Nameserver error "Nameserver ns-b.xxxxxxxxx.zzz cannot be queried for SOA" with mirrored DNS servers

Discussion in 'Installation/Configuration' started by Masters of Media, Jun 6, 2022.

  1. Masters of Media

    Masters of Media New Member HowtoForge Supporter

    I have a multiserver setup with 2 nameservers, ns-a.xxxxxxxxx.zzz and ns-b.xxxxxxxxx.zzz . Server ns-b.xxxxxxxxx.zzz is set to be a mirror of ns-a.xxxxxxxxx.zzz . The servers are in sync (I checked the databases). Both have a firewall entry allowing UDP on port 53. Both have a set of IPv4 and IPv6 addresses in the list of server IP addresses. The servers have IP addresses in completely different IP ranges.
    I have made a DNS zone in ISPConfig for a domain. The DNS zone values for that domain are replicated to nameserver ns-b.xxxxxxxxx.zzz correctly.
    Yet, when I try to assign both nameservers as nameservers for this domain wth the registrar, I get an error
    "Nameserver ns-b.xxxxxxxxx.zzz cannot be queried for SOA"
    for nameserver ns-b.xxxxxxxxx.zzz . I used several onine tools and indeed the second nameserver ns-b.xxxxxxxxx.zzz does not return any values for the domain at all.
    What could be wrong and how to set things correctly so I can start using the DNS servers ?
    Thanks !
    Erik
     
  2. till

    till Super Moderator Staff Member ISPConfig Developer

    please run the command:

    dig @localhost yourdomain.tld

    on the second server and post the result. Replace just yourdomain.tld in the command with the domain name of the affected DNS zone.
     
  3. Masters of Media

    Masters of Media New Member HowtoForge Supporter

    Here's the result:

    # dig @localhost ns-b.yourdomain.tld

    ; <<>> DiG 9.16.1-Ubuntu <<>> @localhost ns-b.yourdomain.tld
    ; (1 server found)
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56050
    ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

    ;; OPT PSEUDOSECTION:
    ; EDNS: version: 0, flags:; udp: 4096
    ; COOKIE: 22a63e1525ccd05101000000629e4604fbfe2b256003ed5a (good)
    ;; QUESTION SECTION:
    ;ns-b.yourdomain.tld. IN A

    ;; ANSWER SECTION:
    ns-b.yourdomain.tld. 60 IN A 136.144.xxx.xx (edited for privcay, the correct IP address is shown)

    ;; Query time: 4 msec
    ;; SERVER: 127.0.0.1#53(127.0.0.1)
    ;; WHEN: Mon Jun 06 18:23:00 UTC 2022
    ;; MSG SIZE rcvd: 95
     
  4. till

    till Super Moderator Staff Member ISPConfig Developer

    I guess the domain you used is wrong, you should not query the nameservers a-record, you should query the domain that's not working. So again:

    dig @localhost yourdomain.tld

    Replace just yourdomain.tld in the command with the domain name of the affected DNS zone.

    so let's say you have a problem with the domain mycustomer.tld, then the command is:

    dig @localhost mycustomer.tld

    and that has to be run on the second name server
     
  5. Masters of Media

    Masters of Media New Member HowtoForge Supporter

    Sorry, didn't understand you correclty the first time. Here's the output, command run from the second nameserver querying for the domain that's not working / can not use the nameservers:

    # dig @localhost mydomain.tld

    ; <<>> DiG 9.16.1-Ubuntu <<>> @localhost mydomain.tld
    ; (1 server found)
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18247
    ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

    ;; OPT PSEUDOSECTION:
    ; EDNS: version: 0, flags:; udp: 4096
    ; COOKIE: 05cab2ab73272c9d01000000629e4c5f92bc9ed2b20483eb (good)
    ;; QUESTION SECTION:
    ;mydomain.tld. IN A

    ;; ANSWER SECTION:
    mydomain.tld. 60 IN A 149.210.xxx.xx (shows correct IP address)

    ;; Query time: 36 msec
    ;; SERVER: 127.0.0.1#53(127.0.0.1)
    ;; WHEN: Mon Jun 06 18:50:07 UTC 2022
    ;; MSG SIZE rcvd: 92
     
  6. Taleman

    Taleman Well-Known Member HowtoForge Supporter

    Use the same command on the working name server, you see the answer is different.
    Something is wrong on second name server, it does not have all the information of the domain / zone. Check name server logs, or ispconfig logs to see why data is not transferred.
    My signature has link to DNS setup tutorial.
     
    Masters of Media likes this.
  7. Masters of Media

    Masters of Media New Member HowtoForge Supporter

    Thanks @Taleman , I'll look into it with that info.
     

Share This Page