Eu tenho vários domínios no Strato. Desejo configurar meu próprio DNS externo para gerenciar meus domínios.
Para fazer isso no Strato, usei a opção "Domainverwaltung: NS-Records ändern". Eu tive que fornecer 2 Nameservers para essa configuração. O sistema aceitou minha configuração.
Eu tenho um DNS BIND9 principal (mestre) e secundário (escravo) em DEBIAN9.
root@server1:/etc/bind# named -v
BIND 9.10.3-P4-Debian <id:ebd72b3>
A configuração do MASTER
/etc/bind/named.conf.options
acl trusted {
127.0.0.1;
xxx.xxx.xxx.43; # NS1
xx.xx.xx.107; # NS2
81.169.148.38; # Strato DNS
};
options {
directory "/var/cache/bind";
// If there is a firewall between you and nameservers you want
// to talk to, you may need to fix the firewall to allow multiple
// ports to talk. See http://www.kb.cert.org/vuls/id/800113
// If your ISP provided one or more IP addresses for stable
// nameservers, you probably want to use them as forwarders.
// Uncomment the following block, and insert the addresses replacing
// the all-0's placeholder.
// forwarders {
// 0.0.0.0;
// };
//========================================================================
// If BIND logs error messages about the root key being expired,
// you will need to update your keys. See https://www.isc.org/bind-keys
//========================================================================
dnssec-validation auto;
listen-on port 53 { any; };
recursion no;
allow-query { any; };
auth-nxdomain no; # conform to RFC1035
listen-on-v6 { any; };
allow-notify { trusted; };
allow-transfer { trusted; };
};
/etc/bind/named.conf.local
//
// Do any local configuration here
//
// Consider adding the 1918 zones here, if they are not used in your
// organization
//include "/etc/bind/zones.rfc1918";
zone "my-domain.com" {
type master;
file "/etc/bind/forward.my-domain.com";
allow-transfer { xx.xx.xx.107; };
};
/etc/bind/forward.my-domain.com
$TTL 604800
@ IN SOA primary.my-domain.com. root.primary.my-domain.com. (
6 ; Serial
604820 ; Refresh
86600 ; Retry
2419600 ; Expire
604600 ) ; Negative Cache TTL
;Name Server Information
@ IN NS primary.my-domain.com.
@ IN NS secondary.my-domain.com.
;IP address of Your Domain Name Server(DNS)
primary IN A xxx.xxx.xxx.43
secondary IN A xx.xx.xx.107
;A Record for Host names
@ IN A xxx.xxx.xxx.43
www IN A xxx.xxx.xxx.43
;CNAME Record
ftp IN CNAME www.my-domain.com.
A configuração do escravo
/etc/bind/named.conf.options
acl trusted {
127.0.0.1;
xxx.xxx.xxx.43; # NS1
xx.xx.xx.107; # NS2
81.169.148.38; # Strato DNS
};
options {
directory "/var/cache/bind";
// If there is a firewall between you and nameservers you want
// to talk to, you may need to fix the firewall to allow multiple
// ports to talk. See http://www.kb.cert.org/vuls/id/800113
// If your ISP provided one or more IP addresses for stable
// nameservers, you probably want to use them as forwarders.
// Uncomment the following block, and insert the addresses replacing
// the all-0's placeholder.
// forwarders {
// 0.0.0.0;
// };
//========================================================================
// If BIND logs error messages about the root key being expired,
// you will need to update your keys. See https://www.isc.org/bind-keys
//========================================================================
dnssec-validation auto;
listen-on port 53 { any; };
recursion no;
allow-query { any; };
auth-nxdomain no; # conform to RFC1035
listen-on-v6 { any; };
allow-notify { trusted; };
allow-transfer { trusted; };
};
/etc/bind/named.conf.local
//
// Do any local configuration here
//
// Consider adding the 1918 zones here, if they are not used in your
// organization
//include "/etc/bind/zones.rfc1918";
zone "my-domain.com" {
type slave;
file "/etc/bind/forward.my-domain.com";
masters { xxx.xxx.xxx.43; };
};
/etc/bind/forward.my-domain.com
$TTL 604800
@ IN SOA primary.my-domain.com. root.primary.my-domain.com. (
6 ; Serial
604820 ; Refresh
86600 ; Retry
2419600 ; Expire
604600 ) ; Negative Cache TTL
;Name Server Information
@ IN NS primary.my-domain.com.
@ IN NS secondary.my-domain.com.
;IP address of Your Domain Name Server(DNS)
primary IN A xxx.xxx.xxx.43
secondary IN A xx.xx.xx.107
;A Record for Host names
@ IN A xxx.xxx.xxx.43
www IN A xxx.xxx.xxx.43
;CNAME Record
ftp IN CNAME www.my-domain.com.
Para testar isso eu usei:
DIG
~$ dig my-domain.com @xxx.xxx.xxx.43
; <<>> DiG 9.11.3-1ubuntu1.2-Ubuntu <<>> my-domain.com @xxx.xxx.xxx.43
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31536
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3
;; WARNING: recursion requested but not available
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;my-domain.com. IN A
;; ANSWER SECTION:
my-domain.com. 604800 IN A xxx.xxx.xxx.43
;; AUTHORITY SECTION:
my-domain.com. 604800 IN NS secondary.my-domain.com.
my-domain.com. 604800 IN NS primary.my-domain.com.
;; ADDITIONAL SECTION:
primary.my-domain.com. 604800 IN A xxx.xxx.xxx.43
secondary.my-domain.com. 604800 IN A xx.xx.xx.107
;; Query time: 16 msec
;; SERVER: xxx.xxx.xxx.43#53(xxx.xxx.xxx.43)
;; WHEN: Tue Oct 16 14:42:09 CEST 2018
;; MSG SIZE rcvd: 136
E NSLOOKUP:
~$ nslookup my-domain.com xxx.xxx.xxx.43
Server: xxx.xxx.xxx.43
Address: xxx.xxx.xxx.43#53
Name: my-domain.com
Address: xxx.xxx.xxx.43
Mas sem apontar diretamente para meu NS, o NS do meu provedor está respondendo:
DIG:
~$ dig my-domain.com
; <<>> DiG 9.11.3-1ubuntu1.2-Ubuntu <<>> my-domain.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7286
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;my-domain.com. IN A
;; ANSWER SECTION:
my-domain.com. 69 IN A 81.169.145.157
;; Query time: 0 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Tue Oct 16 14:44:23 CEST 2018
;; MSG SIZE rcvd: 58
NSLOOKUP:
~$ nslookup my-domain.com
Server: 127.0.0.53
Address: 127.0.0.53#53
Non-authoritative answer:
Name: my-domain.com
Address: 81.169.145.157
Name: my-domain.com
Address: 2a01:238:20a:202:1157::
Strato afirmou: "Por favor, note que devido à estrutura descentralizada do DNS, as alterações a estas configurações não estarão totalmente ativas até 24 horas após a ativação."
Mas, mesmo depois de 24h, minha verificação não aponta para o meu NS-Server. Existe algum teste que eu possa realizar para encontrar possíveis problemas?
Strato também está apontando: (desculpem tradução automática) Original aqui .
Set Record (only for Dedicated Servers)
With a secondary name server you can create a backup if the primary
name server should fail. This will ensure that the domain will still
be reached. Primary and Secondary nameservers are redundant (by the
zone transfer all configurations are synchronized concerning the
domain), so that the second name server can issue the correct DNS
records for the domain, such as A-Record, MX-Record, etc. The zone
transfer must be allowed for the IP address of the STRATO Secondary
Name Server 81.169.148.38. This IP address is static and therefore
does not need to be changed in the future (for BIND, for example via
allow-transfer).
When using STRATO Secondary Nameserver, it is not necessary to operate
two own name servers. If you allow a zone transfer from your primary
name server to sns.serverkompetenz.de, it will get the DNS
configurations of the domains you have set up on your primary name
server. In case of failure of the primary name server, the domains are
still reachable.
In the domain zone, sns.serverkompetenz.de must also be listed as a
name server in the NS set.
