dns server recursive lookups bad?

[wptechno]

Hey guys,

I've been working on this and now my named service won't restart. I even put named.conf back to its original state and now it just won't restart.

and now dnsreports is just giving me all kinds of errors. It think the fixes will work if I can get it restarted. Any help would be great.

[AndyReed]

I've been working on this and now my named service won't restart. I even put named.conf back to its original state and now it just won't restart.

and now dnsreports is just giving me all kinds of errors. It think the fixes will work if I can get it restarted. Any help would be great.

It is difficult to say, without looking into your server and see what you did to cause all these problems. sawbuck and Jeff-C gave good info on how to get the recursive feature up and running.

[wptechno]

I used Configuration File Rollback in whm (awesome feature by the way!) and it took some time but everything restarted correctly. Still have the dns issue though, so I'm just going to have someone do it for me. Thanks for your time.

[chirpy]

This has all been covered before

http://forums.cpanel.net/showthread.php?t=15922

[djmerlyn]

I'm just curious with the glorification of code...could something quite simple be missing?

I wonder, why isn't this adequet?

options {
directory "/var/named";
recursion no;
};

I'm not sure what the side effects are just yet, haven't seen any problems or had anything "funky" reported. It causes reports to pass...

This is in a 10 server cluster using 2 servers ns1 on 1 and ns2 on 2...all other servers use these 2 servers for DNS.

Just curious about long term problems? And what exactly is the reason for having all those IP's on the list of allowed rather then simply dis-allowing recursion?

Does a server on the Cpanel cluster really need recursion? It was my impression that the DNS record is served from the main server and so long as everything resolves...we're golden.

I'm just wondering if in all the code in all the threads about this if something blatently simple was passed over, or if I'm going to be facing "montazumas revenge" any moment now...

[djmerlyn]

Wait, I see now...you turn that on and you can't send mail to places like yahoo, aol, msn...

So, back to where we started I suppose... Does this mean that in order to send email out to these places, I also need to allow there IP's recursion? I can't see how adding my own IP's to the allowed list will make these remote sites accessable via email.

Or do these providers need to stop doing recursive lookups on email sent to them...hmm...

Curious...it seems like a wicked loop that anyone can get lost in...

[Jeff-C]

Adding your own server IP's to the recursion-allowed list will allow you to send mail to anywhere as before.

[djmerlyn]

But I was under the impression that these remote mail folks did recursive lookups and if it fails they bounce it?

The reverse DNS thing with AOL stands out at me right up front...

I understand putting in the local IP's will resolve:

unrouteable mail domain "yahoo.com"

But so now that its routable, what is yahoo or AOL going to think about it when looking backwards (in reverse)...

Thanks for helping end the confusion

[widesurf]

Hello,

Could anyone tell me how I actually get into (or open) named.conf ?
I know it's located in the etc/ folder.

I assume you are using SSH/Shell Access in cpanel?
I've tried to enter "vi named.conf", but there are no info displayed.

Could anyone shead some light on this.

Thanks in advance,

Oddvin

[widesurf]

I was Finally able to edit named.conf and After I made
the change dnsreport.com stated PASS on Open DNS servers

However, my server monitoring stated DNS : This test failed!

Here's how my named.conf looked like :


options {
directory "/var/named";
allow-recursion { 127.0.0.1; 69.10.154.129; 69.10.154.130; };
/*
* If there is a firewall between you and nameservers you want
* to talk to, you might need to uncomment the query-source
* directive below. Previous versions of BIND always asked
* questions using port 53, but BIND 8.1 uses an unprivileged
* port by default.
*/
// query-source address * port 53;


Do anyone have any idea what could be wrong ?

Oddvin
DirectNetMarketing.com

[chirpy]

Yes, it would fail. If you want to allow it you would need to add the IP address of your server monitoring service.

[widesurf]

I finally guessed that was the reason and it's good to have it answered here

However, (don't know if this matters), but when restarting DNS server (Named)
it says:

loading configuration from '/etc/named.conf' Apr 23 11:35:06 server named[25341]: no IPv6 interfaces found Apr 23 11:35:06 server named[25341]:

Should I worry


Thanks for your outstanding support on this forum !

Oddvin

[easyhoster1]

I finally guessed that was the reason and it's good to have it answered here

However, (don't know if this matters), but when restarting DNS server (Named)
it says:

loading configuration from '/etc/named.conf' Apr 23 11:35:06 server named[25341]: no IPv6 interfaces found Apr 23 11:35:06 server named[25341]:

Should I worry


Thanks for your outstanding support on this forum !

Oddvin

No, no need to worry, that is for IP version 6 which will someday include six sets of octets numbers 123.345.678.2.3 because IP version 4 is running out of available octets.

[jackie46]

In addition to 127.0.0.1 that line should include all IPs on the server plus other IPs that you want to allow recursion.

ACLs are another way to handle this.
http://www.net.cmu.edu/groups/netdev...9ARM.ch07.html

For instance we use this type of config:
acl "trusted" {
"main server IP";
127.0.0.1;
"name server IP";
"name server IP";
"additional secondary name server IP;
"and so on";

};
options {
directory "/var/named";
version "not currently available";
allow-recursion { trusted; };
allow-notify { trusted; };
allow-transfer { trusted; };
};

From my personal experience, this setup if far from perfect and we have seen far too many issues with this setup. For eg, once this is implamented there will be a noticable increase in the dreaded "UNROUTABLE DOMAIN" issue in the mail logs. We tested one of our servers using this setup and within 2 weeks every single messages being sent to the server was reporting an unroutable issue, obviously DNS releated. Once we restored our backup all the problems went away. So i suggest that if you imlament this modificaiton that you watch your maillog carefully!!!