Upload
others
View
8
Download
0
Embed Size (px)
Citation preview
Domain NameSystem
TechnologyOverview (DNS and Bind)
DECUS 96
NetBU SE TrainingSlide 2
DNS Roadmap
• DNS Introduction and OverviewFunction of DNS Client, DNS Server
• DNS TerminologyDNS Resource Records
• Types of Nameservers
• DNS Hints
Introduction
DECUS 96
NetBU SE TrainingSlide 4
Yellow Pages
What is the number for ???
The situation...
NetBU SE TrainingSlide 5
In the beginning...
• Systems used host tables for name toaddress translation
• When size of the Internet grew to about1000 hosts in 1984, it became obviousthat host tables would not scale well asthe Internet continued to grow
• All hosts need to have their host tablesupdated when hosts are added orremoved
NetBU SE TrainingSlide 6
Implementations...
• BINDBerkeley (Unix)
• WINSMicrosoft
• NIS (“Yellow Pages”)Sun
• DECdnsDigital
NetBU SE TrainingSlide 7
Domain Name System
• Also called BINDBerkeley Internet Name Domain
• Distributed databaseNot all information is in one place
Entire database is not centrally managed
Both a feature and a potential weakness
• DNS Resource RecordsA, PTR, MX, HINFO, TXT, NS, SOA, CNAME
NetBU SE TrainingSlide 8
DNS Non-Functions
• DNS does not control routing
• DNS does not affect IP connectivity
However,
• When hostnames can not be translateddue to DNS failure, the user oftenassumes that the network is down
NetBU SE TrainingSlide 9
DNS host naming
• Fully-Qualified Domain Names (FQDN)
most specific least specific
host.subdomain.domaincone.tgv.com
www.tgv.com
hq.tgv.cisco.com
fog.isdn.cisco.com
eql.caltech.edu
NetBU SE TrainingSlide 10
DNS Structure
UCSC.EDUCALTECH.EDU
EDU
AMES.NASA.GOV
NASA.GOV FBI.GOV
GOV DE
HQ.TGV.COMCIA.TGV.COMWHATNO.TGV.COM
TGV.COM
COM
.
root domain
NetBU SE TrainingSlide 11
Nameservers
• Nameservers hold the DNS data orknow how to find the answer
• Each “dot” separates a subdomain
• Each subdomain may have anameserver associated with it that hasthe DNS data
host.department.organization.domain
NetBU SE TrainingSlide 12
Tasks of DNS Client (Resolver)
DNS Client(Resolver) DNS Server
Address record forCONE.TGV.COM?
answer = 161.44.128.80
$ TELNET cone.tgv.com... trying 161.44.128.80Connected
Welcome to CONE!
Username:
NetBU SE TrainingSlide 13
DNS Client
(Resolver)
query CONE.TGV.COM
RootNameserver
COM Nameserver
TGV.COMNameserver
cache noyes
Nameserver
Answer = 161.44.128.80
Tasks of the DNS server...
NetBU SE TrainingSlide 14
If partial answer is known...
DNS Client
(Resolver)
query HQ.TGV.COM
RootNameserver
COM Nameserver
TGV.COMNameserver
cache
noyes
Nameserver
Answer = 161.44.72.2
DNS nameserver remembers previous domain responses
NetBU SE TrainingSlide 15
“Reverse” lookups
• Maintain right-to-left parsingMost generic to the right
Most specific to the left
• Reverse IP Addresses
192.3.127.32 32.127.3.192.in-addr.arpa
161.44.128.70 70.128.44.161.in-addr.arpa
cone.tgv.com
PTR records
most specific least specific
least specific most specific
32
127
3
192
IN-ADDR
.
DNSNameservers
DECUS 96
NetBU SE TrainingSlide 17
Types of nameservers
• Root nameserver
• Primary nameserver
• Secondary nameserver
• Caching-only nameserver
• Forwarder
• Slave
NetBU SE TrainingSlide 18
Root Nameservers
• Authoritative for root (“.”) domain
• Responsible for COM, EDU, GOV,ARPA, IE, US, DE, and other top-leveldomains, including IN-ADDR.ARPA
• Not one of your nameserversUnless you are not connected to the Internet
NetBU SE TrainingSlide 19
Delegation
• Delegation is giving part of a zone toanother nameserver
• Permits decentralized administrationDecentralization is DNS’s power
• Delegation can be done at any “.”
UCSC.EDU CALTECH.EDU
EDU
AMES.NASA.GOV
NASA.GOV FBI.GOV
GOV
HQ.TGV.COM CIA.TGV.COMWHATNO.TGV.COM
TGV.COM FORD.COM
COM
.root domain
NetBU SE TrainingSlide 20
Primary Nameserver
• Authoritative for a zone
• Configuration file (bootfile) identifiesthe database files with the resourcerecords
NetBU SE TrainingSlide 21
Primary Nameserver
Configuration file
cache . domain-name-service.cacheprimary 0.0.127.in-addr.arpa domain-name-service.localprimary tgv.com domain-name-service.tgvprimary 44.161.in-addr.arpa domain-name-service.tgv-net
zones
NetBU SE TrainingSlide 22
Secondary Nameserver
• Authoritative for a zone
• Automatically loads data from Primary
• Data is NOT maintained on thesecondary nameserver
• A backup datafile may be created andused for occasions when the primarynameserver is unavailable
NetBU SE TrainingSlide 23
Zone
• A ‘piece’ of a domainSuch as tgv.com, sales.tgv.com , enet.dec.com
• Zone fileDatafile that describes a zone
Contains the resources records
Maintained on the primary nameserver
UCSC.EDU CALTECH.EDU
EDU
AMES.NASA.GOV
NASA.GOV FBI.GOV
GOV
HQ.TGV.COM CIA.TGV.COMWHATNO.TGV.COM
TGV.COM FORD.COM
COM
.root domain
NetBU SE TrainingSlide 24
Sample Zone file
tgv.com. in soa vaxa.tgv.com. wing.tgv.com. ( 199501091 ; serial number 10800 ; refresh 3 hr 3600 ; retry 1 hr 604800 ; expire 1 wk 86400) ; min. TTL 1 day
tgv.com. in ns ns1.tgv.com.
ns1.tgv.com. in a 161.44.128.70
hq.tgv.com. in a 161.44.128.70 in hinfo VAXSTATION-4000-90 VMStgv.com. in mx 10 hq.tgv.com.
fang.tgv.com. in a 161.44.128.87 in mx 10 hq.tgv.com.
NetBU SE TrainingSlide 25
Zone Transfer
• The act of transferring a zone
• Typically from a Primary to SecondarySecondary checks SOA on Primary everyREFRESH seconds
Automatically
If serial number on Primary is higher,secondary gets copy of zone file
NetBU SE TrainingSlide 26
Secondary Asksfor SOA
SecondaryNameserver
PrimaryNameserver
SOA for zone TGV.COM?
SOA = vaxa.tgv.com system.vaxa.tgv.com 95090101 10800 3600 604800 86400
NetBU SE TrainingSlide 27
Secondary PerformsZone Transfer
SecondaryNameserver
PrimaryNameserver
“Please send methe zone”
Zone file
Secondarystashes copyof zone intomemory and ontodisk (for backup, so thatPrimary can be unavailablewhen Secondary reloads)
NetBU SE TrainingSlide 28
Secondary NameserverConfiguration file
cache . domain-name-service.cacheprimary 0.0.127.in-addr.arpa domain-name-service.localsecondary tgv.com 161.44.128.70 dns.tgv-bkpsecondary 44.161.in-addr.arpa 161.44.128.70 dns.tgv-net-bkp
161.44.128.70 = IP Address of primary nameserverfor this zone
backup files
zones
NetBU SE TrainingSlide 29
Caching-only Nameserver
• Responds to DNS resolver queries
• Caches answers
• Improves performance
• Recommended default DNSconfiguration
• Does not contain local DNS information(except for localhost, net#.in-addr.arpa)
NetBU SE TrainingSlide 30
Caching-only Nameserver
Configuration file
cache . domain-name-service.cache
primary 0.0.127.in-addr.arpa domain-name-service.local
NetBU SE TrainingSlide 31
Forwarder
• If answer is not in cache, send query toForwarder
Not necessary for DNS to function
Improves performance
• If Forwarder doesn’t respond, act normallySend query to root nameservers
cache . domain-name-service.cacheprimary 0.0.127.in-addr.arpa domain-name-service.local
forwarder 161.44.128.70
NetBU SE TrainingSlide 32
Slave
• Prevents communication to rootnameservers
• Useful when behind firewall
• Forwarder is required
cache . domain-name-service.cacheprimary 0.0.127.in-addr.arpa domain-name-service.local
forwarder 161.44.128.70slave
DNSHints
DECUS 96
NetBU SE TrainingSlide 34
Location of Nameservers
• Your IP network relies on nameservingNameservers must be accessible and running
• 2-3 nameservers besttwo on-site, one off-site
Configure clients to know about a localnameserver and a remote nameserver
Many IP implementations make it awkward toconfigure clients to use more than onenameserver
NetBU SE TrainingSlide 35
No Internet Connection
• Pseudo-root nameserver necessary fornon-internet connected sites
Because DNS needs root nameservers tofunction
• CACHE file must be modified on allnameservers
Or possible nameserver corruption can occur
NetBU SE TrainingSlide 36
NSLOOKUP
• NSLOOKUP requires lowercasecommands
Verify DNS information$ multinet nslookupDefault Server: LOCALHOSTAddress: 127.0.0.1
> set query=any> cone.tgv.comServer: LOCALHOSTAddress: 127.0.0.1
cone.tgv.com canonical name = Cone-Of-Silence.TGV.COMTGV.COM nameserver = NS1.TGV.COMTGV.COM nameserver = NS2.TGV.COMTGV.COM nameserver = EQL.Caltech.EduNS1.TGV.COM internet address = 161.44.72.2NS2.TGV.COM internet address = 161.44.224.2
EQL.Caltech.Edu internet address = 131.215.29.1
NetBU SE TrainingSlide 37
NSLOOKUP, Cont.
• Verify reverse name mapping> set query=ptr> 161.44.192.51Server: LOCALHOSTAddress: 127.0.0.1
51.192.44.161.in-addr.arpa name = Cone-Of-Silence.TGV.COM44.161.IN-ADDR.ARPA nameserver = NS1.TGV.COM44.161.IN-ADDR.ARPA nameserver = NS2.TGV.COM44.161.IN-ADDR.ARPA nameserver = EQL.Caltech.EduNS1.TGV.COM internet address = 161.44.72.2NS2.TGV.COM internet address = 161.44.224.2EQL.Caltech.Edu internet address = 131.215.29.1
NetBU SE TrainingSlide 38
DNS Myths
• 1. Configuration file needs FORWARDERFalse: not required
DNS works by going down DNS tree
• 2. CACHE file contains “my” nameserversFalse: It contains the root nameservers
Your nameservers are found by going down DNS tree
• 3. Using 127.0.0.1 for resolver won’t workTrue: It is the best configuration if your system is anameserver itself (and is the only way to get caching)
NetBU SE TrainingSlide 39
Common configuration errors
• Syntax errorsNo trailing “.” when needed
Trailing “.” inserted when it shouldn’t be
• Pointer records (reverse lookups) areoften forgotten
• Serial number is not increased whenchanges are made
• Records pointing to configuration filesare not accurate
NetBU SE TrainingSlide 40
“The” book on DNS
• DNS and BIND in a NutshellBy Paul Albitz and Cricket Liu
Published by O’Reilly & Associates
300+ pages. Excellent reference.
Domain NameSystem
TechnologyOverview (DNS and Bind)
DECUS 96
Domain Name Service (DNS)Domain Name Service (DNS)TroubleshootingTroubleshooting
Jan Trumbo [email protected]
Slide 2
DECUS
Fall 1996
AnaheimDNS Reference book
DNS and BIND in a NutshellWritten by Paul Albitz and Cricket LiuPublished by O’Reilly & AssociatesCopyright 1992
New edition due December 1996www.ora.com for ordering info
DNS TerminologyDNS Terminology
Slide 4
DECUS
Fall 1996
AnaheimTerminology Roadmap
ZoneZone fileZone transfer
AuthoritativeRoot nameserverDelegation (Nameserver Delegation)Resource Records
Slide 5
DECUS
Fall 1996
AnaheimZone
A ‘piece’ of a domainSuch as tgv.com, sales.tgv.com
Zone fileDatafile that describes a zone
Zone transfersending zone file from primary to secondary
Slide 6
DECUS
Fall 1996
AnaheimExample Zone file
@ in soa vaxa.tgv.com. wing.tgv.com. ( 9501091 ; serial number 10800 ; refresh 3 hr 3600 ; retry 1 hr 604800 ; expire 1 wk 86400) ; min. TTL 1 day@ in ns ns1.tgv.com.ns1.tgv.com. in a 161.44.128.70hq.tgv.com. in a 161.44.128.70tgv.com. in mx 10 hq.tgv.com.fang.tgv.com. in a 161.44.128.87
Slide 7
DECUS
Fall 1996
AnaheimZone Transfer
The act of transferring a zoneTypically from a Primary to Secondary
Secondary checks SOA on PrimaryThe Secondary “pulls” the file
NSLOOKUP (debugging tool) also doeszone transfers (using ls -d )Performed over TCP port 53
Slide 8
DECUS
Fall 1996
Anaheim
Secondary Asking forSerial Number
SecondaryNameserver
PrimaryNameserver
Serial number?
Serial number = 95012601
Slide 9
DECUS
Fall 1996
Anaheim
Secondary PerformsZone Transfer
SecondaryNameserver
PrimaryNameserver
“Please send methe zone”
Zone file
Secondarystashes copyof zone intomemory and ontodisk (for backup, so thatPrimary can be unavailablewhen Secondary reloads)
Slide 10
DECUS
Fall 1996
AnaheimAuthoritative Answer
Authoritative Answer bit is set on answerTypically only seen with NSLOOKUPUseful for debuging
Only set by Primary or SecondaryIndicates the nameserver thinks it isauthoritative for the zone
Slide 11
DECUS
Fall 1996
AnaheimRoot Nameservers
Authoritative for root (“.”) domainResponsible for COM, EDU, GOV, and othertop-level domainsTypically, not one of your nameservers
Unless you’ve set up pseudo- (fake-) rootnameserver
Slide 12
DECUS
Fall 1996
AnaheimRoot Nameservers
Don’t perform recursive queriesThey cannot get answers for youOnly point you to other nameserversThis reduces their load
Initial list of roots is in CACHE entryUp-to-date list of root nameservers isautomatically obtained and used
However, on-disk CACHE file isn’t changed
Slide 13
DECUS
Fall 1996
AnaheimDelegation
Delegation is giving part of a zone to anothernameserverPermits decentralized administrationDelegation can be done at any subdomain,and can be done to any arbitrary depth
24
Slide 14
DECUS
Fall 1996
AnaheimResource Records
Data in zone file that describes the zone
APTRMXNSSOA
HINFOWKSTXTCNAME
Slide 15
DECUS
Fall 1996
AnaheimResource Record Overview
ZoneRequired: SOA, NS, A
Host (forward lookup)Required: AOptional: MX, WKS, HINFO, (CNAME)
Host (inverse lookups)Required: PTR
Slide 16
DECUS
Fall 1996
AnaheimMultiple Resource Records
Multiple Resource Records are legal tgv-router.tgv.com. in a 161.44.128.1 tgv-router.tgv.com. in a 161.44.129.1 tgv-router.tgv.com. in a 161.44.130.1 tgv.com. in mx 10 hq.tgv.com. tgv.com. in mx 10 cone.tgv.com. tgv.com. in mx 20 fang.tgv.com.
Useful for multi-homed hosts, or for hoststhat have duplicate features
optional
Slide 17
DECUS
Fall 1996
AnaheimA Record
Address recordHostname to IP address mapping
cone.tgv.com. in a 161.44.128.98 hq.tgv.com. in a 161.44.128.70
Slide 18
DECUS
Fall 1996
AnaheimPTR Record
Pointer record - also called ‘inverse’IP address to hostname mappingOften incorrectly configured, or forgottenRequired for some services to function
“r” Services, some FTP ServersPTRs are what causes hostname inSHOW USERS/FULL displayUses ‘inverted’ IP addresses:
71.128.44.161.in-addr.arpa. in ptr hq.tgv.com.72.128.44.161.in-addr.arpa. in ptr fang.tgv.com.73.128.44.161.in-addr.arpa. in ptr tide.tgv.com.74.128.44.161.in-addr.arpa. in ptr wash.tgv.com.
Slide 19
DECUS
Fall 1996
AnaheimMX Record
Mail exchanger recordDirects mail to a hostCan help provide simpler Email addressPreference value
Crude load balancingCan cause mail to spool at nearby system
tgv.com. in mx 10 cad.tgv.com.tgv.com. in mx 10 hq.tgv.com.tgv.com. in mx 20 fang.tgv.com.
Slide 20
DECUS
Fall 1996
AnaheimNS Record
Nameserver recordLists nameservers for the zoneShould agree with parent domain“Glue” records needed for names in samedomain
Nameservers need “A” recordstgv.com. in ns ns1.tgv.com.
Slide 21
DECUS
Fall 1996
AnaheimSOA Record
Start of Authority recordIndicates zone-wide information:
originating system for zone information(typically the primary nameserver)
Email address of DNS administratorVarious numbers and times ...
82
Slide 22
DECUS
Fall 1996
AnaheimExample SOA Record
@ in soa vaxa.tgv.com. wing.tgv.com. ( 9501091 ; serial number 10800 ; refresh 3 hr 3600 ; retry 1 hr 604800 ; expire 1 wk 86400) ; min. TTL 1 day
Slide 23
DECUS
Fall 1996
AnaheimSOA Record Fields
Serial numberIdentifies the ‘version’ of the zone fileHigher number means newer version
And causes zone transfers with Secondaries
Refresh time (seconds)How often Secondary checks the Primary’sserial numberIf serial number is higher, transfer zone
Retry time (seconds)If unable to check serial number at Refreshtime, keep retrying every Retry seconds
Slide 24
DECUS
Fall 1996
AnaheimMore SOA Record Fields
Expire time (seconds)How long Secondary remembers data if unableto do zone transfer with PrimaryIf exceeded, Secondary forgets everythingabout this zone
Minimum Time-To-Live (seconds)Also called “Default TTL”Default time a caching nameserver can cache aResource RecordCan be overridden on specific Resource Record
Slide 25
DECUS
Fall 1996
AnaheimHINFO Record
Host Information recordHuman-readable information
Usually Hardware type, Operating systemcone.tgv.com. in hinfo vax vmswhirr.tgv.com. in hinfo pc windows
Don’t record OS version - it will always beout of date
Slide 26
DECUS
Fall 1996
AnaheimWKS Record
Well Known Service recordOriginally intended to indicate which servicesrun on the host (FTP, TELNET, SMTP, etc.)Not consulted by any client applicationsNot very useful
Slide 27
DECUS
Fall 1996
AnaheimTXT Record
Text recordHuman-readable free-form informationLocation, owner, or humor
wade.tgv.com. in txt building-3
cad.tgv.com. in txt “Contrived Accident”cad.tgv.com. in txt “Division”
Slide 28
DECUS
Fall 1996
AnaheimCNAME Record
Canonical name recordHost alias nameUseful when renaming host, or host hasseveral functionswww.tgv.com. in cname zaphod.tgv.com.gopher.tgv.com. in cname zaphod.tgv.com.ftp.tgv.com. in cname hq.tgv.com.
Not recommended for mail aliases
TerminologyKey Concepts
Resource RecordsZone
Required: SOA, NS, AHost (forward lookup)
Required: AOptional: MX, WKS, HINFO, (CNAME)
Host (inverse lookups)Required: PTR
DNS TroubleshootingDNS Troubleshooting
Slide 31
DECUS
Fall 1996
AnaheimQuery types
Any of the Resource Records can bequeried
A, PTR, MX, SOA, TXT, etc.Can also send an “any” query
Returns contents of cache
Non-recursive queryUseful for debugging - causes nameserver toonly return information from its cache
Slide 32
DECUS
Fall 1996
AnaheimAnswers
Servers may return additional recordsMX query returns MX answers and A recordsNon-authoritative servers return NS records
Slide 33
DECUS
Fall 1996
AnaheimDebugging
DNS & BIND book is very usefulDetailed troubleshooting in chapter 12Information on various DNS configurationsSurviving outages to DNS server (p 175)
Firewalls can cause interesting DNSbehaviors
Check from ‘both sides’ of a firewall
Slide 34
DECUS
Fall 1996
Anaheim
DNS TroubleshootingUsing NSLOOKUP
Use NSLOOKUPDNS & BIND, Chapter 10Can tell if nameserver is authoritativeCan’t tell Primary from a SecondaryAvailable on Unix, VMS, many PCs
Slide 35
DECUS
Fall 1996
AnaheimUsing NSLOOKUP
Use lowercase with NSLOOKUPOnly single-line command recall$ multinet nslookupServer: LOCALHOSTAddress: 127.0.0.1>
Slide 36
DECUS
Fall 1996
Anaheim
NSLOOKUP Appends theDefault Domain
$ show log *domain*"MULTINET_SEARCHDOMAINS" = "Opus1.COM"
$ mu nslDefault Server: LOCALHOSTAddress: 127.0.0.1
> tennisServer: LOCALHOSTAddress: 127.0.0.1
Name: Tennis.Opus1.COMAddress: 192.245.12.2
> tennis.Server: LOCALHOSTAddress: 127.0.0.1
*** LOCALHOST can't find tennis.: Non-existent host/domain
Use final period todisable domainappends
Slide 37
DECUS
Fall 1996
Anaheim
NSLOOKUP Can QueryOther Nameservers
$ mu nslookupDefault Server: LOCALHOSTAddress: 127.0.0.1
>
> server ns.opus1.com
Default Server: ns.Opus1.COM
Address: 192.245.12.50
>
Queries the localresolver by default
Use the ‘server’command to sendqueries elsewhere
Slide 38
DECUS
Fall 1996
Anaheim
Find the Right Server FromWhois Database
$ whois dom opusone.comOpus One (OPUSONE-DOM) 1404 East Lind Road Tucson, AZ 85719
Domain Name: OPUSONE.COM
Administrative Contact: Julieta, Romeo (RJ9) [email protected] (602) 324-0494 Technical Contact, Zone Contact: Snyder, Joel M. (JMS56) [email protected] +1 520 324 0494 (FAX) +1 520 324 0495 (FAX) +1 520 324 0495
Record last updated on 25-Oct-96. Record created on 21-Jan-95.
Domain servers in listed order:
NS.OPUS1.COM 192.245.12.50 ARIZONA.EDU 128.196.128.233
Slide 39
DECUS
Fall 1996
Anaheim
Or, Find Servers From theRoot Servers
$ mu nslDefault Server: LOCALHOSTAddress: 127.0.0.1
> set type=ns> server d.root-servers.netDefault Server: D.ROOT-SERVERS.NETAddress: 128.8.10.90
> opusone.comServer: D.ROOT-SERVERS.NETAddress: 128.8.10.90
Authoritative answers can be found from:opusone.com nameserver = NS.OPUS1.COMopusone.com nameserver = ARIZONA.EDUNS.OPUS1.COM internet address = 192.245.12.50ARIZONA.EDU internet address = 128.196.128.233
Slide 40
DECUS
Fall 1996
Anaheim
Primary and SecondaryLook Alike
> set type=soa> server ns.opus1.comDefault Server: ns.Opus1.COMAddress: 192.245.12.50
> opusone.com.Server: ns.Opus1.COMAddress: 192.245.12.50
OpusOne.COM origin = NS.Opus1.COM mail addr = hostmaster.Opus1.COM serial = 1996110800 refresh = 86400 (1 days) retry = 7200 (2 hours) expire = 2592000 (30 days) minimum ttl = 604800 (7 days)
Notice we disabledomain appending toprevent unnecessarythrashing
Slide 41
DECUS
Fall 1996
Anaheim
... Or Is This One ThePrimary?
> server arizona.eduDefault Server: ARIZONA.EDUAddresses: 128.196.128.234, 128.196.128.233
> opusone.com.Server: ARIZONA.EDUAddresses: 128.196.128.234, 128.196.128.233
OpusOne.COM origin = NS.Opus1.COM mail addr = hostmaster.Opus1.COM serial = 1995072804 refresh = 86400 (1 days) retry = 7200 (2 hours) expire = 2592000 (30 days) minimum ttl = 604800 (7 days)
Only the DNSadministrators know forsure ... furthermore, itdoesn’t matter to you!
Slide 42
DECUS
Fall 1996
AnaheimLame Delegations
A ‘Lame Delegation’ occurs when a zone has beendelegated to a nameserver, and that nameserver isnot authoritative for the zone - i.e. no SOA recordThe most common DNS problemResults from lack of communication between DNSmanagers
Slide 43
DECUS
Fall 1996
AnaheimTracing Lame Delegations
> server d.root-servers.netDefault Server: d.root-servers.netAddress: 128.8.10.90
> set type=ns> aspect-ts.com.Server: d.root-servers.netAddress: 128.8.10.90
Non-authoritative answer:aspect-ts.com nameserver = NS1.ACES.COMaspect-ts.com nameserver = NS.OPUS1.COM
Authoritative answers can be found from:NS1.ACES.COM internet address = 192.195.240.1NS.OPUS1.COM internet address = 192.245.12.50
Slide 44
DECUS
Fall 1996
AnaheimNow Ask That Server
> server ns1.aces.com
Default Server: ns1.ACES.COM
Address: 192.195.240.1
> set type=soa
> aspect-ts.com.
Server: ns1.ACES.COM
Address: 192.195.240.1
*** ns1.ACES.COM can't find aspect-ts.com: Non-existenthost/domain
Whoops!
Slide 45
DECUS
Fall 1996
AnaheimA and PTR Mismatches
> set type=a> compurad.com.Server: ns.opus1.comAddress: 192.245.12.50
Name: compurad.COMAddress: 204.153.44.5
> set type=ptr> 204.153.44.5Server: ns.opus1.comAddress: 192.245.12.50
5.44.153.204.IN-ADDR.ARPA name = s5.204-153-44-NET.AccessOne.NET44.153.204.IN-ADDR.ARPA nameserver = NS.Opus1.COM44.153.204.IN-ADDR.ARPA nameserver = NS1.ACES.COMNS.Opus1.COM internet address = 192.245.12.50NS1.ACES.COM internet address = 192.195.240.1
Some applications care, somedon’t. This is NOT necessarily a
problem!
NSLOOKUP does the work ofreversing the IP number forus with type=ptr
Slide 46
DECUS
Fall 1996
AnaheimMail Looks at MX Records
> server ns.opus1.com
Default Server: ns.Opus1.COM
Address: 192.245.12.50
> set type=any
> mail.opusone.com
Server: ns.Opus1.COM
Address: 192.245.12.50
Mail.OpusOne.COM preference = 10, mail exchanger =mail.opus1.COM
Slide 47
DECUS
Fall 1996
Anaheim
But an MX to an MX is NotWhat You Think It Is
> mail.opus1.comServer: ns.Opus1.COMAddress: 192.245.12.50
Mail.Opus1.COM text = "Where Opus One gets mail"Mail.Opus1.COM preference = 10, mail exchanger = Cello.Opus1.COMMail.Opus1.COM preference = 15, mail exchanger = Tennis.Opus1.COMMail.Opus1.COM preference = 20, mail exchanger = Piano.Opus1.COMMail.Opus1.COM preference = 30, mail exchanger = Arizona.EDUMail.Opus1.COM internet address = 192.245.12.7Opus1.COM nameserver = ns.Opus1.COMOpus1.COM nameserver = Arizona.EDUCello.Opus1.COM internet address = 192.245.12.7Tennis.Opus1.COM internet address = 192.245.12.2Piano.Opus1.COM internet address = 192.245.12.69Arizona.EDU internet address = 128.196.128.233ns.Opus1.COM internet address = 192.245.12.50
Mail.OpusOne.COM preference = 10, mail exchanger =mail.opus1.COM
This is all you’repointing to
Slide 48
DECUS
Fall 1996
AnaheimYou Can’t Mail to a CNAME
$ mu nslDefault Server: LOCALHOSTAddress: 127.0.0.1
> set type=any> smtp.opusone.com.Server: LOCALHOSTAddress: 127.0.0.1
smtp.OpusOne.COM canonical name = mail.opus1.COMOpusOne.COM nameserver = ns.opus1.COMOpusOne.COM nameserver = NS1.ACES.COMOpusOne.COM nameserver = Arizona.EDUns.opus1.COM internet address = 192.245.12.50NS1.ACES.COM internet address = 192.195.240.1Arizona.EDU internet address = 128.196.128.233
Bad, bad DNSAdministrator!
Slide 49
DECUS
Fall 1996
Anaheim
TXT Records Are WorthChecking
> set type=any> tgv.com.Server: NS1.CISCO.COMAddress: 161.44.72.2
TGV.COM text = "Cisco Systems "TGV.COM text = "Internet Business Unit"TGV.COM text = "101 Cooper Street"TGV.COM text = "Santa Cruz, CA 95060"TGV.COM text = "(408) 457-5200 for main operator or salesassistance"
TGV.COM text = "(408) 457-5201 or [email protected] for technicalassistance"TGV.COM text = "This zone is being maintained by the UBERserver"
Presentation Copyright © 1996 Opus OneDNST11081996
Jan Trumbo [email protected]://ftp.opus1.com/decus/dns-trouble.powerpoint
DNS TroubleshootingDNS Troubleshooting