dns server not working

Discussion in 'ISPConfig 3 Priority Support' started by chief, Feb 20, 2025.

Page 1 of 2
  1. chief

    chief Member HowtoForge Supporter

    Hi,
    this morning the primary dns server stopped reposing to dns requests.
    port scan of IP show not listening
    i did "ispconfig_update --force" and had this error after saying no to ssl
    Code:
    [Thu 20 Feb 10:57:36 GMT 2025] Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: 6
    using https://intodns.com shows both nameservers not responding
     
    chief, Feb 20, 2025
    #1
  2. till

    till Super Moderator Staff Member ISPConfig Developer

    Your system can not resolve names, that's why you can not do an update. but that#s not really an issue as I won't recommend doing an update in such a case anyway as the config can not be wrong unless you manually altered it.

    Instead, restart bind with this command (Debian and Ubuntu):

    service named restart

    and check again if DNS works now.
     
    till, Feb 20, 2025
    #2
    chief likes this.
  3. chief

    chief Member HowtoForge Supporter

    Thanks Till,
    I restarted named, it did not complain.
    I ran
    Code:
    service named status
root@ns1:~# service named status
● named.service - BIND Domain Name Server
     Loaded: loaded (/lib/systemd/system/named.service; enabled; preset: enabled)
     Active: active (running) since Thu 2025-02-20 11:37:40 GMT; 29s ago
       Docs: man:named(8)
   Main PID: 5834 (named)
     Status: "running"
      Tasks: 8 (limit: 4643)
     Memory: 32.7M
        CPU: 156ms
     CGroup: /system.slice/named.service
             └─5834 /usr/sbin/named -f -u bind
    BUT!!
    Code:
    Feb 20 11:37:40 ns1 named[5834]: network unreachable resolving 'ns2.tlwebservies.co.uk/A/IN': 2001:502:2eda::3#53
    so, ?? firewall issue??
     
    chief, Feb 20, 2025
    #3
  4. till

    till Super Moderator Staff Member ISPConfig Developer

    Test if Bind responds to one of your zones locally by running this command on your DNS server:

    dig yourdomain.com

    replace yourdoamin.tld with a domain name you host. If this is ok and returns the correct IP, then you have a network or firewall issue and not a Bind DNS problem.
     
    till, Feb 20, 2025
    #4
    chief likes this.
  5. chief

    chief Member HowtoForge Supporter

    it does resolve to my external for all my hostnames to the correct external IP.
    So firewall issue
     
    chief, Feb 20, 2025
    #5
  6. chief

    chief Member HowtoForge Supporter

    when i do
    Code:
    dave@DavePC:~$ dig @ns2.tlwebservices.co.uk mail.thinkvans.com

; <<>> DiG 9.18.33-1~deb12u2-Debian <<>> @ns2.tlwebservices.co.uk mail.thinkvans.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 48595
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: bb8e8113e5b2f8ad0100000067b71912631fe7a44e165a57 (good)
;; QUESTION SECTION:
;mail.thinkvans.com.        IN    A

;; Query time: 0 msec
;; SERVER: 146.66.81.103#53(ns2.tlwebservices.co.uk) (UDP)
;; WHEN: Thu Feb 20 11:59:14 GMT 2025
;; MSG SIZE  rcvd: 75
    but using
    Code:
    https://intodns.com/tlsystems.co.uk
    states name servers not giving records.
    still nothing resolving
     
    chief, Feb 20, 2025
    #6
  7. till

    till Super Moderator Staff Member ISPConfig Developer

    This means you still have a network or firewall issue and not a DNS problem, or you deleted your main domain so that tlwebservices.co.uk ns2.tlwebservices.co.uk does not exist anymore in DNS or you deleted it at domain registry level.
     
    till, Feb 20, 2025
    #7
  8. chief

    chief Member HowtoForge Supporter

    No till, not deleted anything for tlwebservices.co.uk.
     
    chief, Feb 20, 2025
    #8
  9. chief

    chief Member HowtoForge Supporter

    It started working about 1 hr ago, i have asked the isp now if there was a routing issue as the firewall support (pfsense) stated
     
    chief, Feb 20, 2025
    #9
    till likes this.
  10. chief

    chief Member HowtoForge Supporter

    Hey,
    I believe all is ok now, i can ping the nameservers and the IP.
    I have some tinkering to do, looks like dns 2 cannot get updates from 1 or vice versa.
    so, i add a client, domain, email, mailbox etc, then dns and then secondary dns.
    I have multiserver setup with 2 dns servers.
    ns2 is not a mirror of ns1
    so i add records to DNS -> Zones -> WIZARD (fill in the info, naming ns1 and ns2), then i go back in to the domain -> ZONE SETTINGS and add to "Allow zone transfers to these IP's (comma seperated list): IP of ns2, then i goto Secondary DNS-ZONE -> ADD NEW Sec Zone and add the same domain.
    am i doing this wrong as i secondary cannot communicate to primary dns
    Code:
    Feb 21 13:17:16 ns2 named[187751]: transfer of 'tlsystems.uk/IN' from 146.66.81.102#53: failed while receiving responses: REFUSED
Feb 21 13:17:16 ns2 named[187751]: transfer of 'tlsystems.uk/IN' from 146.66.81.102#53: Transfer status: REFUSED
Feb 21 13:17:16 ns2 named[187751]: transfer of 'tlsystems.uk/IN' from 146.66.81.102#53: Transfer completed: 0 messages, 0 records, 0 bytes, 0.001 secs (0 bytes/sec) (serial 0)
     
    chief, Feb 21, 2025
    #10
  11. chief

    chief Member HowtoForge Supporter

    The isp confirm they fixed the issue.
    Following on from your post.
    My registrar for tlwebservices - i have entries for both ns1 and ns2 that point to both IP's.
    ispconfig for tlwebservices.co.uk -> dns -> zone
    2 entries, 1 for ns1 pointing to external IP and 1 for ns2 pointing to external IP.
    internally they use a 10.0.0.0 number inside.
    Code:
    dave@DavePC:~$ dig @ns2.tlwebservices.co.uk tlsystems.co.uk

; <<>> DiG 9.18.33-1~deb12u2-Debian <<>> @ns2.tlwebservices.co.uk tlsystems.co.uk
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 53341
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 090814ea91ebda420100000067c5e6f6f1d8584ea384f847 (good)
;; QUESTION SECTION:
;tlsystems.co.uk.        IN    A

;; Query time: 0 msec
;; SERVER: 146.66.81.103#53(ns2.tlwebservices.co.uk) (UDP)
;; WHEN: Mon Mar 03 17:29:26 GMT 2025
;; MSG SIZE  rcvd: 72
    to me this looks good, but when i use mxtoolbox.com or intodns.com they both state ns2 is not responding.
    any ideas?
     
    chief, Mar 3, 2025
    #11
  12. till

    till Super Moderator Staff Member ISPConfig Developer

    The ns2 server is not working, you see that from the word "SERVFAIL". Login to the server ns2.tlwebservices.co.uk with SSH and run the command:

    dig @localhost tlsystems.co.uk

    which output do you get then?
     
    till, Mar 3, 2025
    #12
  13. chief

    chief Member HowtoForge Supporter

    Hey Till
    Code:
    root@ns2:~# dig @localhost tlsystems.co.uk

; <<>> DiG 9.18.33-1~deb12u2-Debian <<>> @localhost tlsystems.co.uk
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 24934
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 62a53a2fb4e7b84d0100000067c70663b3408377c1c200dd (good)
;; QUESTION SECTION:
;tlsystems.co.uk.        IN    A

;; Query time: 4 msec
;; SERVER: ::1#53(localhost) (UDP)
;; WHEN: Tue Mar 04 13:55:47 GMT 2025
;; MSG SIZE  rcvd: 72
     
    chief, Mar 4, 2025
    #13
  14. till

    till Super Moderator Staff Member ISPConfig Developer

    Ok, so this zone is not working on the server at all. Please run the same command on ns1 so we can see if it works there.
     
    till, Mar 4, 2025
    #14
  15. chief

    chief Member HowtoForge Supporter

    root@ns1:~# dig @tlsystems.co.uk

    ; <<>> DiG 9.18.33-1~deb12u2-Debian <<>> @tlsystems.co.uk
    ; (1 server found)
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2473
    ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 1

    ;; OPT PSEUDOSECTION:
    ; EDNS: version: 0, flags:; udp: 1424
    ;; QUESTION SECTION:
    ;. IN NS

    ;; ANSWER SECTION:
    . 86400 IN NS f.root-servers.net.
    . 86400 IN NS e.root-servers.net.
    . 86400 IN NS k.root-servers.net.
    . 86400 IN NS h.root-servers.net.
    . 86400 IN NS l.root-servers.net.
    . 86400 IN NS j.root-servers.net.
    . 86400 IN NS a.root-servers.net.
    . 86400 IN NS d.root-servers.net.
    . 86400 IN NS i.root-servers.net.
    . 86400 IN NS c.root-servers.net.
    . 86400 IN NS g.root-servers.net.
    . 86400 IN NS b.root-servers.net.
    . 86400 IN NS m.root-servers.net.

    ;; Query time: 12 msec
    ;; SERVER: 146.66.81.98#53(tlsystems.co.uk) (UDP)
    ;; WHEN: Tue Mar 04 13:54:07 GMT 2025
    ;; MSG SIZE rcvd: 239
     
    chief, Mar 4, 2025
    #15
  16. till

    till Super Moderator Staff Member ISPConfig Developer

    Please use this command:

    Code:
    dig @localhost tlsystems.co.uk
     
    till, Mar 4, 2025
    #16
  17. chief

    chief Member HowtoForge Supporter

    Sorry
    Code:
    root@ns1:~# dig @localhost tlsystems.co.uk

; <<>> DiG 9.18.33-1~deb12u2-Debian <<>> @localhost tlsystems.co.uk
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61157
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 0435a6faf04773690100000067c71a2f69e886b0f92c5dad (good)
;; QUESTION SECTION:
;tlsystems.co.uk.        IN    A

;; ANSWER SECTION:
tlsystems.co.uk.    3600    IN    A    146.66.81.98

;; Query time: 0 msec
;; SERVER: ::1#53(localhost) (UDP)
;; WHEN: Tue Mar 04 15:20:15 GMT 2025
;; MSG SIZE  rcvd: 88
     
    chief, Mar 4, 2025
    #17
  18. till

    till Super Moderator Staff Member ISPConfig Developer

    Ok, so this server works. How is the secondary connected to the primary server? Do you use ISPConfig server mirroring, or do you use a BIND slave zone?
     
    till, Mar 4, 2025
    #18
  19. chief

    chief Member HowtoForge Supporter

    chief, Mar 4, 2025
    #19
  20. chief

    chief Member HowtoForge Supporter

    to clarify, under secondary dns zone
    NS (IP-address) = 146.66.81.102 (primary NS)
    Allow zone transfers to these IP's = 146.66.81.103

    is this correct - the manual says it is
     
    chief, Mar 4, 2025
    #20
Page 1 of 2

Share This Page