Here's what I've done...<br><br>I've set up two PowerDNS authoritative servers using an LDAP replicated backend, serving an internal Intranet DNS (outside on the Internet is <a href="http://domain.com">domain.com</a>, inside is <a href="http://inside.domain.com">inside.domain.com</a> for example)<br>
<br>I installed the recursor server on each of the authoritative pdns machines, answering to port 54. I pointed the authoritative servers to recursor=<a href="http://127.0.0.1:54">127.0.0.1:54</a> Each recursor has "local-address=127.0.0.1" and "local-port=54"<br>
<br>The primary server is 192.168.1.4, and the secondary server (running off the ldap replication server) is 192.168.1.251<br><br>Unfortunately I also have a legacy Windows Active Directory domain that I'm in the process of phasing out. I've configured the Windows 2003 AD DNS server to use 192.168.1.4 and 192.168.1.251 for all recursion, since I can't wholesale replace the Windows DNS until those workstations are migrated away.<br>
<br>Here's how my DNS lookups progress:<br>
Linux workstation -> PDNS Authoritative for <a href="http://internal.domain.com">internal.domain.com</a> -> PDNS recursor<br>
Windows workstation - > AD Domain server DNS for
<a href="http://internal.someother.com">internal.someother.com</a> - > PDNS Authoritative for
<a href="http://internal.domain.com">internal.domain.com</a> -> PDNS recursor (temporary hack)<br>This allows the Windows workstations to query their required A/D server
and still get answers on the second internal domain names - the Linux stations really could care less about the Windows DNS names. All
external recursion is handled by pdns-recursor.<br><br>Both pdns servers are configured identically, just pointed to their own machine for the ldap backend.<br><br>From one particular machine on the network, sometimes it will get a response of:<br>
<br>$nslookup <a href="http://firewall.inside.domain.com">firewall.inside.domain.com</a><br><b>;; Got recursion not available from 192.168.1.4, trying next server</b><br>Server: 192.168.1.251<br>Address: 192.168.1.251#53<br>
<br>Name: <a href="http://firewall.inside.domain.com">firewall.inside.domain.com</a><br>Address: 192.168.1.1<br><br>When this happens, <b>any machine asking for what SHOULD be an authoritative answer from 192.168.1.4 will not resolve</b>, BUT what's weird is that any address not known to my domain is being answered from the recursor on <a href="http://192.168.1.4:54">192.168.1.4:54</a> - which is only reachable from the authoritative server at <a href="http://192.168.1.4:53">192.168.1.4:53</a> - which just reported recursion not available... ?<br>
<br>So why would the authoritative server not be answering in an authoritative way for it's own domain?<br clear="all"><br>What's even more strange is this:<br><br>$ nslookup <a href="http://firewall.inside.domain.com">firewall.inside.domain.com</a><br>
<b>;; Got recursion not available from 192.168.1.4, trying next server</b><br>Server: 192.168.1.251<br>Address: 192.168.1.251#53<br><br>Name: <a href="http://thinfire.inside.domain.com">thinfire.inside.domain.com</a><br>
Address: 192.168.1.1<br><br>$ nslookup <a href="http://firewall.inside.domain.com">firewall.inside.domain.com</a> 192.168.1.4<br>Server: 192.168.1.4<br>Address: 192.168.1.4#53<br><br>Name: <a href="http://firewall.inside.domain.com">firewall.inside.domain.com</a><br>
Address: 192.168.1.1<br><br>And to convolute it even more...<br>If I restart the pdns authoritative server on 192.168.1.4 it will resolve names fine for a while even through the Windows server recursing to it - but sooner or later it will end up failing lookups again. The "Got recursion not available" error goes away after the restart, for a while.<br>
<br><br>More details:<br>Primary PowerDNS server is Ubuntu 8.10. Backup server is Ubuntu 8.04.<br>Both authoritative servers have:<br><br>daemon=yes<br>disable-axfr=yes<br>guardian=yes<br>lazy-recursion=yes<br>local-address=0.0.0.0<br>
local-port=53<br>recursor=<a href="http://127.0.0.1:54">127.0.0.1:54</a><br><br>Both recursor's have:<br><br>local-address=127.0.0.1<br>local-port=54<br><br>Neither server is logging anything interesting in syslog.<br>
<br>The windows server is authoritative for a separate <a href="http://internal.anotherdomain.com">internal.anotherdomain.com</a> (which is being phased out) so I can't just eliminate it right now.<br><br>If I can't get this solved I'll have to go back to bind9 without the LDAP backend.<br>
<br><br><br>-- <br>Tony Maro<br><a href="http://www.ossramblings.com/">http://www.ossramblings.com/</a><br>