Help with DNS

Discussion in 'Installation/Configuration' started by mrbronz, Dec 23, 2020.

  1. mrbronz

    mrbronz Member HowtoForge Supporter

    Setup:
    I have my main server "mydomain.com" running all but my DNS server
    I have 2 microservers running my DNS ns1.mydomain.com and ns2.mydomain.com
    All servers are run by the main server with the help of ISPConfig 3
    Apart from changing the nameservers on my domain registrar, I think its working!

    Problem:
    However, to be honest, I am experimenting and not sure of how to interpret the results from the dig command
    so when I do the
    dig @ns1.mydomain.com any mydomain.com

    I get the following:

    ; <<>> DiG 9.11.5-P4-5.1+deb10u2-Debian <<>> @ns1.mydomain.com ANY mydomain.com
    ; (1 server found)
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28986
    ;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 4

    ;; OPT PSEUDOSECTION:
    ; EDNS: version: 0, flags:; udp: 4096
    ; COOKIE: d7f1721e69793246d1bb8ec350d576140f8 (good)
    ;; QUESTION SECTION:
    ;mydomain.com. IN ANY

    ;; ANSWER SECTION:
    mydomain.com. 300 IN A 111.222.333.444 <<my correct external ip
    mydomain.com. 300 IN SOA ns1.my-isp.com. postmaster.my-isp.com. 2020122218 86400 300 3600000 300
    mydomain.com. 300 IN NS ns2.my-isp.com.
    mydomain.com. 300 IN NS ns3.my-isp.com.
    mydomain.com. 300 IN NS ns1.my-isp.com.

    ;; ADDITIONAL SECTION:
    ns1.my-isp.com. 23642 IN A 33.333.8.241
    ns2.my-isp.com. 23642 IN A 3.333.7.21
    ns3.my-isp.com. 23642 IN A 22.123.41.102

    ;; Query time: 198 msec
    ;; SERVER: 192.168.1.72#53(192.168.1.72)
    ;; WHEN: Wed Dec 23 11:16:39 GMT 2020
    ;; MSG SIZE rcvd: 253

    I get a similar response when I dig ns2.mydomain.com

    My question is, is this the correct response or have a missed or messed up something somewhere?

    Many thanks in advance
     
    Last edited: Dec 23, 2020
  2. Taleman

    Taleman Well-Known Member HowtoForge Supporter

    I don't know whether it is correct or not. Is the info shown the values you have entered in DNS and what you want shown?
    You seem to have three NS servers according to dig? And they are not ns1.mydomain.com and ns2.mydomain.com.
    My signature has link to DNS tutorial.
     
    ahrasis likes this.
  3. mrbronz

    mrbronz Member HowtoForge Supporter

    The three NS servers you mentioned are my domain reg NS servers. as the example shows nothing apart from the external IP and the main name is shown in the dig command.
    I believe I have followed the "How To Run Your Own DNS Servers (Primary And Secondary) With ISPConfig 3 "
    every step except for substituting my own name servers with my domain registrars.
    Any idea what I could look for to help shine a light on why it's not showing the correct results
     
  4. Th0m

    Th0m ISPConfig Developer Staff Member ISPConfig Developer

    You probably have to wait till the changes are propagated
     
  5. Taleman

    Taleman Well-Known Member HowtoForge Supporter

    If the authoritative name servers for your domain are the three name servers of your domain registrar, you are not running your own name servers. Or maybe you are, but they are not used.
    Hard to help any more. Ask someone you trust and who knows name service to check your setup, if you tell him/her your domain name the setup can be checked.
     
    ahrasis likes this.
  6. mrbronz

    mrbronz Member HowtoForge Supporter

    I have received several of these email warnings:

    server1.mydomain.com - 24.12.2020-09:42 - WARNING - Falsche Anfrage / Wrong QuerySQL-Query =
    INSERT INTO sys_log (server_id,datalog_id,loglevel,tstamp,message)
    VALUES (1, '521', 'LOGLEVEL_WARN', UNIX_TIMESTAMP(), 'Writing BIND domain file failed:
    /etc/bind/pri.mydomain.com zone mydomain.com/IN: NS \'ns1.mydomain.com\' has no address records
    (A or AAAA) zone mydomain.com/IN: NS \'ns2.mydomain.com\' has no address records (A or AAAA)
    zone mydomain.com/IN: not loaded due to errors.') -> 1366 (Incorrect integer value:
    'LOGLEVEL_WARN' for column `dbispconfig`.`sys_log`.`loglevel` at row 1)


    The contents of /etc/bind/pri.mydomain.com.err:

    $TTL 3600
    @ IN SOA ns1.mydomain.com. ns.mydomain.com. (
    2020122401 ; serial, todays date + todays serial #
    7200 ; refresh, seconds
    540 ; retry, seconds
    604800 ; expire, seconds
    3600 ) ; minimum, seconds
    ;

    mydomain.com. 3600 A 123.123.123.123
    www 3600 A 123.123.123.123
    mail 3600 A 123.123.123.123
    mydomain.com. 3600 NS ns1.mydomain.com.
    mydomain.com. 3600 NS ns2.mydomain.com.
    mydomain.com. 3600 MX 10 mail.mydomain.com.
    mydomain.com. 3600 TXT "v=spf1 mx a ~all"
    martin.mydomain.com 3600 A 123.123.123.123

    Not sure what to do with them or how to interpret them.

    Any help, please!
     
    Last edited: Dec 24, 2020
  7. Th0m

    Th0m ISPConfig Developer Staff Member ISPConfig Developer

    You need to create A (and eventual AAAA) records for ns1 and ns2 in your zone.
     
  8. mrbronz

    mrbronz Member HowtoForge Supporter

    Hi Th0m thanks for the fast response.

    Are the A records in addition to the NS records for the same NS1 and NS2 nameserver records?
    It just seems a little off that ISPCONFIG 3 template doesn't do this automatically if they are required
    I will try it now

    PS Do I use the external IP of my domain or the internal IP of the NS servers?
     
  9. Th0m

    Th0m ISPConfig Developer Staff Member ISPConfig Developer

    Yes, they need a A record. NS records define the nameservers for your domain, but to reach those nameservers you need to create A (and AAAA) records that point to them.

    The external IP as others can't reach your internal IP's.
     
  10. mrbronz

    mrbronz Member HowtoForge Supporter

    OK thanks, Th0m

    I did try internal IP and, you're quite right they don work, but unfortunately, neither to external IP

    I am not confident with AAAA records to implement them and to be honest I don't know where to start with them
     
  11. Th0m

    Th0m ISPConfig Developer Staff Member ISPConfig Developer

    Did you open port 53 in your firewall on the nameservers?

    AAAA records are used for IPv6 traffic, which is becoming bigger and bigger and I expect that not supporting IPv6 can already lead to problems.
     
    mrbronz likes this.
  12. ahrasis

    ahrasis Well-Known Member

    A or AAAA record functions are the same. Having either one is fine but having both is better.
     
  13. mrbronz

    mrbronz Member HowtoForge Supporter

    Yes I opened port 53
    Yes, I understand what the AAAA records are and I understand they are better as we all know that IPV4 will most likely be used less and less.
    However, I don't know how to create an IPV6
     
  14. Th0m

    Th0m ISPConfig Developer Staff Member ISPConfig Developer

    They are not the same and adding only one of them is not fine if you want to be reachable, especially important for nameservers.

    What doesn't work exactly? Can you elaborate?
     
    mrbronz likes this.
  15. mrbronz

    mrbronz Member HowtoForge Supporter

    As the first post above states

    dig @ns1.mydomain.com any mydomain.com
    is not returning the correct info.
    Not knowing how to take this problem is a little frustrating
     
  16. Th0m

    Th0m ISPConfig Developer Staff Member ISPConfig Developer

    That's the wrong syntax, you should use
    Code:
    dig recordtype example.com @ns1.example.com
     
  17. mrbronz

    mrbronz Member HowtoForge Supporter

  18. mrbronz

    mrbronz Member HowtoForge Supporter

    I get the same responce
     
  19. ahrasis

    ahrasis Well-Known Member

    I clearly said their functions are the same, I did not said they are the same.

    I don't think AAAA record is needed for dns server to be reachable, so long A record is set and vice versa, but having both are indeed better.

    https://www.plesk.com/wiki/aaaa-record/amp/
    IPV6 availability depends on your ISP or vps hosting company and not all are ipv6 ready, though most of them are.
     
    mrbronz likes this.
  20. mrbronz

    mrbronz Member HowtoForge Supporter

    Not sure if this is possible but looks like my ISP don't support IPV6

    [Edit]
    Nore do my domain provider
     

Share This Page