LinuxQuestions.org - Linux BIND refuses to resolve Microsoft domains???

- Linux - Server (http://www.linuxquestions.org/questions/linux-server-73/)

- - Linux BIND refuses to resolve Microsoft domains??? (http://www.linuxquestions.org/questions/linux-server-73/linux-bind-refuses-to-resolve-microsoft-domains-700621/)

Linux BIND refuses to resolve Microsoft domains???

Hi all!

I am baffled by this problem. I have setup a BIND 9.5.1-P1 service on a Fedora Core 9 server. Clients, that point to this server and our service provider as a secondary, resolve www.google.com and local names with no problem. Yet they cannot resolve any Microsoft names (i.e. msn.com, msdn.com, hotmail.com, etc.)!! Now, I have my own bias against Micro$**t but I don't know why BIND would. If I place my client(laptop) outside of our firewall so that it only gets our service provider's DNS, Micro$**t's names resolve without any problem.

In fact, this same configuration was used on a previous Fedora Core 6 system without problems. The only change was that I needed to uncomment this line:

query-source port 53;

I have used yum to completely update everything on the server. 'yum update' returns no more updates.

Here is my named.conf file:

Code:

options {

        directory "/var/named";



        // Uncommenting this might help if you have to go through a

        // firewall and things are not working out.  But you probably

        // need to talk to your firewall admin.



        query-source port 53;



};



controls {

        inet 127.0.0.1 allow { localhost; } keys { rndc_key; };

};



key "rndc_key" {

        algorithm hmac-md5;

        secret "tsktsktsk";

};



key "DHCP_UPDATER" {

         algorithm hmac-md5;

         secret "nada";

};



zone "0.0.127.in-addr.arpa" {

        type master;

        allow-transfer { 127.0.0.1; };

        allow-update { none; };

        file "pz/127.0.0";

};



zone "example.com" {

        type master;

        notify no;

        allow-transfer { 127.0.0.1; };

        allow-update { key "DHCP_UPDATER"; };

        file "pz/example.com";

};



zone "0.30.172.in-addr.arpa" {

        type master;

        notify no;

        allow-transfer { 127.0.0.1; };

        allow-update { key "DHCP_UPDATER"; };

        file "pz/example-reverse";

};

Any help would be greatly appreciated. Thanks in advance!

Are you sure that you cannot resolve just the M$ domains?
Because you need the hint zone "." in order to be able to resolve domains that your dns is not authoritative.
Add

Code:

 zone "." in {

 type hint;

 file "root.hints";

 };

in /etc/named.conf and run

Code:

dig @a.root-servers.net . ns > root.hints

to get the latest hint zone file. If you cannot resolve a.root-servers.net, use its IP: 198.41.0.4

Regards

Thanks! I'll give that a try.

Thanks for the reply but unfortunately that did not help.

Here is the result of an nslookup:

Code:

# nslookup www.msn.com

;; connection timed out; no servers could be reached

...and another that was successful (modified)...

Code:

nslookup www.linuxquestions.org

Server:         172.30.0.xx

Address:        172.30.0.xx#53



Non-authoritative answer:

Name:   www.linuxquestions.org

Address: 75.126.162.205

Quick note: Those two nslookups were done successively from the same system.

Quote:

Originally Posted by ddekeyser2000 (Post 3424553)

Quick note: Those two nslookups were done successively from the same system.

If the same system cannot contact always the dns, then this is a network or firewall problem.
The fact that the 1st time that failed to contact the dns you're looking up msn.com and the 2nd time it succeeded to lookup linuxquestions.org, I think it's purely random.
You can use dig to investigate further

Code:

dig +trace www.msn.com

or disable the "query-source port 53' option and see if it helps.

The nslookup's that I showed you were just two of many. It consistently fails for Microsoft sites. It consistently works for any other name.

The dig with trace produced some interesting results.

Code:

# dig +trace www.msn.com



; <<>> DiG 9.5.1-P1 <<>> +trace www.msn.com

;; global options:  printcmd

.                       468187  IN      NS      H.ROOT-SERVERS.NET.

.                       468187  IN      NS      D.ROOT-SERVERS.NET.

.                       468187  IN      NS      J.ROOT-SERVERS.NET.

.                       468187  IN      NS      B.ROOT-SERVERS.NET.

.                       468187  IN      NS      C.ROOT-SERVERS.NET.

.                       468187  IN      NS      A.ROOT-SERVERS.NET.

.                       468187  IN      NS      M.ROOT-SERVERS.NET.

.                       468187  IN      NS      K.ROOT-SERVERS.NET.

.                       468187  IN      NS      G.ROOT-SERVERS.NET.

.                       468187  IN      NS      F.ROOT-SERVERS.NET.

.                       468187  IN      NS      E.ROOT-SERVERS.NET.

.                       468187  IN      NS      I.ROOT-SERVERS.NET.

.                       468187  IN      NS      L.ROOT-SERVERS.NET.

;; Received 488 bytes from 172.30.0.35#53(172.30.0.35) in 2 ms



com.                    172800  IN      NS      a.gtld-servers.net.

com.                    172800  IN      NS      b.gtld-servers.net.

com.                    172800  IN      NS      c.gtld-servers.net.

com.                    172800  IN      NS      d.gtld-servers.net.

com.                    172800  IN      NS      e.gtld-servers.net.

com.                    172800  IN      NS      f.gtld-servers.net.

com.                    172800  IN      NS      g.gtld-servers.net.

com.                    172800  IN      NS      h.gtld-servers.net.

com.                    172800  IN      NS      i.gtld-servers.net.

com.                    172800  IN      NS      j.gtld-servers.net.

com.                    172800  IN      NS      k.gtld-servers.net.

com.                    172800  IN      NS      l.gtld-servers.net.

com.                    172800  IN      NS      m.gtld-servers.net.

;; Received 489 bytes from 193.0.14.129#53(K.ROOT-SERVERS.NET) in 55 ms



msn.com.                172800  IN      NS      ns1.msft.net.

msn.com.                172800  IN      NS      ns2.msft.net.

msn.com.                172800  IN      NS      ns3.msft.net.

msn.com.                172800  IN      NS      ns4.msft.net.

msn.com.                172800  IN      NS      ns5.msft.net.

;; Received 207 bytes from 192.42.93.30#53(g.gtld-servers.net) in 71 ms



dig: couldn't get address for 'ns1.msft.net': failure

Code:

# dig +trace ns1.msft.net



; <<>> DiG 9.5.1-P1 <<>> +trace ns1.msft.net

;; global options:  printcmd

.                       468079  IN      NS      J.ROOT-SERVERS.NET.

.                       468079  IN      NS      E.ROOT-SERVERS.NET.

.                       468079  IN      NS      K.ROOT-SERVERS.NET.

.                       468079  IN      NS      G.ROOT-SERVERS.NET.

.                       468079  IN      NS      H.ROOT-SERVERS.NET.

.                       468079  IN      NS      B.ROOT-SERVERS.NET.

.                       468079  IN      NS      C.ROOT-SERVERS.NET.

.                       468079  IN      NS      M.ROOT-SERVERS.NET.

.                       468079  IN      NS      I.ROOT-SERVERS.NET.

.                       468079  IN      NS      A.ROOT-SERVERS.NET.

.                       468079  IN      NS      L.ROOT-SERVERS.NET.

.                       468079  IN      NS      D.ROOT-SERVERS.NET.

.                       468079  IN      NS      F.ROOT-SERVERS.NET.

;; Received 500 bytes from 172.30.0.35#53(172.30.0.35) in 1 ms



net.                    172800  IN      NS      K.GTLD-SERVERS.net.

net.                    172800  IN      NS      M.GTLD-SERVERS.net.

net.                    172800  IN      NS      D.GTLD-SERVERS.net.

net.                    172800  IN      NS      J.GTLD-SERVERS.net.

net.                    172800  IN      NS      B.GTLD-SERVERS.net.

net.                    172800  IN      NS      H.GTLD-SERVERS.net.

net.                    172800  IN      NS      A.GTLD-SERVERS.net.

net.                    172800  IN      NS      L.GTLD-SERVERS.net.

net.                    172800  IN      NS      I.GTLD-SERVERS.net.

net.                    172800  IN      NS      F.GTLD-SERVERS.net.

net.                    172800  IN      NS      G.GTLD-SERVERS.net.

net.                    172800  IN      NS      E.GTLD-SERVERS.net.

net.                    172800  IN      NS      C.GTLD-SERVERS.net.

;; Received 487 bytes from 192.5.5.241#53(F.ROOT-SERVERS.NET) in 77 ms



ns1.msft.net.           172800  IN      A       207.68.160.190

msft.net.               172800  IN      NS      ns1.msft.net.

msft.net.               172800  IN      NS      ns2.msft.net.

msft.net.               172800  IN      NS      ns3.msft.net.

msft.net.               172800  IN      NS      ns4.msft.net.

msft.net.               172800  IN      NS      ns5.msft.net.

;; Received 212 bytes from 192.5.6.30#53(A.GTLD-SERVERS.net) in 115 ms

I'm not sure why on the first one it said it couldn't get the address for ns1.msft.net but the second obviously did.

I'll try to disable the 'query-source port 53' option after my users go home tonight. Could you explain that option to me? I didn't need it before (when the server was on Fedora Core 6).

Thanks!

Quote:

I'll try to disable the 'query-source port 53' option after my users go home tonight. Could you explain that option to me? I didn't need it before (when the server was on Fedora Core 6).

This option is used when your firewall permits outgoing traffic only from source port 53 (or some other ports you have specified) and block anything else.
In a default situation bind only accepts queries from clients on port 53 and uses other random unprivileged ports when it acts as a client and contact another dns for a domain it cannot resolve.
Now the fact it's not resolving the M$ domains, is really strange. Did you run the dig command to get the latest root.hints file? Because I see that your "dig +trace" uses the K.ROOT-SERVERS.NET that does not exist in my root.hints that I've just downoaded. Maybe K.ROOT-SERVERS.NET is not used and thus it's .outdated

Thanks for the option description. I'm not sure why I need that now when I didn't need it before. I haven't made any changes to my firewall.

I did do the dig command as you requested before to create the root.hints file. The K server was included.

I deleted the 'K' server from the file and restarted 'named'. It still does not resolve Microsoft but still resolves everything else.

Quote:

I'm not sure why I need that now when I didn't need it before. I haven't made any changes to my firewall.

Are you sure you need it? If you do and you haven't changed anything in the configuration of your firewall then it's maybe selinux.

Quote:

I did do the dig command as you requested before to create the root.hints file. The K server was included.

I deleted the 'K' server from the file and restarted 'named'. It still does not resolve Microsoft but still resolves everything else.

Well the correct root.hints should contain the k root servers. It seems that the a.root-server I used is outdated.

Thanks for all of your help bathory! I was unable to work on this problem today. I'll revisit this on Monday.

Thanks again!

OKAY, I'm not sure why this worked but I just commented out:

// query-source port 53;

...and everything seems to be working fine now. I'm not sure why it didn't work before. Unfortunately, there is some other variable that I'm not seeing that must have changed.

Sorry to anyone looking at this for answers. Maybe it will give you a hint if you have a similar issue.

Thanks for all of your help bathory!!!