[Pdns-users] PowerDNS Delegation (SmartConnect Isilon)

[Drew Decker]

Michael,

I think  you only read a few posts on this thread, so I’ll give you some details of what had/has been done up to this point, as I read your entire email and from what you are saying, I’ve already done (which is why I’m reaching out to the community) - correct me if I’m wrong.

I have a single zone: lab.example.com

The isilon needs a delegated zone for it to use, so we simply chose isilon.lab.example.com

From a PowerDNS perspective, lab.example.com lives on a single server pdns01 and the database server runs on its own dedicated hardware pdnsdb01.

A single zone was created - lab.example.com

We added the following DNS records to PowerDNS (in the lab.example.com zone):
labisilon.lab.example.com. 900 IN NS lab-isilon.lab.example.com.
lab-isilon.lab.example.com. 900 IN A x.x.x.x
Once we added this, it still does not work; when we ping labisilon.lab.example.com, it returns the IP from lab-isilon.lab.example.com, which would be as expected, but since the “x.x.x.x” IP is a SmartConnect IP on the Isilon, it actually takes that IP gives a random IP (depends on how the Isilon is configured) back to the client.  So, in our case, we basically round-robin it, so each new request to the isilon should give us a new IP, until we get to the end, and then we start over.  
I just need to know if I’m missing something here, and if not, maybe it is an issue with the Isilon, in this case.  I just want to make sure that I’m setting up DNS delegation correctly in PowerDNS, or if I’m missing something PowerDNS specific.
Thanks for your continued input.

-- 
Drew Decker


On December 12, 2013 at 9:32:33 PM, Michael Loftis (mloftis at wgops.com) wrote:

The most common and obvious example of glue is when you have a TLD  
such as GOV, COM, or EDU delegate your domain, your NS records usually  
exist within your domain so glue must exist higher up, exact same  
principal applies at every level where a delegation occurs. Say  
isil.lab.example.com is served by the isilon. This is the delegated  
subdomain. lab.example.com is served by other nameservers. The A  
record you're using could be ns1.isil.lab.example.com, and so must  
exist in both the isil.lab.example.com domain, AND the lab.example.com  
domain, in two seperate nameservers.  

You must have on BOTH the lab.example.com and the isil.lab.example.com  
domains and nameservers.... A records for out of zone nameservers in  
subdomains are called glue. Nothing magical. Everyone has some in  
COM, GOV, EDU, ORG, etc. If you take a look at google.com, you'll see  
ns1 through ns4.google.com -- those four A records exist in the COM  
zone as glue. Likewise, all four of those A records served by the COM  
nameservers are identical to the ones served by google.com  
nameservers. Same thing has to happen on subdomains if the A record  
points to something that exists inside the delegated domain.  

ns1.isil.lab.example.com IN A 127.1.1.2  
isil.lab.example.com IN NS ns1.isil.lab.example.com  

And that leads into yet another pitfall, if those records are  
mismatched, BIND and most other resolvers will decide someone is  
trying to poison their cache and refuse to serve results for that  
domain (or subdomain, there is not any distinction to BIND and  
PowerDNS)  




On Thu, Dec 12, 2013 at 4:48 PM, Drew Decker <drewrockshard at gmail.com> wrote:  
> Michael,  
>  
> When you state "If the A records that the NS points to are in the subdomain,  
> glue records must be created in the parent domain/zone." - can you elaborate  
> on how to do this? Everything else that you mentioned is DNS 101 and has  
> already been done. Explain to me how and what I need to do about the DNS  
> glue records in PowerDNS and I'll give it a try.  
>  
> Thanks!  
>  
>  
> On Thu, Dec 12, 2013 at 6:36 PM, Michael Loftis <mloftis at wgops.com> wrote:  
>>  
>> I must be missing something because this is DNS 101. Just create NS  
>> records in the domain on the PDNS server that points at the isilon.  
>> If the A records that the NS points to are in the subdomain, glue  
>> records must be created in the parent domain/zone. There's no magic,  
>> insert the two records into your PowerDNS authoratitive servers  
>> records table, make sure that the clients can contact the isilon's UDP  
>> and TCP port 53 (where the A record points to)  
>>  
>> If you're still having issues I suggest using dig +trace to see whats  
>> going on, and dig in general to see if the isilon is even responding -  
>> it really sounds like you've got a firewall issue that's keeping  
>> anything from being able to contact the delegated-to nameserver.  
>>  
>> On Thu, Dec 12, 2013 at 4:17 PM, Drew Decker <drewrockshard at gmail.com>  
>> wrote:  
>> > Does anyone else know of a way to do this, or could give me some  
>> > recommendations on how we could do this in or current configuration? We  
>> > just need to be able to create a delegation in PowerDNS to use a  
>> > different  
>> > Nameserver on the actual isilon. We are basically delegating to the  
>> > Isilon  
>> > for a specific "subdomain".  
>> >  
>> > Thanks!  
>> >  
>> >  
>> > On Wed, Dec 4, 2013 at 2:06 PM, ktm at rice.edu <ktm at rice.edu> wrote:  
>> >>  
>> >> On Wed, Dec 04, 2013 at 02:03:57PM -0600, Drew Decker wrote:  
>> >> > Ken,  
>> >> >  
>> >> > Yea - I don't think this will work for us. Our domain is shared with  
>> >> > the  
>> >> > Isilon, so it would be lab.domain.com, and I don't want to forward  
>> >> > the  
>> >> > entire zone over to the Isilon.  
>> >> >  
>> >> > thanks!  
>> >> >  
>> >>  
>> >> Yes, we put our Isilon in its own (sub)domain for exactly that reason.  
>> >> It  
>> >> made this easy. You could roll-your-own with lua in the recursor if a  
>> >> separate  
>> >> domain is not possible.  
>> >>  
>> >> Regards,  
>> >> Ken  
>> >  
>> >  
>> >  
>> >  
>> > --  
>> > Best Regards,  
>> > Drew Decker  
>> >  
>> > _______________________________________________  
>> > Pdns-users mailing list  
>> > Pdns-users at mailman.powerdns.com  
>> > http://mailman.powerdns.com/mailman/listinfo/pdns-users  
>> >  
>>  
>>  
>>  
>> --  
>>  
>> "Genius might be described as a supreme capacity for getting its  
>> possessors  
>> into trouble of all kinds."  
>> -- Samuel Butler  
>  
>  
>  
>  
> --  
> Best Regards,  
> Drew Decker  



--  

"Genius might be described as a supreme capacity for getting its possessors  
into trouble of all kinds."  
-- Samuel Butler  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.powerdns.com/pipermail/pdns-users/attachments/20131212/55ae49bd/attachment-0001.html>