DNS Failed after Updates

[Techno]

Good day,

After automated updates our DNS is not resolving to domains.
All systems check. We resolved many issues however when monitoring access
(named -u named -g) We are receiving
client 205.188.158.202#22002: view external: query domain.com/AAAA/IN' denied


We've rebuilt the DNS Server Re-Structured everything, but will not resolve IP's.

When Tracing, Name Servers resolve externally and when performing dig domain.com @localhost all reports back perfectly..

For some reason all domains are being denied, any thoughts.

Thanks

 

[viraj]

Hi,

Try changing the following in /etc/named.conf

From :

view "external"
{
/* This view will contain zones you want to serve only to "external" clients
* that have addresses that are not on your directly attached LAN interface subnets:
*/
match-clients { !localnets; !localhost; };
match-destinations { !localnets; !localhost; };

To:

view "external"
{
/* This view will contain zones you want to serve only to "external" clients
* that have addresses that are not on your directly attached LAN interface subnets:
*/
match-clients { any; };
match-destinations { any; };

Oops.. forgot mention that a named service restart is necessary :D

 

[Techno]

DNS Blues

We have performed your advise however didn't work. So we started over AGAIN

/scripts/fixndc –fv
/scripts/cleandns
/scripts/rebuildnamedconf

Tested
dig ourdomain.com @localhost Response quickly however displays local loop back IP but now not the assigned IP.

Monitoring = named -u named -g
Still with error
view external: query domain.com/AAAA/IN' denied

Every domain on the server can be access via IP (of course) however DNS will not work and denies external queries.

This only happen with AUTOMATIC UPDATES! with our server down for two days Thank God we have several servers that backup our clients...

Any additional help/information would be great to bounce off of...

Thanks

 

[viraj]

Hi,

Can you check if the firewall is active & blocking the access to port 53 ?
You can check this via disabling the firewall temporarily for testing purposes.. Hope that helps

 

[Techno]

Yes we have tested without csf firewall in place and confirmed port activity. the denied service when monitoring the NDS service is the problem..

Thanks for your input.