Master config: https://static.0x04.com/2013/10/master.pdns_.txt
tcpdump:
node-fd1d01 ~ # tcpdump -n 'host 146.185.146.149 and port 53'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
09:51:38.042713 IP 146.185.146.149.42478 > 162.243.29.199.53: 61745 notify [b2&3=0x2400] SOA? netly.io. (26)
09:51:41.043323 IP 146.185.146.149.42478 > 162.243.29.199.53: 61745 notify [b2&3=0x2400] SOA? netly.io. (26)
09:51:46.044145 IP 146.185.146.149.42478 > 162.243.29.199.53: 61745 notify [b2&3=0x2400] SOA? netly.io. (26)
09:51:52.049533 IP 146.185.146.149.42478 > 162.243.29.199.53: 59408 notify [b2&3=0x2400] SOA? netly.io. (26)
09:51:55.050715 IP 146.185.146.149.42478 > 162.243.29.199.53: 61745 notify [b2&3=0x2400] SOA? netly.io. (26)
09:51:55.050753 IP 146.185.146.149.42478 > 162.243.29.199.53: 59408 notify [b2&3=0x2400] SOA? netly.io. (26)
09:52:00.053327 IP 146.185.146.149.42478 > 162.243.29.199.53: 59408 notify [b2&3=0x2400] SOA? netly.io. (26)
09:52:09.056321 IP 146.185.146.149.42478 > 162.243.29.199.53: 59408 notify [b2&3=0x2400] SOA? netly.io. (26)
Log doesn't show anything new (latest at 09h48):
node-fd1d01 /etc/powerdns/bind # tail -f /var/log/daemon.log
Oct 2 09:47:59 localhost pdns[2253]: Domain netly.io is fresh (not presigned, no RRSIG check)
Oct 2 09:47:59 localhost pdns[2253]: Domain titify.com is fresh (not presigned, no RRSIG check)
Oct 2 09:47:59 localhost pdns[2253]: No master domains need notifications
Oct 2 09:47:59 localhost pdns[2253]: Done launching threads, ready to distribute questions
Oct 2 09:48:00 localhost ntpd[2144]: Listen normally on 6 tun0 172.17.24.1 UDP 123
Oct 2 09:48:00 localhost ntpd[2144]: Listen normally on 7 tun1 172.17.16.1 UDP 123
Oct 2 09:48:00 localhost ntpd[2144]: peers refreshed
Oct 2 09:48:12 localhost dbus[2093]: [system] Activating service name='org.freedesktop.ConsoleKit' (using servicehelper)
Oct 2 09:48:12 localhost dbus[2093]: [system] Successfully activated service 'org.freedesktop.ConsoleKit'
Oct 2 09:48:59 localhost pdns[2253]: No new unfresh slave domains, 0 queued for AXFR already
But when I cat the zone file (in Bind format) it's not updated.
We were experiencing this and it turns out that the target of the DNS notification message was actually refusing the message.
Notice the "notify Refused" below. Substituted fake server and zone names.
Captured this output on the master with the following:
The problem was port 53 being firewalled from the outside port, but not on the localhost or on the VPN interface. I hadn't noticed because I usually tried
dig @localhost.If I understand correctly, master sends a message to UDP/53 (via Stefan). This was thus partially firewalled and caused the problem.
Master:
Slave:
don't forget to increase your serial. a AXFR notify does nothing if you haven't increased the serial on the master