I’ve got a complain from the customer of my recent cPanel server installation that his DNS zones are not replicated by our main DNS servers and therefore they have problems.
We are using custom system to pull slave zone configuration from cPanel servers (I’ll explain it later in separate post) which allows us to use regular ISC Bind servers as slaves to the cPanel masters.
I’ve checked logs and they were right – zones were not replicating.
|
1 2 3 4 5 |
ns1 named[6623]: zone customerzone.fr/IN/external: Transfer started. ns1 named[6623]: transfer of 'customerzone.fr/IN/external' from X.X.X.X#53: connected using Y.Y.Y.Y#53746 ns1 named[6623]: transfer of 'customerzone.fr/IN/external' from X.X.X.X#53: failed while receiving responses: NOTAUTH ns1 named[6623]: transfer of 'customerzone.fr/IN/external' from X.X.X.X#53: Transfer status: NOTAUTH ns1 named[6623]: transfer of 'customerzone.fr/IN/external' from X.X.X.X#53: Transfer completed: 0 messages, 0 records, 0 bytes, 0.001 secs (0 bytes/sec) |
I manage more then one cPanel server with similar configuration and only this one most recent was giving me problems with zone update.
The only difference between other, working cPanel servers and the problematic was the Bind server software version – Centos7 ships with 9.11.4 version of it.
My first guess was that zone vew didn’t match – master server has one huge default view (don’t ask) while standard customer cPanel bind configuration has 3 separate view – “local_resolver”, “internal”, and “external” (I could have been wrong about views restriction, but I will get to that later).
For slave zone replication I am using slightly modified brilliant PHP script which saves me the hassle dealing with “dns-only” cPanel. Alas, while slave zones were properly configured on master Bind server it still refused to replicate zones from cPanel with an error “NOT AUTH” and I suspected that it wanted to replicate zones with the same view.
The obvious solution would be creating views on slave servers and move cPanel zones there, but that would be hundreds of zones and god knows what other complications.
Less obvious but more efficient was switching cPanels from Bind to PowerDNS. PowerDNS is not view-aware, so this restriction is gone. You will need to turn on zone replication in /etc/pdns/pdns.conf look for the line starting from “allow-axfr-ips” and add your slave DNS servers IP there.
After starting PowerDNS you will see that slave server can replicate zones from cPanel server. Problem solved.
0 Comments.