Class C / delegation reverse-lookup help with BIND

[jjay]

Hi all,

I have two nameservers A and B, serving-up mydomain.com and mydomain.net, both
on the same machine running under named. If I go to dnsreport.com and run a check,
it always gives me a "Reverse DNS entries for MX records" -- FAIL, but here's the
weird part: it's always only ONE of the nameservers, and it'll swap. Sometimes it
says A failed, and other times it says B failed, like BIND 9 can only serve-up one
reverse lookup at a time.

Our network is 1.2.3.3/28 where 1.2.3.3 is our router and .4 and .5 is the
same physical machine, serving-up both .4 and .5.

When I do a reverse lookup FROM WITHIN MY LAN, even telling it to
use MY DNS SERVER (192.168.0.1), I get a response from my ISP. I
don't understand why:


grampus:/var/lib/named/master # dig @192.168.0.1 -x 1.2.3.4

; <<>> DiG 9.2.3 <<>> @192.168.0.1 -x 1.2.3.4
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 40971
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;4.3.2.1.in-addr.arpa. IN PTR

;; AUTHORITY SECTION:
3.2.1.in-addr.arpa. 2592 IN SOA ns1.myisp.net. hostmaster.ns1.myisp.net. 2000010726 7200 3600 3600000 86400

;; Query time: 7 msec
;; SERVER: 192.168.0.1#53(192.168.0.1)
;; WHEN: Fri Jun 25 15:47:56 2004
;; MSG SIZE rcvd: 107



I don't see any errors in /var/log/messages when I restart named.

This new server setup has been running for about 2 hours now. Do I
need to be more patient for other caches to be updated, or is there an
error on my or my ISP's part (BOTH is always an option :) )??



This is my named.conf file:

options {
directory "/var/lib/named";
dump-file "/var/log/named_dump.db";
statistics-file "/var/log/named.stats";
query-source address * port 53;
transfer-source * port 53;
notify-source * port 53;
notify no;
};

logging {
channel syslog_queries {
syslog user;
severity debug;
};
category queries { syslog_queries; };
channel syslog_errors {
syslog user;
severity error;
};
category default { syslog_errors; };
category lame-servers { null; };
};

view "internal" {
match-clients { 127.0.0.1; 192.168.0.0/24; };

zone "." in {
type hint;
file "root.hint";
};

zone "localhost" in {
type master;
file "localhost.zone";
};

zone "0.0.127.in-addr.arpa" in {
type master;
file "127.0.0.zone";
};

zone "mydomain.com" {
type master;
file "master/private.mydomain.com.zone";
};

zone "mydomain.net" in {
type master;
file "master/private.mydomain.net.zone";
};

zone "0.168.192.in-addr.arpa" in {
type master;
file "master/0.168.192.in-addr.arpa.zone";
};

}; //end view internal

view "external" {

match-clients { any; };

zone "." in {
type hint;
file "root.hint";
};

zone "mydomain.net" in {
type master;
file "master/mydomain.net.zone";
};

zone "mydomain.com" in {
type master;
file "master/mydomain.com.zone";
};

zone "28/3.3.2.1.in-addr.arpa" in {
type master;
file "master/3.2.1.in-addr.arpa.zone";
};

}; //end view external


This is the mydomain.com.zone file:

$TTL 2D
mydomain.com. IN SOA ns1.mydomain.net. root.mydomain.com. (
2004062503 ; serial
2H ; refresh
2H ; retry
1W ; expiry
2D ) ; minimum
IN NS ns1.mydomain.net.
IN NS ns2.mydomain.net.
mydomain.com. IN MX 10 grampus
mydomain.com. IN A 1.2.3.4
mydomain.com. IN A 1.2.3.5
ns1.mydomain.net. IN A 1.2.3.4
ns2.mydomain.net. IN A 1.2.3.5
grampus IN A 1.2.3.4
grampus IN A 1.2.3.5
www IN CNAME grampus



This is the mydomain.net.zone file:

$TTL 2D
mydomain.net. IN SOA ns1.mydomain.net. root.mydomain.net. (
2004062401 ; serial
2H ; refresh
2H ; retry
1W ; expiry
2D ) ; minimum

IN NS ns1.mydomain.net.
IN NS ns2.mydomain.net.
mydomain.net. IN MX 10 grampus
ns1.mydomain.net. IN A 1.2.3.4
ns2.mydomain.net. IN A 1.2.3.5
grampus IN A 1.2.3.4
grampus IN A 1.2.3.5
www IN CNAME grampus


This is the reverse file:

$TTL 2D
28/3.3.2.1.in-addr.arpa. IN SOA ns1.mydomain.net. root.mydomain.net. (
2004062505 ; serial
2H ; refresh
2H ; retry
1W ; expiry
2D ) ; minimum

IN NS ns1.mydomain.net.

4 IN PTR ns1.mydomain.net.
5 IN PTR ns2.mydomain.net.


Thanks for any help.

[cowanrl]

By default, 28/3.3.2.1.in-addr.arpa is not where reverse lookups will be done for the 1.2.3.x address space. When you do a reverse lookup on 1.2.3.4, your DNS server will look for the answer in 3.2.1.in-addr.arpa. This will be hosted by your ISP which is why your reverse lookup replies always come from your ISP.

I suggest you read through RFC 2317. This explains how to set up reverse lookups when you have less than a full class C address. Go to http://www.rfc-editor.org and do a search on 2317.

We have a 27 bit class C address space at work. It required a special entry in my ISP's in-addr.arpa file for our address space so that I could host our own reverse zone. Until I did this, I had trouble with some of our customers rejecting e-mail from us because their mail server was doing a reverse lookup on the IP address of our server. Their server could never get the correct response so our e-mail was rejected.

The format of your 28/3.3.2.1.in-addr.arpa zone file is probably correct. However, you'll want to be sure you have an entry in it for your mail server.

I don't have access to my in-addr.arpa file here but if you want, I can post it when I get to work on Monday.

[jjay]

cowanri> Thanks so much for your help. The link you provided was extremely enlightening. I've added the MX record and will talk to our ISP first thing tomorrow morning to see what's required to get our two networks in sync. Hopefully I won't need your reverse file as an example, especially since I know it's a burden to post it, but I really appreciate the offer. Thanks again!