S
S
Sergey2021-07-21 16:41:56
Domain Name System
Sergey, 2021-07-21 16:41:56

BIND9. Why does it stop resolving correctly?

Good afternoon!

Previously, I did not configure BIND9 and could not find a solution to the error.
It will be easier to explain with an example:
I have my own DNS server (10.1.2.2). In the "named.conf.options" file, it is configured to use the company's and google's DNS when resolving third-party resources:
forwarders {
10.1.1.2;
10.1.1.3;
10.1.1.4;
8.8.8.8;
8.8.4.4;
};
There are servers that use our DNS as the default by default.
At some point, it happens that when you try to resolve any internal resource from these servers (for example, a file server or some kind of site), the record of which is on the corporate DNS, our DNS gives out the external IP of the company. Moreover, the resource itself is not tied to it and does not have access outside.
At the same time, if you try to resolve any resource that has a record on our DNS server, there are no problems. This behavior only happens with records outside of our DNS. If we restart the BIND service on our dns server, the problem temporarily goes away.

I included debug logs, but I can't figure out what the problem is.
Compared settings with corporate DNS. In addition to different IP differences, I did not see.
If you need to provide any config, say what you need.

Answer the question

In order to leave comments, you need to log in

2 answer(s)
V
Vladimir Pilipchuk, 2021-08-05
@SLIDERWEB

Very similar to a split dns problem. Responses to recursive requests from outside get into the cache. But since the server does not have the ability to understand where the request came from, it gives answers from the general heap.
If you want the responses for the wreath and are somehow controlled internally, use the view functionality.

S
Sergey, 2021-08-05
@Lait_II

Vladimir Pilipchuk , the problem is still in the response speed of DNS servers. Removed from the list of DNS from google. Wrong answers stopped coming.
But then the question is: how to make it so that, if necessary, bind could access them if the corporate DNS does not respond? Where to indicate it? Or is it possible to set the priority of sending requests to other DNS?

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question