BIND 9.3.3 split dns recursion disallow

twantrd · 12-15-2006, 03:05 PM

Hi guys,

I'm setting up split views (internal/external) on BIND 9.3.3. I allow recursion for my internal clients (ie. office, branches, etc..) but disallow recursion for external. Doing a MX query from the outside with nslookup on a windows box against my domain doesn't show anything but it's completely fine with linux. Weird. Is this a nslookup bug on windows? If I allow recursion for my external view, then nslookup on windows works! However, I don't want to allow recursion for the external view but I'm afraid that exchange servers from other companies won't be able to deliver mail to mine.

Any ideas? Anyone have this issue?

-twantrd

chort · 12-15-2006, 04:23 PM

You should probably post your named.conf as well as the results of nslookup from Windows & dig from Linux (both external). There are way too many variables that could cause the results to be different for anyone to give an anwer based on what you've provided so far.

twantrd · 12-15-2006, 06:12 PM

I modified the configs to no longer use split dns as I thought that could be the issue. However, it's not and the result is the same. Below is named.conf:

Code:

options {
        directory "/etc";
        query-source address * port 53;
        pid-file "/var/run/named.pid";
        statistics-file "/var/run/named.stats";
        zone-statistics yes;
        //allow-recursion { "corp_internal"; };
        recursion no;
};

include "security.conf";
include "master.conf";
include "arpa.conf";

// Cache Zone
zone "." {
        type hint;
        file "named.root";
};

Here is my master.conf:

Code:

//Zone files go here

zone "mydomain.com" {
              type master;
              file "master/mydomain.com";
};

Below is the lookup from a windows machine hitting the external ip address of the nameserver:

Code:

C:\Documents and Settings\bob>nslookup
Default Server:  dc1.mydomain.com
Address:  10.11.1.12

> server <outside ip address>
Default Server:  [outside ip address]
Address:  <outside ip address>

> set q=mx
> mydomain.com
Server:  [outside ip address]
Address:  <outside ip address

domain.com nameserver = ns2.gushi.org
domain.com nameserver = ns.gushi.org
ns.gushi.org    internet address = 8.7.49.254
ns2.gushi.org   internet address = 72.9.101.132
>

Now, here is nslookup from a linux workstation:

Code:

[root@dev01 ~]# nslookup
> server <outside ip address>
Default server: <outside ip address>
Address: <outside ip address>#53
> set q=mx
> mydomain.com
Server:         <outside ip address>
Address:        <outside ip address>#53

mydomain.com        mail exchanger = 5 mail.mydomain.com.
>

Both the linux workstation and the windows workstation are on the same network (same vlan). It's completely weird that nslookup on linux works fine but not on windows. Running dig on linux shows a successful result as well.

-twantrd