I have introduced some error in my dns resolution and I would like some help fixing it as I cannot seem to detect what I have done wrong. Briefly the setup is this:
name servers: DNS01 - 216.185.71.33 DNS02 - 209.47.176.33 DNS03 - 216.185.71.34 DNS04 - 209.47.176.34 - offline
DNS01 is a master DNS02-04 are slaves of 216.185.71.33
All are listed as authoritative for the zone test.com
The following tests are run from a caching name server configured to forward queries as follows:
/etc/resolv.conf search hamilton.harte-lyne.ca harte-lyne.ca harte-lyne.com halisp.net nameserver 0.0.0.0 nameserver 216.185.71.33 nameserver 209.47.176.33
Extract from /etc/named.conf ... forwarders { 216.185.71.33; 209.47.176.33; 216.185.71.34; 209.47.176.34; }; forward first; }; ...
The intent of our setup is that if any server goes offline then the remaining servers will continue to answer queries. To further protect against outages DNS02 and DNS04 (currently offline) are on a separate netblock at a physically remote location. However, this is not what appears to happen when I test it. This are the results that I get when DNS01-03 are all online together.
# dig @a.root-servers.net pop3.test.com +trace
; <<>> DiG 9.2.1 <<>> @a.root-servers.net pop3.test.com +trace ;; global options: printcmd . 518400 IN NS C.ROOT-SERVERS.NET. . 518400 IN NS G.ROOT-SERVERS.NET. . 518400 IN NS F.ROOT-SERVERS.NET. . 518400 IN NS B.ROOT-SERVERS.NET. . 518400 IN NS J.ROOT-SERVERS.NET. . 518400 IN NS K.ROOT-SERVERS.NET. . 518400 IN NS L.ROOT-SERVERS.NET. . 518400 IN NS M.ROOT-SERVERS.NET. . 518400 IN NS I.ROOT-SERVERS.NET. . 518400 IN NS E.ROOT-SERVERS.NET. . 518400 IN NS D.ROOT-SERVERS.NET. . 518400 IN NS A.ROOT-SERVERS.NET. . 518400 IN NS H.ROOT-SERVERS.NET. ;; Received 436 bytes from 198.41.0.4#53(a.root-servers.net) in 750 ms
com. 172800 IN NS A.GTLD-SERVERS.NET. com. 172800 IN NS B.GTLD-SERVERS.NET. com. 172800 IN NS C.GTLD-SERVERS.NET. com. 172800 IN NS D.GTLD-SERVERS.NET. com. 172800 IN NS E.GTLD-SERVERS.NET. com. 172800 IN NS F.GTLD-SERVERS.NET. com. 172800 IN NS G.GTLD-SERVERS.NET. com. 172800 IN NS H.GTLD-SERVERS.NET. com. 172800 IN NS I.GTLD-SERVERS.NET. com. 172800 IN NS J.GTLD-SERVERS.NET. com. 172800 IN NS K.GTLD-SERVERS.NET. com. 172800 IN NS L.GTLD-SERVERS.NET. com. 172800 IN NS M.GTLD-SERVERS.NET. ;; Received 506 bytes from 192.33.4.12#53(C.ROOT-SERVERS.NET) in 38 ms
test.com. 172800 IN NS dns01.harte-lyne.ca. test.com. 172800 IN NS dns02.harte-lyne.ca. test.com. 172800 IN NS dns03.harte-lyne.ca. ;; Received 107 bytes from 192.5.6.30#53(A.GTLD-SERVERS.NET) in 41 ms
pop3.test.com. 38400 IN CNAME imap.test.com. imap.test.com. 38400 IN CNAME imap.halisp.net. imap.halisp.net. 38400 IN CNAME imap-07.halisp.net. imap-07.halisp.net. 38400 IN CNAME imap-07.harte- lyne.ca. imap-07.harte-lyne.ca. 86400 IN CNAME inet07.hamilton.harte-lyne.ca. inet07.hamilton.harte-lyne.ca. 86400 IN A 216.185.71.27 harte-lyne.ca. 86400 IN NS dns01.harte- lyne.ca. harte-lyne.ca. 86400 IN NS dns02.harte- lyne.ca. harte-lyne.ca. 86400 IN NS dns03.harte- lyne.ca. harte-lyne.ca. 86400 IN NS dns04.harte- lyne.ca. ;; Received 329 bytes from 216.185.71.33#53(dns01.harte-lyne.ca) in 2 ms
However, if named on DNS01 is stopped and left running on DNS02 and DNS03 then this happens:
]# dig @a.root-servers.net pop3.test.com +trace
; <<>> DiG 9.2.1 <<>> @a.root-servers.net pop3.test.com +trace ;; global options: printcmd . 518400 IN NS I.ROOT-SERVERS.NET. . 518400 IN NS E.ROOT-SERVERS.NET. . 518400 IN NS D.ROOT-SERVERS.NET. . 518400 IN NS A.ROOT-SERVERS.NET. . 518400 IN NS H.ROOT-SERVERS.NET. . 518400 IN NS C.ROOT-SERVERS.NET. . 518400 IN NS G.ROOT-SERVERS.NET. . 518400 IN NS F.ROOT-SERVERS.NET. . 518400 IN NS B.ROOT-SERVERS.NET. . 518400 IN NS J.ROOT-SERVERS.NET. . 518400 IN NS K.ROOT-SERVERS.NET. . 518400 IN NS L.ROOT-SERVERS.NET. . 518400 IN NS M.ROOT-SERVERS.NET. ;; Received 436 bytes from 198.41.0.4#53(a.root-servers.net) in 37 ms
dig: Couldn't find server 'I.ROOT-SERVERS.NET': Name or service not known
So. The question is, what am I doing wrong? It has to be something simple but I cannot see it for the life of me.
Any and all help greatly appreciated.
Jim
-- *** e-mail is not a secure channel *** mailto:byrnejb.<token>@harte-lyne.ca James B. Byrne Harte & Lyne Limited vox: +1 905 561 1241 9 Brockley Drive fax: +1 905 561 0757 Hamilton, Ontario <token> = hal Canada L8E 3C3