I have introduced some error in my dns resolution and I would like
some help fixing it as I cannot seem to detect what I have done
wrong. Briefly the setup is this:
name servers:
DNS01 - 216.185.71.33
DNS02 - 209.47.176.33
DNS03 - 216.185.71.34
DNS04 - 209.47.176.34 - offline
DNS01 is a master
DNS02-04 are slaves of 216.185.71.33
All are listed as authoritative for the zone test.com
The following tests are run from a caching name server configured
to forward queries as follows:
/etc/resolv.conf
search hamilton.harte-lyne.ca harte-lyne.ca harte-lyne.com
halisp.net
nameserver 0.0.0.0
nameserver 216.185.71.33
nameserver 209.47.176.33
Extract from /etc/named.conf
...
forwarders {
216.185.71.33;
209.47.176.33;
216.185.71.34;
209.47.176.34;
};
forward first;
};
...
The intent of our setup is that if any server goes offline then the
remaining servers will continue to answer queries. To further
protect against outages DNS02 and DNS04 (currently offline) are on
a separate netblock at a physically remote location. However, this
is not what appears to happen when I test it. This are the results
that I get when DNS01-03 are all online together.
# dig @a.root-servers.net pop3.test.com +trace
; <<>> DiG 9.2.1 <<>> @a.root-servers.net pop3.test.com +trace
;; global options: printcmd
. 518400 IN NS C.ROOT-SERVERS.NET.
. 518400 IN NS G.ROOT-SERVERS.NET.
. 518400 IN NS F.ROOT-SERVERS.NET.
. 518400 IN NS B.ROOT-SERVERS.NET.
. 518400 IN NS J.ROOT-SERVERS.NET.
. 518400 IN NS K.ROOT-SERVERS.NET.
. 518400 IN NS L.ROOT-SERVERS.NET.
. 518400 IN NS M.ROOT-SERVERS.NET.
. 518400 IN NS I.ROOT-SERVERS.NET.
. 518400 IN NS E.ROOT-SERVERS.NET.
. 518400 IN NS D.ROOT-SERVERS.NET.
. 518400 IN NS A.ROOT-SERVERS.NET.
. 518400 IN NS H.ROOT-SERVERS.NET.
;; Received 436 bytes from 198.41.0.4#53(a.root-servers.net) in 750
ms
com. 172800 IN NS A.GTLD-SERVERS.NET.
com. 172800 IN NS B.GTLD-SERVERS.NET.
com. 172800 IN NS C.GTLD-SERVERS.NET.
com. 172800 IN NS D.GTLD-SERVERS.NET.
com. 172800 IN NS E.GTLD-SERVERS.NET.
com. 172800 IN NS F.GTLD-SERVERS.NET.
com. 172800 IN NS G.GTLD-SERVERS.NET.
com. 172800 IN NS H.GTLD-SERVERS.NET.
com. 172800 IN NS I.GTLD-SERVERS.NET.
com. 172800 IN NS J.GTLD-SERVERS.NET.
com. 172800 IN NS K.GTLD-SERVERS.NET.
com. 172800 IN NS L.GTLD-SERVERS.NET.
com. 172800 IN NS M.GTLD-SERVERS.NET.
;; Received 506 bytes from 192.33.4.12#53(C.ROOT-SERVERS.NET) in 38
ms
test.com. 172800 IN NS dns01.harte-lyne.ca.
test.com. 172800 IN NS dns02.harte-lyne.ca.
test.com. 172800 IN NS dns03.harte-lyne.ca.
;; Received 107 bytes from 192.5.6.30#53(A.GTLD-SERVERS.NET) in 41
ms
pop3.test.com. 38400 IN CNAME imap.test.com.
imap.test.com. 38400 IN CNAME imap.halisp.net.
imap.halisp.net. 38400 IN CNAME imap-07.halisp.net.
imap-07.halisp.net. 38400 IN CNAME imap-07.harte-
lyne.ca.
imap-07.harte-lyne.ca. 86400 IN CNAME
inet07.hamilton.harte-lyne.ca.
inet07.hamilton.harte-lyne.ca. 86400 IN A 216.185.71.27
harte-lyne.ca. 86400 IN NS dns01.harte-
lyne.ca.
harte-lyne.ca. 86400 IN NS dns02.harte-
lyne.ca.
harte-lyne.ca. 86400 IN NS dns03.harte-
lyne.ca.
harte-lyne.ca. 86400 IN NS dns04.harte-
lyne.ca.
;; Received 329 bytes from 216.185.71.33#53(dns01.harte-lyne.ca) in
2 ms
However, if named on DNS01 is stopped and left running on DNS02 and
DNS03 then this happens:
]# dig @a.root-servers.net pop3.test.com +trace
; <<>> DiG 9.2.1 <<>> @a.root-servers.net pop3.test.com +trace
;; global options: printcmd
. 518400 IN NS I.ROOT-SERVERS.NET.
. 518400 IN NS E.ROOT-SERVERS.NET.
. 518400 IN NS D.ROOT-SERVERS.NET.
. 518400 IN NS A.ROOT-SERVERS.NET.
. 518400 IN NS H.ROOT-SERVERS.NET.
. 518400 IN NS C.ROOT-SERVERS.NET.
. 518400 IN NS G.ROOT-SERVERS.NET.
. 518400 IN NS F.ROOT-SERVERS.NET.
. 518400 IN NS B.ROOT-SERVERS.NET.
. 518400 IN NS J.ROOT-SERVERS.NET.
. 518400 IN NS K.ROOT-SERVERS.NET.
. 518400 IN NS L.ROOT-SERVERS.NET.
. 518400 IN NS M.ROOT-SERVERS.NET.
;; Received 436 bytes from 198.41.0.4#53(a.root-servers.net) in 37
ms
dig: Couldn't find server 'I.ROOT-SERVERS.NET': Name or service not
known
So. The question is, what am I doing wrong? It has to be something
simple but I cannot see it for the life of me.
Any and all help greatly appreciated.
Jim
--
*** e-mail is not a secure channel ***
mailto:byrnejb.<token>@harte-lyne.ca
James B. Byrne Harte & Lyne Limited
vox: +1 905 561 1241 9 Brockley Drive
fax: +1 905 561 0757 Hamilton, Ontario
<token> = hal Canada L8E 3C3