BIND9 and pop mail problems

penguindeb · 01-23-2008, 04:44 AM

Hi Guys,

I have just installed a local DNS Server. Everything works fine but now I cannot receive pop mail anymore from my ISP. I guessed that was due to my DNS server but I cannot fixe the problem. I have enclosed below my DNS configuration files. The only I have done is a forwarder as I have attached to my network a router. I did try a forwarder with my ISP's DNS but that didnt work at all.
Any help I could get here is very much appreciated because I am really stuck. Finally, I have another email account that works fine on the same network. That account is not from my ISP but it is a Mac.com account. It is a pop mail account but to get my emails, i use mail.mac.com and not pop.mac.com. Is it why that one is working and not the one from my isps which uses pop.orange.fr ?? Plus, my google account which uses pop.google.com doesn't work anymore as well.

Again, thank you all for your help

Here is my db.macitos.fr file

$TTL 604801
@ IN SOA margoullat.macitos.fr. leonidas.margoullat.fr (
20041122 ;
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Minimum

NS margoullat.macitos.fr ; Name of server
margoullat A 192.168.1.7 ; IP address of the name server
margoullat HINFO "AMD64 " "Debian etch" ;

iguane A 192.168.1.8
margoullat A 192.168.1.6
margoullat A 192.168.1.7
zongo A 192.168.1.5
heaven A 192.168.1.10

perso CNAME zongo
ig CNAME iguane
mar CNAME margoullat
mac CNAME heaven
pop CNAME iguane
smtp CNAME iguane

Here is my named.conf.local

zone "macitos.fr" {
type master;
file "/etc/bind/db.macitos.fr";
forwarders{};
};

zone "1.168.192.in-addr.arpa" {
type master;
file "/etc/bind/db.macitos.fr.inv";
forwarders{};

This is my named.conf.options file

forwarders {
192.168.1.1;
};

auth-nxdomain no; # conform to RFC1035
listen-on-v6 { any; };

acid_kewpie · 01-23-2008, 08:20 AM

what would make you think dns was at all related to this? never just guess...what is the hostname of your remote pop server? does it resolve? can you ping it? can't think why bind should be being pointed at first off.

JimBass · 01-23-2008, 08:37 AM

There is nothing wrong on the public net with resolving either pop.orange.fr or pop.gmail.com -

Code:

jim@jimsworktop:~$ dig pop.orange.fr

; <<>> DiG 9.4.2 <<>> pop.orange.fr
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2438
;; flags: qr rd ra; QUERY: 1, ANSWER: 12, AUTHORITY: 2, ADDITIONAL: 2

;; QUESTION SECTION:
;pop.orange.fr.                 IN      A

;; ANSWER SECTION:
pop.orange.fr.          600     IN      A       80.12.242.2
pop.orange.fr.          600     IN      A       80.12.242.8
pop.orange.fr.          600     IN      A       80.12.242.14
pop.orange.fr.          600     IN      A       80.12.242.51
pop.orange.fr.          600     IN      A       80.12.242.60
pop.orange.fr.          600     IN      A       80.12.242.90
pop.orange.fr.          600     IN      A       80.12.242.143
pop.orange.fr.          600     IN      A       80.12.242.149
pop.orange.fr.          600     IN      A       193.252.22.68
pop.orange.fr.          600     IN      A       193.252.22.85
pop.orange.fr.          600     IN      A       193.252.22.90
pop.orange.fr.          600     IN      A       193.252.23.65

;; AUTHORITY SECTION:
orange.fr.              357     IN      NS      ns.wanadoo.fr.
orange.fr.              357     IN      NS      ns2.wanadoo.fr.

;; ADDITIONAL SECTION:
ns.wanadoo.fr.          3450    IN      A       80.12.255.24
ns2.wanadoo.fr.         2750    IN      A       80.12.255.159

;; Query time: 273 msec
;; SERVER: 207.69.188.186#53(207.69.188.186)
;; WHEN: Wed Jan 23 09:14:41 2008
;; MSG SIZE  rcvd: 298

jim@jimsworktop:~$ dig pop.gmail.com

; <<>> DiG 9.4.2 <<>> pop.gmail.com
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16800
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 6, ADDITIONAL: 6

;; QUESTION SECTION:
;pop.gmail.com.                 IN      A

;; ANSWER SECTION:
pop.gmail.com.          274     IN      CNAME   gmail-pop.l.google.com.
gmail-pop.l.google.com. 276     IN      A       209.85.199.109
gmail-pop.l.google.com. 276     IN      A       209.85.199.111

;; AUTHORITY SECTION:
l.google.com.           21214   IN      NS      b.l.google.com.
l.google.com.           21214   IN      NS      c.l.google.com.
l.google.com.           21214   IN      NS      d.l.google.com.
l.google.com.           21214   IN      NS      e.l.google.com.
l.google.com.           21214   IN      NS      g.l.google.com.
l.google.com.           21214   IN      NS      a.l.google.com.

;; ADDITIONAL SECTION:
a.l.google.com.         32716   IN      A       209.85.139.9
b.l.google.com.         32718   IN      A       64.233.179.9
c.l.google.com.         21214   IN      A       64.233.161.9
d.l.google.com.         21216   IN      A       66.249.93.9
e.l.google.com.         32746   IN      A       209.85.137.9
g.l.google.com.         21214   IN      A       64.233.167.9

;; Query time: 106 msec
;; SERVER: 207.69.188.186#53(207.69.188.186)
;; WHEN: Wed Jan 23 09:15:19 2008
;; MSG SIZE  rcvd: 288

That implies that you have a configuration error. It looks like you didn't set your zone, macitos.fr up correctly. You have defined short names without an include. When I copied your zone onto one of my DNS servers, it didn't like the setup at all -

Code:

ns2:/home/jim# named-checkzone macitos.fr db.macitos.fr
db.macitos.fr:9: unknown RR type 'margoullat.macitos.fr'
zone macitos.fr/IN: loading master file db.macitos.fr: unknown class/type

Here is how I believe your zone should be constructed. The serial number should change, as should a few lines be added. Your TTLs are very long, so if you ever tried to switch an address, it would be cached forever. I suggest keeping that to around 2 hours. Also, any FQDN (fully qualified domain name), like margoullat.macitos.fr has to end with a period, so that Bind doesn't add more to it. -

Code:

$TTL 7200
@ IN SOA margoullat.macitos.fr. leonidas.margoullat.fr. (
2008012300 ;
7200 ; Refresh
7200 ; Retry
2419200 ; Expire
7200 ) ; Minimum

NS margoullat.macitos.fr. ; Name of server
$ORIGIN macitos.fr.
margoullat A 192.168.1.7 ; IP address of the name server
margoullat HINFO "AMD64 " "Debian etch" ;

iguane A 192.168.1.8
margoullat A 192.168.1.6
margoullat A 192.168.1.7
zongo A 192.168.1.5
heaven A 192.168.1.10


perso CNAME zongo
ig CNAME iguane
mar CNAME margoullat
mac CNAME heaven
pop CNAME iguane
smtp CNAME iguane

I would try making that switch. Also, you should have been able to forward requests to your ISP directly, there shouldn't be any need to pass them through your router. I suggest either ditching the forward directive completely, and allowing your nameserver to do what it was designed to do, or only forward to your ISP's DNS. To test out if you can forward, simply find the IP of the ISP DNS, then do something like this on your DNS box -

Code:

dig google.fr @A.B.C.D

Where A.B.C.D is the IP of your ISP DNS. If you get an answer, then you can forward to them.

What I suspect has happened here is that your semi-corrupted zone was polluting all of your lookups. Change the zonefile, then restart BIND or do "rndc reload macitos.fr" if your BIND supports rndc. Also, take the forward to your router out. If it all works well, great. If not, take your macitos.fr zone out (just comment out the lines about macitos.fr in named.conf.local), and restart again. Then you are just a caching DNS. If that works, it confirms that the problem is within your zonefile. Write back if you need more help or want a more detailed explanation.

Peace,
JimBass

penguindeb · 01-23-2008, 09:56 AM

HI JimBass,

Thank you so much for your response. I have followed step by step your advice but still have the same type of error as follow

1-When i run "named-checkzone" for db.macitos.fr and db.macitos.fr.inv I still get the error "Unknown RR type "margoullat.macitos.fr.". I did run the test with macitos.fr uncommented as well like you said and the error came back.

2-When I am trying to fecth email, eventhough I have change the config following your instructions, I still get the same error type Unable to connect to POP server pop.orange.fr. Error sending password: -ERR disconnect because could not connect to server. Please enter the POP password on host pop.orange.fr. Which I did but then i got "unable to connect to POP server pop.orange.fr. Error sending password: Operation is now undertaken.

I have a feeling that the error on my DNS server or even just running as a Cache server is linked to my email client not being able to fetch my mail anymore.

3-Then I run the dig orange.fr@86.213.22.143; and you know what. i went through like no hassle at all. There, I am getting really confuse now

4-Then I decided to do a ping on pop.orange.fr
27 packets transmitted, 0received, 100% packet loss.

5-Then I went on doing a telnet on port 110 on pop.orange.fr and I went through no problem.

Again, thank you so much for your help. Being a newbie on linux Debian is somtimes tough but worth it

JimBass · 01-23-2008, 10:41 AM

Don't sweat the inability to ping, most internet hosts don't allow pings. Some major ones do, like yahoo and google, but I also can't ping pop.orange.fr, although it resolves fine. Ping is a nearly worthless test over the internet. On a LAN it can work, but don't ever think it tells you anything valid about an internet host. Since you could telnet to the mail server, all is well from a DNS perspective.

Code:

jim@jimsworktop:~$ ping pop.orange.fr
PING pop.orange.fr (80.12.242.2) 56(84) bytes of data.

--- pop.orange.fr ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2010ms

So your problem isn't DNS.

Peace,
JimBass

penguindeb · 01-23-2008, 10:48 AM

JimBass,

Just one quick thing. The error I got when i ran named-checkzone "unknown RR type 'margoullat.macitos.fr' zone macitos.fr/IN:loading master file /etc/bind/db.macitos.fr: unknown class/type. What is it?? Is it because it is only a local domain?? Isn't that error message linked to the fact that I cannot get my emails anymore??

Cheers JimBass

JimBass · 01-23-2008, 03:40 PM

I doubt it. That is complaining that you have a bad round-robin (multiple addresses for one name), and it looks like you do. You have 4 definitions for margoullat, 2 a repeat, and I don't know what that HINFO line is. I've never seen that, and would suspect it is causing the problem. Try trimming down the duplicate (you have margoullat A 192.168.1.7 twice, and get rid of the margoullat HINFO line).

Also, those should have nothing to do with your inability to reach external sites. You can resolve pop.orange.fr, then it isn;t a DNS problem, it is something else.

Peace,
JimBass