Anyone had all zones mysteriously removed on cPanel dns only?

MediaServe

Well-Known Member
PartnerNOC
Apr 9, 2004
140
4
168
Dallas, Texas
cPanel Access Level
DataCenter Provider
Had a case this morning where our dns servers had *all* zones removed. We're running cPanel dns only. I see no evidence (yet) of tampering, and /var/log/messages shows a bunch of these entries:

Jun 5 11:39:30 D043B7C9 named[21625]: zone abc.xyz/IN/internal: (master) removed

Every last zone was gone. It was relatively easy to re-sync everything but I wonder if anyone else has seen anything like this?
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,908
2,216
463
Hello,

Were the zones only removed from the DNS-Only server, or were they also removed from the hosting servers syncing their zones to the DNS-Only server?

Thank you.
 

MediaServe

Well-Known Member
PartnerNOC
Apr 9, 2004
140
4
168
Dallas, Texas
cPanel Access Level
DataCenter Provider
Hello,

Were the zones only removed from the DNS-Only server, or were they also removed from the hosting servers syncing their zones to the DNS-Only server?

Thank you.
Only the zones on our 2 cPanel dns only servers were deleted (and every last one of them!). Zones on all the full cPanel servers were untouched. Each server is in a dns cluster as write-only to the two dns servers, and then the two dns servers sync between themselves as well.

I have a script that grabs all the currently hosted domains per server and does a dnscluster synczone on each of them, which I used to quickly resolve the problem.
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,908
2,216
463
Hello,

Feel free to open a support ticket using the link in my signature so we can take a closer look. You can post the ticket number here so we can update this thread with the outcome.

Thank you.