[Pdns-users] [Fwd: Re: DiG: Hopefully Final Thoughts..]

Mon Feb 20 00:38:57 UTC 2017

Sorry meant to reply all ....

-------- Forwarded Message --------
From: stancs3 <scruise56 at gmail.com>
To: Brian Candler <b.candler at pobox.com>
Subject: Re: [Pdns-users] DiG: Hopefully Final Thoughts..
Date: Sun, 19 Feb 2017 17:37:33 -0700

After a bunch of testing etc:

The reverse now works; like you indicated it's just another zone; once
I got that digested, I forwarded it from the recursor and it works.

I have attached the remaining thing I cannot resolve (no pun).

1. The test above the ===== line is:

Recursor listening on port 53, forwarding to auth server listening on
port 5300.

Dig of NS replies with no Additional section.
Dig of ns1 replies with the A record.

2. The test below the ===== line is:

No recursor, auth server listening on port 53.

Dig of NS replies with Additional section showing the A records for
both NSs.

> 
> > 
> > Why does only a dig NS directly to the auth server show the NS A
records?

> 
> > 
> > And/or is this expected behavior, and just be happy I got this far?

Stan

On Fri, 2017-02-17 at 08:15 +0000, Brian Candler wrote:
> 
> On 17/02/2017 06:45, stancs3 wrote:
> > 
> > 
> > Reverse doesn't work in this config, so I figure on giving up on
> > recursor.
> What do you mean by "reverse doesn't work"? Can you give a specific 
> example of what you did, what you saw, and what you expected to see?
> 
> Reverse is just another domain (under in-addr.arpa), no different to
> any 
> other.
> > 
> > 
> > I can either use my router's recursor, or perhaps set up a pdns-
> > recursor on a different VM to keep it clean. Wouldn't that be the
> > same/better than the router's?
> Most routers' built-in DNS is pretty poor - little more than a
> caching 
> forwarder to an upstream DNS (like dnsmasq), so having your own 
> pdns-recursor is likely to be much better.
> 
> If you want your authoritative DNS to be visible to the outside
> world 
> for real delegation, then it needs to listen on port 53. If you want 
> your recursive DNS to be usable by local clients, then it also needs
> to 
> listen on port 53, since most clients can't be (easily) configured
> to 
> send their DNS queries to a different port.
> 
> So, to run both auth and recursive, you need to assign two IP
> addresses. 
> Those can either be two different VMs (maximum separation), two 
> different containers, or even two different IPs in the same machine, 
> where the pns-auth and pdns-recursor processes are configured to bind
> to 
> (listen on) a different individual IP address.
> 
> You could try fancy tricks with dns-dist in front, but personally
> I'd 
> just go for the two VMs or two containers.
> 
> Don't forget redundancy. For authoritative DNS you'll want another 
> nameserver on a completely different backbone (see RFC2182). For
> client 
> redundancy, two local recursors is what you want.
> 
> HTH,
> 
> Brian.
-------------- next part --------------

>> The following are dig to recursor on port 53, which forwards to auth server on port 5300:

buddy at place:~$ dig stuf.example.com @192.168.1.10

; <<>> DiG 9.10.3-P4-Ubuntu <<>> stuf.example.com @192.168.1.10
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48144
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;stuf.example.com.		IN	A

;; AUTHORITY SECTION:
stuf.example.com.	563	IN	SOA	ns1.stuf.example.com. hostmaster.stuf.example.com. 2017021901 28800 7200 604800 86400

;; Query time: 2 msec
;; SERVER: 192.168.1.10#53(192.168.1.10)
;; WHEN: Sun Feb 19 17:11:03 MST 2017
;; MSG SIZE  rcvd: 90

buddy at place:~$ dig ns stuf.example.com @192.168.1.10

; <<>> DiG 9.10.3-P4-Ubuntu <<>> ns stuf.example.com @192.168.1.10
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16983
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;stuf.example.com.		IN	NS

;; ANSWER SECTION:
stuf.example.com.	83385	IN	NS	ns1.stuf.example.com.
stuf.example.com.	83385	IN	NS	ns2.stuf.example.com.

;; Query time: 1 msec
;; SERVER: 192.168.1.10#53(192.168.1.10)
;; WHEN: Sun Feb 19 17:11:20 MST 2017
;; MSG SIZE  rcvd: 78

buddy at place:~$ dig ns1.stuf.example.com @192.168.1.10

; <<>> DiG 9.10.3-P4-Ubuntu <<>> ns1.stuf.example.com @192.168.1.10
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 60273
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;ns1.stuf.example.com.	IN	A

;; ANSWER SECTION:
ns1.stuf.example.com. 83358 IN	A	192.168.1.10

;; Query time: 3 msec
;; SERVER: 192.168.1.10#53(192.168.1.10)
;; WHEN: Sun Feb 19 17:11:47 MST 2017
;; MSG SIZE  rcvd: 59

buddy at place:~$ 

===========================================================================================

The following are dig directly to the same auth server as above, on port 53: (i.e. the recursor is not used):

buddy at place:~$ dig stuf.example.com @192.168.1.11

; <<>> DiG 9.10.3-P4-Ubuntu <<>> stuf.example.com @192.168.1.11
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53955
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1680
;; QUESTION SECTION:
;stuf.example.com.		IN	A

;; AUTHORITY SECTION:
stuf.example.com.	86400	IN	SOA	ns1.stuf.example.com. hostmaster.stuf.example.com. 2017021901 28800 7200 604800 86400

;; Query time: 3 msec
;; SERVER: 192.168.1.11#53(192.168.1.11)
;; WHEN: Sun Feb 19 17:12:49 MST 2017
;; MSG SIZE  rcvd: 101

buddy at place:~$ dig ns stuf.example.com @192.168.1.11

; <<>> DiG 9.10.3-P4-Ubuntu <<>> ns stuf.example.com @192.168.1.11
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9155
;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 3
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1680
;; QUESTION SECTION:
;stuf.example.com.		IN	NS

;; ANSWER SECTION:
stuf.example.com.	86400	IN	NS	ns2.stuf.example.com.
stuf.example.com.	86400	IN	NS	ns1.stuf.example.com.

;; ADDITIONAL SECTION:
ns2.stuf.example.com. 86400 IN	A	192.168.1.11       << the A records,
ns1.stuf.example.com. 86400 IN	A	192.168.1.10       << not shown is test above =====

;; Query time: 4 msec
;; SERVER: 192.168.1.11#53(192.168.1.11)
;; WHEN: Sun Feb 19 17:12:59 MST 2017
;; MSG SIZE  rcvd: 121

buddy at place:~$ dig ns1.stuf.example.com @192.168.1.11

; <<>> DiG 9.10.3-P4-Ubuntu <<>> ns1.stuf.example.com @192.168.1.11
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51366
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1680
;; QUESTION SECTION:
;ns1.stuf.example.com.	IN	A

;; ANSWER SECTION:
ns1.stuf.example.com. 86400 IN	A	192.168.1.10

;; Query time: 3 msec
;; SERVER: 192.168.1.11#53(192.168.1.11)
;; WHEN: Sun Feb 19 17:13:16 MST 2017
;; MSG SIZE  rcvd: 70