Archived from groups: microsoft.public.win2000.dns (More info?)
Thanks to William and Kevin for pointing me in the right direction on
delegation vs stub zone on my earlier post.
I am still not getting the results I expect to see and may not have all I
need in place to get things running.
Basically, I am trying to help set up a MAPS server for a group that does
not have $$ for Postini.
W2K server is running DNS and Active Directory for their environment.
MAPS program is up and running on local UNIX box. Running dig at local host
returns:
[root at maps root]# dig @localhost 6.60.255.68.abuse.nonprofit.local
; <<>> DiG 9.2.1 <<>> @localhost 6.60.255.68.abuse.nonprofit.local
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40548
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;6.60.255.68.abuse.nonprofit.local. IN A
;; ANSWER SECTION:
6.60.255.68.abuse.nonprofit.local. 3600 IN A 127.0.0.2
;; Query time: 24 msec
;; SERVER: 127.0.0.1#53(localhost)
;; WHEN: Wed Oct 6 08:27:58 2004
;; MSG SIZE rcvd: 68
(The 127.0.0.2 is the correct answer for an IP listed in the abusive sender
database on the MAPS box. If the address is not listed you do not get the
127.0.0.2.)
HOWEVER running dig using the Wintel DNS server gives:
[root at maps root]# dig 10.10.10.1 6.60.255.68.abuse.nonprofit.local +nord
; <<>> DiG 9.2.1 <<>> 10.10.10.1
6.60.255.68.abuse.nonprofit.local +nord
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 11111
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;10.10.10.1. IN A
;; AUTHORITY SECTION:
... 8745 IN SOA a.root-servers.net.
nstld.verisign-grs.com. 0000000000 0000 000 000000 000
;; Query time: 23 msec
;; SERVER: 10.10.10.1#53(10.10.10.1)
;; WHEN: Wed Oct 6 08:35:35 2004
;; MSG SIZE rcvd: 103
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48322
;; flags: qr ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; QUESTION SECTION:
;6.60.255.68.abuse.nonprofit.local. IN A
;; AUTHORITY SECTION:
abuse.nonprofit.local. 3600 IN NS maps.nonprofit.local.
;; ADDITIONAL SECTION:
maps.nonprofit.local. 3600 IN A 10.10.10.10
;; Query time: 66 msec
;; SERVER: 10.10.10.1#53(10.10.10.1)
;; WHEN: Wed Oct 6 08:35:35 2004
;; MSG SIZE rcvd: 109
If I am reading the AUTHORITY SECTION correctly, the W2K machine seems to
delegate zone "abuse" to the
machine "maps", just not sure why listed addresses are not returning
127.0.0.2.
Following is an excerpt from some online directions for the MAPS program. I
am just not totally clear how we could make some of the changes on a Windows
box. Can zones be manually edited as described?
Configure the DNS server(s) your mail server(s) use to forward
dnsbl.njabl.org queries to your rbldnsd server(s). Add the following to
named.conf:
zone "dnsbl.njabl.org" IN {
type forward;
forward first;
forwarders {
127.0.0.1 port 530;
};
};
If you're running rbldnsd on a dedicated system (not an existing DNS
server), adjust the IP in the forwarders statement appropriately. With the
setup above, if your local rbldnsd becomes unavailable, dnsbl.njabl.org
queries will fall back to the root-servers. If your network generates a
large volume of queries (thousands/sec), it may make sense to run multiple
rbldnsd copies of dnsbl.njabl.org on several systems with the rsync update
slightly staggered. rbldnsd will not answer queries while reloading the zone
data into memory. Depending on the speed of your system and the size of the
zone data, reloading could make the rbldnsd server unavailable for several
seconds.
If you're running bind 8.x, the port option above is not supported. You'll
need to dedicate an IP address to rbldnsd and make bind not listen on that
IP by telling it which IPs to listen on. i.e. Setup an IP alias of 127.0.0.2
on your lo interface. Replace the bind config above with:
options {
listen-on {
x.x.x.x;
127.0.0.1;
};
};
zone "dnsbl.njabl.org" IN {
type forward;
forward first;
forwarders {
127.0.0.2;
};
};
replacing x.x.x.x with the IP address of your server. If your server has
many IPs, you can list each one, or use CIDR notation such as x.x.x.0/24.
TIA for any help.
Thanks to William and Kevin for pointing me in the right direction on
delegation vs stub zone on my earlier post.
I am still not getting the results I expect to see and may not have all I
need in place to get things running.
Basically, I am trying to help set up a MAPS server for a group that does
not have $$ for Postini.
W2K server is running DNS and Active Directory for their environment.
MAPS program is up and running on local UNIX box. Running dig at local host
returns:
[root at maps root]# dig @localhost 6.60.255.68.abuse.nonprofit.local
; <<>> DiG 9.2.1 <<>> @localhost 6.60.255.68.abuse.nonprofit.local
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40548
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;6.60.255.68.abuse.nonprofit.local. IN A
;; ANSWER SECTION:
6.60.255.68.abuse.nonprofit.local. 3600 IN A 127.0.0.2
;; Query time: 24 msec
;; SERVER: 127.0.0.1#53(localhost)
;; WHEN: Wed Oct 6 08:27:58 2004
;; MSG SIZE rcvd: 68
(The 127.0.0.2 is the correct answer for an IP listed in the abusive sender
database on the MAPS box. If the address is not listed you do not get the
127.0.0.2.)
HOWEVER running dig using the Wintel DNS server gives:
[root at maps root]# dig 10.10.10.1 6.60.255.68.abuse.nonprofit.local +nord
; <<>> DiG 9.2.1 <<>> 10.10.10.1
6.60.255.68.abuse.nonprofit.local +nord
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 11111
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;10.10.10.1. IN A
;; AUTHORITY SECTION:
... 8745 IN SOA a.root-servers.net.
nstld.verisign-grs.com. 0000000000 0000 000 000000 000
;; Query time: 23 msec
;; SERVER: 10.10.10.1#53(10.10.10.1)
;; WHEN: Wed Oct 6 08:35:35 2004
;; MSG SIZE rcvd: 103
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48322
;; flags: qr ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; QUESTION SECTION:
;6.60.255.68.abuse.nonprofit.local. IN A
;; AUTHORITY SECTION:
abuse.nonprofit.local. 3600 IN NS maps.nonprofit.local.
;; ADDITIONAL SECTION:
maps.nonprofit.local. 3600 IN A 10.10.10.10
;; Query time: 66 msec
;; SERVER: 10.10.10.1#53(10.10.10.1)
;; WHEN: Wed Oct 6 08:35:35 2004
;; MSG SIZE rcvd: 109
If I am reading the AUTHORITY SECTION correctly, the W2K machine seems to
delegate zone "abuse" to the
machine "maps", just not sure why listed addresses are not returning
127.0.0.2.
Following is an excerpt from some online directions for the MAPS program. I
am just not totally clear how we could make some of the changes on a Windows
box. Can zones be manually edited as described?
Configure the DNS server(s) your mail server(s) use to forward
dnsbl.njabl.org queries to your rbldnsd server(s). Add the following to
named.conf:
zone "dnsbl.njabl.org" IN {
type forward;
forward first;
forwarders {
127.0.0.1 port 530;
};
};
If you're running rbldnsd on a dedicated system (not an existing DNS
server), adjust the IP in the forwarders statement appropriately. With the
setup above, if your local rbldnsd becomes unavailable, dnsbl.njabl.org
queries will fall back to the root-servers. If your network generates a
large volume of queries (thousands/sec), it may make sense to run multiple
rbldnsd copies of dnsbl.njabl.org on several systems with the rsync update
slightly staggered. rbldnsd will not answer queries while reloading the zone
data into memory. Depending on the speed of your system and the size of the
zone data, reloading could make the rbldnsd server unavailable for several
seconds.
If you're running bind 8.x, the port option above is not supported. You'll
need to dedicate an IP address to rbldnsd and make bind not listen on that
IP by telling it which IPs to listen on. i.e. Setup an IP alias of 127.0.0.2
on your lo interface. Replace the bind config above with:
options {
listen-on {
x.x.x.x;
127.0.0.1;
};
};
zone "dnsbl.njabl.org" IN {
type forward;
forward first;
forwarders {
127.0.0.2;
};
};
replacing x.x.x.x with the IP address of your server. If your server has
many IPs, you can list each one, or use CIDR notation such as x.x.x.0/24.
TIA for any help.
Facebook
Twitter
Instagram