0

I'm trying to setup a DNS-Server for my Domains using Bind. The Server behaves correctly for noncustom Domains like google.com or github.com, but for my domains it always returns "SERVFAIL". I've already checked the zone file using named-checkzone which returns "OK".

My Zone config (defined in named.conf.local):

zone "michlfranken" {
  type master;
  file "/var/cache/bind/db.isiko404.dev";
};

My Options File:

options {
        directory "/var/cache/bind";

        // If there is a firewall between you and nameservers you want
        // to talk to, you may need to fix the firewall to allow multiple
        // ports to talk.  See http://www.kb.cert.org/vuls/id/800113

        // If your ISP provided one or more IP addresses for stable
        // nameservers, you probably want to use them as forwarders.
        // Uncomment the following block, and insert the addresses replacing
        // the all-0's placeholder.

        forwarders {
                80.241.218.68;
                46.182.19.48;
        };

        //========================================================================
        // If BIND logs error messages about the root key being expired,
        // you will need to update your keys.  See https://www.isc.org/bind-keys
        //========================================================================
        dnssec-validation yes;

        listen-on-v6 { any; };
        listen-on { any; };
};
isi_ko
  • 103
  • 1
  • 1
    `SERVFAIL` should appear in your logfiles, did you look at them. Also it is not a good idea to have both recursive and authoritative service on the same server. And are you sure about `zone "michlfranken"`? This is not a FQDN inside the IANA root. – Patrick Mevzek Oct 22 '22 at 18:18
  • Yeah, clarification about the zone name would be nice. named.conf may also help and named logs would also be helpfull. – Tomek Oct 22 '22 at 18:22

1 Answers1

0

The RHS (right-hand-side) of NS record CANNOT be a CNAME, it must be canonical name, defined as either or both A and AAA records. This is described here: In DNS can an IN NS point to a CNAME?

This is your NS record:

vesemir:~> dig @81.169.234.207 isiko404.dev ns +short
h2869709.stratoserver.net.
dns.isiko404.dev.

This is your dns.isiko404.dev record:

vesemir:~> dig @81.169.234.207 dns.isiko404.dev +norecurse +noall +answer
dns.isiko404.dev.       21600   IN      CNAME   s1.isiko404.dev.
s1.isiko404.dev.        21600   IN      A       81.169.234.207

Now, the name in zone clause should be your zone name and I guess it is "isiko404.dev", not "michlfranken".

I must say I am puzzled why I can query your server and don't see the error.

Tomek
  • 3,390
  • 1
  • 16
  • 10
  • 1
    The zone is not defined as `isiko404.dev` in the configuration snippet given... – Patrick Mevzek Oct 22 '22 at 18:18
  • "The RHS (right-hand-side) of NS record CANNOT be a CNAME, it must be canonical name, defined as either or both A and AAA records." This is true but in practice not a fatal error in `named-checkzone` AFAIK and not something that would triggerr a `SERVFAIL`. – Patrick Mevzek Oct 22 '22 at 18:20
  • Just noticed mismatch in zone name. Let's wait for indication if I guessed right... – Tomek Oct 22 '22 at 18:21
  • It seems to have been the mismatch in the zone name, I gues copy and past has it's down sides :D I'll look into that CNAME About you being able to query my Server, I'm switching from CoreDNS to Bind and just had CoreDNS running while Bind was down – isi_ko Oct 22 '22 at 21:44