Questions[nsd](server)

I'm trying to create a master/slave setup using NSD. I have NSD installed on two servers. The servers are running great; when I perform normal DNS queries they return the information from the zone files. However, when I try to nsdc notify on the master, the slave doesn't seem to pick up the new zone configuration.

The nsd.conf file on the master looks like this:

## NSD authoritative only DNS
#

server:
    logfile: "/var/log/nsd.log"
    port: 53
    server-count: 1
    ip4-only: yes
    hide-version: yes
    identity: ""
    zonesdir: "/etc/nsd3"
    verbosity: 3

zone:
    name: domain.com
    zonefile: www.domain.com.forward
    notify: <ip slave> NOKEY
    provide-xfr: <ip slave> NOKEY

nsd.conf on the slave server looks like:

## NSD authoritative only DNS
#

server:
    logfile: "/var/log/nsd.log"
    port: 53
    server-count: 1
    ip4-only: yes
    hide-version: yes
    identity: ""
    zonesdir: "/etc/nsd3"
    verbosity: 3

zone:
    name: domain.com
    zonefile: www.domain.com.forward
    allow-notify: <ip master> NOKEY
    request-xfr: AXFR <ip master> NOKEY

The zonefile file looks like this on the master server:

$ORIGIN domain.com.
$TTL 86400           ; default time to live

@ IN SOA ns1.domain.com. admin.domain.com. (
    2011010203  ; serial number
    28800       ; Refresh
    7200        ; Retry
    864000      ; Expire
    86400       ; Min TTL
    )

NS  ns1.domain.com.
MX  10  mailfilter.hostingprovider.com.

mail    IN  A   <ip mailserver hostingprovider>
www IN  A   <ip master>

ns1     IN      A       <ip master>
ns2     IN      A       <ip slave>


newvalue    IN  A   8.8.8.8

*   IN  A   <ip master>

The forward file is the same on the slave server, except for the line with "newvalue" (the value I want to transfer).

If I perform a nsdc notify on the master server, the following ends up in the slave's logs:

[1487507948] nsd[26038]: info: Notify received and accepted, forward to xfrd
[1487507948] nsd[26037]: info: Handle incoming notify for zone domain.com

However, the zone files don't seem to get updates. After the notify, I perform nsdc patch; nsdc rebuild; nsdc reload; service nsd3 restart on the slave server, just to be sure. But this doesn't change the zone files either.

Also, if I perform a dig axfr @<master ip> domain.com on the slave server, I get a nice zone transfer.

Why isn't the slave server updating the zone files?

I am trying to configure NSD and Unbound to handle Internal DNS.

I have everything working for forward look ups but reverse looks ups are failing.

I am not sure what to do next, but looking at the dig (reverse) response, it has something to do with my specification of the reverse zone.

"10.in-addr.arpa" vs "57.142.10.in-addr.arpa"

please see the dig output and configuration files below

Dig forward(working):

dig pc01.example.com.au

; <<>> DiG 9.8.3-P1 <<>> pc01.example.com.au
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2821
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;pc01.example.com.au.         IN      A

;; ANSWER SECTION:
pc01.example.com.au. 79883    IN      A       10.142.57.50

;; AUTHORITY SECTION:
example.com.au.       79755   IN      NS      ns1.example.com.au.

;; ADDITIONAL SECTION:
ns1.example.com.au.   79755   IN      A       10.142.57.1

;; Query time: 0 msec
;; SERVER: 10.142.57.1#53(10.142.57.1)
;; WHEN: Tue Nov  1 12:36:38 2016
;; MSG SIZE  rcvd: 91

Dig reverse(not working):

dig -x 10.142.57.50

; <<>> DiG 9.8.3-P1 <<>> -x 10.142.57.50
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 24368
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;50.57.142.10.in-addr.arpa.     IN      PTR

;; AUTHORITY SECTION:
10.in-addr.arpa.        10800   IN      SOA     localhost. nobody.invalid. 1 3600 1200 604800 10800

;; Query time: 1 msec
;; SERVER: 10.142.57.1#53(10.142.57.1)
;; WHEN: Tue Nov  1 12:38:25 2016
;; MSG SIZE  rcvd: 102

unbound.conf:

server:
        interface: 10.142.57.1
        interface: 127.0.0.1

        access-control: 0.0.0.0/0 refuse
        access-control: 10.142.57.0/24 allow
        access-control: 127.0.0.0/8 allow

        do-not-query-localhost: no
        hide-identity: yes
        hide-version: yes
        do-ip6: no

        auto-trust-anchor-file: "/var/unbound/etc/root.key"
        root-hints: "/var/unbound/etc/named.cache"

        local-zone: "57.142.10.in-addr.arpa." nodefault

        verbosity: 1

remote-control:
        control-enable: yes
        control-interface: 127.0.0.1

stub-zone:
        name: "example.com.au"
        stub-addr: 127.0.0.1@8053

stub-zone:
        name: "57.142.10.in-addr.arpa."
        stub-addr: 127.0.0.1@8053

nsd.conf:

server:

    server-count: 1 # use this number of cpu cores
    database: "/var/nsd/db/nsd.db"
    zonelistfile: "/var/nsd/db/zone.list"
    username: _nsd
    logfile: "/var/log/nsd.log"
    pidfile: "/var/nsd/run/nsd.pid"
    xfrdfile: "/var/nsd/run/xfrd.state"
    ip-address: 127.0.0.1
    port: 8053

remote-control:
    control-enable: yes

zone:
    name: example.com.au
    zonefile: example.com.au.forward

zone:
    name: 57.142.10.in-addr.arpa
    zonefile: example.com.au.reverse

example.com.au.forward:

$ORIGIN example.com.au.
$TTL 86400
;
@ IN SOA ns1.example.com.au. example.com.au. (
           2016110102  ; serial number
           28800       ; Refresh
           7200        ; Retry
           864000      ; Expire
           86400       ; Min TTL
           )
           IN     NS   ns1.example.com.au.
;
ns1      IN     A    10.142.57.1
pc01     IN     A    10.142.57.50
pc02     IN     A    10.142.57.51
server01 IN     A    10.142.57.254

example.com.au.reverse:

$ORIGIN 57.142.10.in-addr.arpa.
$TTL 86400
;
@ IN SOA ns1.example.com.au. admin.example.com.au. (
           2016110102  ; serial number
           28800       ; Refresh
           7200        ; Retry
           864000      ; Expire
           86400       ; Min TTL
           )
    IN NS ns1.example.com.au.
;
1   PTR ns1.example.com.au.
50  PTR pc01.example.com.au.
51  PTR pc02.example.com.au.
254 PTR server01.example.com.au.

My problem is this.

Dissatisfied with the existing free DNS nameserver solutions, I decided to make my own nameservers for my websites. I'm using NSD on Debian, and it's working great. I can request a record from the server with DIG and get the correct response and all that jazz.

However, there's a catch that I can't figure out how to circumvent. In order to give my nameservers to my domain registrar, they need A records. (ns1.example.com etc.)

Here's the issue: Since I'm having these servers handle the DNS for all of my domains, I'm not sure how to create A records for the servers themselves. If I create the ns1, ns2 records inside my own server, my registrar won't be able to look them up. But in order to create those records externally so I can point a registrar to my servers, I need to register those A records with an external source, right?

How can I bootstrap the A records for my nameservers so my registrar can see them long enough to plug in? Or am I misunderstanding the problem entirely?

I hope that made a bit of sense.

I have this directory structure:

\etc\nsd3
   |- nsd3.conf
   |- zones
   |   |- zonefile.com.zone
   |   |- zonefile2.com.zone

Currently I have to add an entry into nsd3.conf for each zonefile I wish to source to provide DNS for.

Is there a way to have nsd3 source all the zonefiles in the zones/ directory?

Thanks -vox

I have server with NSD. There are MAIN_IP and ADD_IP. When I try to get IP of my site from server I have right output

dig @localhost my_site.com

But when I try to make this from my PC, I have

dig @my_ns_server.com my_site.com
;; reply from unexpected source: MAIN_IP#53, expected ADD_IP#53

(ADD_IP is IP of my_ns_server.com)

What should I do?

UPD: My interfaces conf

auto eth2
allow-hotplug eth2
iface eth2 inet static
        address xxx.xxx.xxx.234
        netmask 255.255.255.252
        network xxx.xxx.xxx.232
        broadcast xxx.xxx.xxx.235
        gateway xxx.xxx.xxx.233
        dns-nameservers MY_ISP_IP
        dns-search MY_ISP_DOMAIN

auto eth2:0
iface eth2:0 inet static
  address xxx.xxx.xxx.124
  netmask 255.255.255.0

xxx.xxx.xxx is the same for all IPs

netstat -lntpu | grep :53

tcp        0      0 0.0.0.0:53              0.0.0.0:*               LISTEN      1363/nsd        
tcp6       0      0 :::53                   :::*                    LISTEN      1363/nsd        
udp        0      0 0.0.0.0:53              0.0.0.0:*                           1363/nsd        
udp6       0      0 :::53                   :::*                                1363/nsd