LinuxQuestions.org
Go Job Hunting at the LQ Job Marketplace
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices

Reply
 
Search this Thread
Old 01-28-2009, 03:48 PM   #1
ddekeyser2000
LQ Newbie
 
Registered: Feb 2008
Posts: 17

Rep: Reputation: 0
Linux BIND refuses to resolve Microsoft domains???


Hi all!

I am baffled by this problem. I have setup a BIND 9.5.1-P1 service on a Fedora Core 9 server. Clients, that point to this server and our service provider as a secondary, resolve www.google.com and local names with no problem. Yet they cannot resolve any Microsoft names (i.e. msn.com, msdn.com, hotmail.com, etc.)!! Now, I have my own bias against Micro$**t but I don't know why BIND would. If I place my client(laptop) outside of our firewall so that it only gets our service provider's DNS, Micro$**t's names resolve without any problem.

In fact, this same configuration was used on a previous Fedora Core 6 system without problems. The only change was that I needed to uncomment this line:

query-source port 53;

I have used yum to completely update everything on the server. 'yum update' returns no more updates.

Here is my named.conf file:

Code:
options {
        directory "/var/named";

        // Uncommenting this might help if you have to go through a
        // firewall and things are not working out.  But you probably
        // need to talk to your firewall admin.

        query-source port 53;

};

controls {
        inet 127.0.0.1 allow { localhost; } keys { rndc_key; };
};

key "rndc_key" {
        algorithm hmac-md5;
        secret "tsktsktsk";
};

key "DHCP_UPDATER" {
         algorithm hmac-md5;
         secret "nada";
};

zone "0.0.127.in-addr.arpa" {
        type master;
        allow-transfer { 127.0.0.1; };
        allow-update { none; };
        file "pz/127.0.0";
};

zone "example.com" {
        type master;
        notify no;
        allow-transfer { 127.0.0.1; };
        allow-update { key "DHCP_UPDATER"; };
        file "pz/example.com";
};

zone "0.30.172.in-addr.arpa" {
        type master;
        notify no;
        allow-transfer { 127.0.0.1; };
        allow-update { key "DHCP_UPDATER"; };
        file "pz/example-reverse";
};
Any help would be greatly appreciated. Thanks in advance!
 
Old 01-28-2009, 04:20 PM   #2
bathory
Guru
 
Registered: Jun 2004
Location: Piraeus
Distribution: Slackware
Posts: 10,881

Rep: Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322
Are you sure that you cannot resolve just the M$ domains?
Because you need the hint zone "." in order to be able to resolve domains that your dns is not authoritative.
Add
Code:
 zone "." in {
 type hint;
 file "root.hints";
 };
in /etc/named.conf and run
Code:
dig @a.root-servers.net . ns > root.hints
to get the latest hint zone file. If you cannot resolve a.root-servers.net, use its IP: 198.41.0.4

Regards

Last edited by bathory; 01-28-2009 at 04:21 PM.
 
Old 01-28-2009, 04:35 PM   #3
ddekeyser2000
LQ Newbie
 
Registered: Feb 2008
Posts: 17

Original Poster
Rep: Reputation: 0
Thanks! I'll give that a try.
 
Old 01-28-2009, 04:42 PM   #4
ddekeyser2000
LQ Newbie
 
Registered: Feb 2008
Posts: 17

Original Poster
Rep: Reputation: 0
Thanks for the reply but unfortunately that did not help.

Here is the result of an nslookup:

Code:
# nslookup www.msn.com
;; connection timed out; no servers could be reached
...and another that was successful (modified)...

Code:
nslookup www.linuxquestions.org
Server:         172.30.0.xx
Address:        172.30.0.xx#53

Non-authoritative answer:
Name:   www.linuxquestions.org
Address: 75.126.162.205
 
Old 01-28-2009, 04:54 PM   #5
ddekeyser2000
LQ Newbie
 
Registered: Feb 2008
Posts: 17

Original Poster
Rep: Reputation: 0
Quick note: Those two nslookups were done successively from the same system.
 
Old 01-29-2009, 02:20 AM   #6
bathory
Guru
 
Registered: Jun 2004
Location: Piraeus
Distribution: Slackware
Posts: 10,881

Rep: Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322
Quote:
Originally Posted by ddekeyser2000 View Post
Quick note: Those two nslookups were done successively from the same system.
If the same system cannot contact always the dns, then this is a network or firewall problem.
The fact that the 1st time that failed to contact the dns you're looking up msn.com and the 2nd time it succeeded to lookup linuxquestions.org, I think it's purely random.
You can use dig to investigate further
Code:
dig +trace www.msn.com
or disable the "query-source port 53' option and see if it helps.
 
Old 01-29-2009, 09:49 AM   #7
ddekeyser2000
LQ Newbie
 
Registered: Feb 2008
Posts: 17

Original Poster
Rep: Reputation: 0
The nslookup's that I showed you were just two of many. It consistently fails for Microsoft sites. It consistently works for any other name.

The dig with trace produced some interesting results.

Code:
# dig +trace www.msn.com

; <<>> DiG 9.5.1-P1 <<>> +trace www.msn.com
;; global options:  printcmd
.                       468187  IN      NS      H.ROOT-SERVERS.NET.
.                       468187  IN      NS      D.ROOT-SERVERS.NET.
.                       468187  IN      NS      J.ROOT-SERVERS.NET.
.                       468187  IN      NS      B.ROOT-SERVERS.NET.
.                       468187  IN      NS      C.ROOT-SERVERS.NET.
.                       468187  IN      NS      A.ROOT-SERVERS.NET.
.                       468187  IN      NS      M.ROOT-SERVERS.NET.
.                       468187  IN      NS      K.ROOT-SERVERS.NET.
.                       468187  IN      NS      G.ROOT-SERVERS.NET.
.                       468187  IN      NS      F.ROOT-SERVERS.NET.
.                       468187  IN      NS      E.ROOT-SERVERS.NET.
.                       468187  IN      NS      I.ROOT-SERVERS.NET.
.                       468187  IN      NS      L.ROOT-SERVERS.NET.
;; Received 488 bytes from 172.30.0.35#53(172.30.0.35) in 2 ms

com.                    172800  IN      NS      a.gtld-servers.net.
com.                    172800  IN      NS      b.gtld-servers.net.
com.                    172800  IN      NS      c.gtld-servers.net.
com.                    172800  IN      NS      d.gtld-servers.net.
com.                    172800  IN      NS      e.gtld-servers.net.
com.                    172800  IN      NS      f.gtld-servers.net.
com.                    172800  IN      NS      g.gtld-servers.net.
com.                    172800  IN      NS      h.gtld-servers.net.
com.                    172800  IN      NS      i.gtld-servers.net.
com.                    172800  IN      NS      j.gtld-servers.net.
com.                    172800  IN      NS      k.gtld-servers.net.
com.                    172800  IN      NS      l.gtld-servers.net.
com.                    172800  IN      NS      m.gtld-servers.net.
;; Received 489 bytes from 193.0.14.129#53(K.ROOT-SERVERS.NET) in 55 ms

msn.com.                172800  IN      NS      ns1.msft.net.
msn.com.                172800  IN      NS      ns2.msft.net.
msn.com.                172800  IN      NS      ns3.msft.net.
msn.com.                172800  IN      NS      ns4.msft.net.
msn.com.                172800  IN      NS      ns5.msft.net.
;; Received 207 bytes from 192.42.93.30#53(g.gtld-servers.net) in 71 ms

dig: couldn't get address for 'ns1.msft.net': failure
Code:
# dig +trace ns1.msft.net

; <<>> DiG 9.5.1-P1 <<>> +trace ns1.msft.net
;; global options:  printcmd
.                       468079  IN      NS      J.ROOT-SERVERS.NET.
.                       468079  IN      NS      E.ROOT-SERVERS.NET.
.                       468079  IN      NS      K.ROOT-SERVERS.NET.
.                       468079  IN      NS      G.ROOT-SERVERS.NET.
.                       468079  IN      NS      H.ROOT-SERVERS.NET.
.                       468079  IN      NS      B.ROOT-SERVERS.NET.
.                       468079  IN      NS      C.ROOT-SERVERS.NET.
.                       468079  IN      NS      M.ROOT-SERVERS.NET.
.                       468079  IN      NS      I.ROOT-SERVERS.NET.
.                       468079  IN      NS      A.ROOT-SERVERS.NET.
.                       468079  IN      NS      L.ROOT-SERVERS.NET.
.                       468079  IN      NS      D.ROOT-SERVERS.NET.
.                       468079  IN      NS      F.ROOT-SERVERS.NET.
;; Received 500 bytes from 172.30.0.35#53(172.30.0.35) in 1 ms

net.                    172800  IN      NS      K.GTLD-SERVERS.net.
net.                    172800  IN      NS      M.GTLD-SERVERS.net.
net.                    172800  IN      NS      D.GTLD-SERVERS.net.
net.                    172800  IN      NS      J.GTLD-SERVERS.net.
net.                    172800  IN      NS      B.GTLD-SERVERS.net.
net.                    172800  IN      NS      H.GTLD-SERVERS.net.
net.                    172800  IN      NS      A.GTLD-SERVERS.net.
net.                    172800  IN      NS      L.GTLD-SERVERS.net.
net.                    172800  IN      NS      I.GTLD-SERVERS.net.
net.                    172800  IN      NS      F.GTLD-SERVERS.net.
net.                    172800  IN      NS      G.GTLD-SERVERS.net.
net.                    172800  IN      NS      E.GTLD-SERVERS.net.
net.                    172800  IN      NS      C.GTLD-SERVERS.net.
;; Received 487 bytes from 192.5.5.241#53(F.ROOT-SERVERS.NET) in 77 ms

ns1.msft.net.           172800  IN      A       207.68.160.190
msft.net.               172800  IN      NS      ns1.msft.net.
msft.net.               172800  IN      NS      ns2.msft.net.
msft.net.               172800  IN      NS      ns3.msft.net.
msft.net.               172800  IN      NS      ns4.msft.net.
msft.net.               172800  IN      NS      ns5.msft.net.
;; Received 212 bytes from 192.5.6.30#53(A.GTLD-SERVERS.net) in 115 ms
I'm not sure why on the first one it said it couldn't get the address for ns1.msft.net but the second obviously did.
 
Old 01-29-2009, 09:53 AM   #8
ddekeyser2000
LQ Newbie
 
Registered: Feb 2008
Posts: 17

Original Poster
Rep: Reputation: 0
I'll try to disable the 'query-source port 53' option after my users go home tonight. Could you explain that option to me? I didn't need it before (when the server was on Fedora Core 6).

Thanks!
 
Old 01-29-2009, 12:11 PM   #9
bathory
Guru
 
Registered: Jun 2004
Location: Piraeus
Distribution: Slackware
Posts: 10,881

Rep: Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322
Quote:
I'll try to disable the 'query-source port 53' option after my users go home tonight. Could you explain that option to me? I didn't need it before (when the server was on Fedora Core 6).
This option is used when your firewall permits outgoing traffic only from source port 53 (or some other ports you have specified) and block anything else.
In a default situation bind only accepts queries from clients on port 53 and uses other random unprivileged ports when it acts as a client and contact another dns for a domain it cannot resolve.
Now the fact it's not resolving the M$ domains, is really strange. Did you run the dig command to get the latest root.hints file? Because I see that your "dig +trace" uses the K.ROOT-SERVERS.NET that does not exist in my root.hints that I've just downoaded. Maybe K.ROOT-SERVERS.NET is not used and thus it's .outdated
 
Old 01-29-2009, 12:34 PM   #10
ddekeyser2000
LQ Newbie
 
Registered: Feb 2008
Posts: 17

Original Poster
Rep: Reputation: 0
Thanks for the option description. I'm not sure why I need that now when I didn't need it before. I haven't made any changes to my firewall.

I did do the dig command as you requested before to create the root.hints file. The K server was included.

I deleted the 'K' server from the file and restarted 'named'. It still does not resolve Microsoft but still resolves everything else.
 
Old 01-29-2009, 12:57 PM   #11
bathory
Guru
 
Registered: Jun 2004
Location: Piraeus
Distribution: Slackware
Posts: 10,881

Rep: Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322Reputation: 1322
Quote:
I'm not sure why I need that now when I didn't need it before. I haven't made any changes to my firewall.
Are you sure you need it? If you do and you haven't changed anything in the configuration of your firewall then it's maybe selinux.
Quote:
I did do the dig command as you requested before to create the root.hints file. The K server was included.

I deleted the 'K' server from the file and restarted 'named'. It still does not resolve Microsoft but still resolves everything else.
Well the correct root.hints should contain the k root servers. It seems that the a.root-server I used is outdated.
 
Old 01-30-2009, 03:27 PM   #12
ddekeyser2000
LQ Newbie
 
Registered: Feb 2008
Posts: 17

Original Poster
Rep: Reputation: 0
Thanks for all of your help bathory! I was unable to work on this problem today. I'll revisit this on Monday.

Thanks again!
 
Old 02-03-2009, 12:14 PM   #13
ddekeyser2000
LQ Newbie
 
Registered: Feb 2008
Posts: 17

Original Poster
Rep: Reputation: 0
OKAY, I'm not sure why this worked but I just commented out:

// query-source port 53;

...and everything seems to be working fine now. I'm not sure why it didn't work before. Unfortunately, there is some other variable that I'm not seeing that must have changed.

Sorry to anyone looking at this for answers. Maybe it will give you a hint if you have a similar issue.

Thanks for all of your help bathory!!!
 
  


Reply

Tags
bind, dns, fedora, microsoft, named


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Bind unable to resolve jedimastermopar Linux - Networking 3 08-05-2009 03:39 PM
BIND multiple domains tommyfen Linux - Software 0 09-10-2007 05:23 AM
my bind 8.2.4 sometime can't resolve name chhansopheaktra Linux - Networking 2 08-11-2005 06:29 AM
BIND/DNS - Two Different Domains jhewitt Linux - Networking 1 02-20-2004 07:54 PM
HELP! Caching DNS server wont resolve .EDU domains? spadesmaster Linux - Networking 0 04-30-2002 10:25 AM


All times are GMT -5. The time now is 07:26 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration