[Pdns-users] External CNAME w/ auth and recursor
Sebastien Luttringer
sebastien.luttringer at smartjog.com
Mon Mar 10 14:27:23 UTC 2008
Sascha Holzleiter wrote:
> Sebastien Luttringer schrieb:
>> Sascha Holzleiter wrote:
>> And for your example dig answer that...
>>
>> # dig @127.0.0.1 test.tdf-pmm.wan
>> ; <<>> DiG 9.3.4 <<>> @127.0.0.1 test.tdf-pmm.wan
>> ; (1 server found)
>> ;; global options: printcmd
>> ;; Got answer:
>> ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 33663
>> ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
>>
>> ;; QUESTION SECTION:
>> ;test.tdf-pmm.wan. IN A
>>
>> ;; AUTHORITY SECTION:
>> . 3320 IN SOA a.root-servers.net.
>> nstld.verisign-grs.com. 2008030401 1800 900 604800 86400
>>
>> ;; Query time: 33 msec
>> ;; SERVER: 127.0.0.1#53(127.0.0.1)
>> ;; WHEN: Wed Mar 5 17:08:09 2008
>> ;; MSG SIZE rcvd: 109
>>
>>
>
> This is strange. Powerdns usually never answers with an NXDOMAIN for
> domains which it thinks
> it is authorative for.
>
> Ok, to make it short, maybe there is a problem in your
> Recursor<->Powerdns interaction, so here
> is an setup which works:
This really strange because this problem is the same if recursor is
bind, so this cannot be a misconfiguration of pdns-recursor. No ?
>
> pdns-recursor bound to 127.0.0.1
> pdns bound to 212.227.60.43
For me pdns-recursor bound to 127.0.0.1:5353 and pdns to 127.0.0.1:53
>
> For recursion to work you must specify the recursor in pdns.conf:
>
> recursor=127.0.0.1
recursor=127.0.0.1:5353
>
> Then, if you hit the nameserver with the question for e.g. in this
> example
> test.root-login.org it will forward this request to the recursor as it
> can't
> resolve the record by itself. For this example i have
> test.root-login.org as a CNAME to ns.seblu.net.
> But there is still the problem, that my secondary NS isn't controlled
> by me and also refuses to recurse
> this entry, so i'll tell the recursor to forward the root-login.org
> zone to my pdns server like this:
>
> forward-zones=root-login.org=212.227.60.43
for me forward-zones=tdf-pmm.wan=127.0.0.1
ok, this is a "solution". Thanks !
But this cut many advantage of pdns and is mysql backend. Because for
each domain under authority of pdns a modification in recursor.conf is
needed... This cannot be a solution.
>
> With this in place everything works as expected:
>
> > dig @212.227.60.43 test.root-login.org
>
> ; <<>> DiG 9.4.2 <<>> @212.227.60.43 test.root-login.org
> ; (1 server found)
> ;; global options: printcmd
> ;; Got answer:
> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20401
> ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0
>
> ;; QUESTION SECTION:
> ;test.root-login.org. IN A
>
> ;; ANSWER SECTION:
> test.root-login.org. 86178 IN CNAME ns.seblu.net.
> ns.seblu.net. 172578 IN A 88.191.33.22
>
> ;; Query time: 3 msec
> ;; SERVER: 212.227.60.43#53(212.227.60.43)
> ;; WHEN: Wed Mar 5 23:25:33 2008
> ;; MSG SIZE rcvd: 79
>
> What happens behind the scenes is this:
>
> * We ask PDNS for an A entry for test.root-login.org
> * PDNS has no A record for this, only a CNAME, but that wasn't asked
> for, so the original
> query is forwarded to the recursor
> * The recursor gets the question for the A entry of
> test.root-login.org. I've told him to ask
> any questions regarding this zone my PDNS server, so he asks it and
> gets the CNAME
> and as the recursor is allowed to recurse further it does this and
> comes up with the A
> record.
Yes but this is a kind of "cheat code".
> * The recursor gives everything back to PDNS which gives it to us and
> makes us happy ;)
No because other recursif DNS, like those of ISP or university, don't
see this CNAME.
> Hope this helps to get your setup right. There seems to be something
> wrong there.
> With these things you just have to make sure you don't build a
> resolving circle
> within the recursor<->PDNS interaction :)
In fact no, but thanks for your help ! I think it's just a powerdns
problem :
if i run a bind on 10.0.2.15, i get this answer from dig
# dig @10.0.2.15 test.tdf-pmm.net
; <<>> DiG 9.3.4 <<>> @10.0.2.15 test.tdf-pmm.net
; (1 server found)
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43996
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 13, ADDITIONAL: 0
;; QUESTION SECTION:
;test.tdf-pmm.net. IN A
;; ANSWER SECTION:
test.tdf-pmm.net. 604800 IN CNAME ns.seblu.net.
;; AUTHORITY SECTION:
. 518400 IN NS A.ROOT-SERVERS.net.
. 518400 IN NS B.ROOT-SERVERS.net.
. 518400 IN NS C.ROOT-SERVERS.net.
. 518400 IN NS D.ROOT-SERVERS.net.
. 518400 IN NS E.ROOT-SERVERS.net.
. 518400 IN NS F.ROOT-SERVERS.net.
. 518400 IN NS G.ROOT-SERVERS.net.
. 518400 IN NS H.ROOT-SERVERS.net.
. 518400 IN NS I.ROOT-SERVERS.net.
. 518400 IN NS J.ROOT-SERVERS.net.
. 518400 IN NS K.ROOT-SERVERS.net.
. 518400 IN NS L.ROOT-SERVERS.net.
. 518400 IN NS M.ROOT-SERVERS.net.
;; Query time: 34 msec
;; SERVER: 10.0.2.15#53(10.0.2.15)
;; WHEN: Mon Mar 10 12:18:41 2008
;; MSG SIZE rcvd: 266
and on 127.0.0.1 a pdns server
# dig @127.0.0.1 test.tdf-pmm.wan
; <<>> DiG 9.3.4 <<>> @127.0.0.1 test.tdf-pmm.wan
; (1 server found)
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 41025
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;test.tdf-pmm.wan. IN A
;; AUTHORITY SECTION:
. 10164 IN SOA A.ROOT-SERVERS.NET.
NSTLD.VERISIGN-GRS.COM. 2008030901
0 900 604800 86400
;; Query time: 88 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Mar 10 12:18:30 2008
;; MSG SIZE rcvd: 109
Bind when it's not a recursor answer to an A record by a CNAME record if
exist (but don't recurse, of course)
Pdns when it's not a recursor answer to an A record by a nxdomain and
then the recursif dns assume this true...
pdns :/
--
Sebastien "Seblu" Luttringer sebastien.luttringer at smartjog.com
Smartjog SA http://www.smartjog.com/
More information about the Pdns-users
mailing list