[SOLVED] can't ping cname in CentOS7 dns server with Unbound

rhinolt · 01-20-2017, 08:00 AM

My CentOS7 system is running on vmware12
im trying to set up unbound with some local hosts
unbound-checkconf: no errors in /etc/unbound/unbound.conf

here's my setting in /etc/unbound/local.d/RR.conf

Code:

local-zone: "example.com." static
local-data: "example.com. 36000 IN SOA server.example.com. root 2017011701 1H 600 1D 1H"
local-data: "server.example.com.   IN A 192.168.10.1"
local-data: "repo.example.com.     IN A 192.168.10.2"
local-data: "desktop.example.com.  IN A 192.168.10.10"
local-data: "mail.example.com.     IN CNAME server.example.com."
local-data: "test.example.com.     IN CNAME server.example.com."
local-data: "www.example.com.      IN CNAME server.example.com."

local-data-ptr: "192.168.10.1 server.example.com."
local-data-ptr: "192.168.10.2 repo.example.com."
local-data-ptr: "192.168.10.10 desktop.example.com."

it works fine with 'ping A records',and got right messages with 'dig'

Code:

ping server.example.com
PING server.example.com (192.168.10.1) 56(84) bytes of data.
64 bytes from server.example.com (192.168.10.1): icmp_seq=1 ttl=64 time=0.069 ms
64 bytes from server.example.com (192.168.10.1): icmp_seq=2 ttl=64 time=0.056 ms
64 bytes from server.example.com (192.168.10.1): icmp_seq=3 ttl=64 time=0.070 ms

Code:

dig server.example.com
; <<>> DiG 9.9.4-RedHat-9.9.4-29.el7 <<>> server.example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58357
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;server.example.com.		IN	A
;; ANSWER SECTION:
server.example.com.	3600	IN	A	192.168.10.1
;; Query time: 0 msec
;; SERVER: 192.168.10.1#53(192.168.10.1)
;; WHEN: Thu Jan 19 04:28:12 EST 2017
;; MSG SIZE  rcvd: 63

BUT FAILED with CNAME records with ping/dig

Code:

ping mail.example.com
ping: unknown host mail.example.com

Code:

dig mail.example.com

; <<>> DiG 9.9.4-RedHat-9.9.4-29.el7 <<>> mail.example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57823
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;mail.example.com.		IN	A
;; AUTHORITY SECTION:
example.com.		36000	IN	SOA	server.example.com. root. 2017011701 3600 600 86400 3600
;; Query time: 0 msec
;; SERVER: 192.168.10.1#53(192.168.10.1)
;; WHEN: Fri Jan 20 08:57:39 EST 2017
;; MSG SIZE  rcvd: 92

but seems ok with 'dig -t cname'

Code:

dig -t cname mail.example.com

; <<>> DiG 9.9.4-RedHat-9.9.4-29.el7 <<>> -t cname mail.example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4297
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;mail.example.com.		IN	CNAME
;; ANSWER SECTION:
mail.example.com.	3600	IN	CNAME	server.example.com.
;; Query time: 0 msec
;; SERVER: 192.168.10.1#53(192.168.10.1)
;; WHEN: Fri Jan 20 08:59:09 EST 2017
;; MSG SIZE  rcvd: 66

bathory · 01-20-2017, 03:32 PM

Hi,

From the documentation, looks like unbound does not support (well) some special records

Quote:

If you need more complicated authoritative data, with referrals,
wildcards, CNAME/DNAME support, or DNSSEC authoritative service,
setup a stub-zone for it as detailed in the stub zone section

The same is reported hereYou can ditch CNAMEs and use A RRs, that is also faster as it needs just one lookup instead of 2 needed to resolve a CNAME

If you still want to use CNAMEs, better use bind, or else use a stub resolver as mentioned in the above unbound documentation

Regards