DNS recursive

DNS recursive

For who have recently notice that now DNSreport do verify if your DNS is recursive lookup or not, here is the tip on how to set it up.

open you named.conf and add before options { the follow lines:

acl "trusted" {
xxx.xxx.xxx.xxx;
yyy.yyy.yyy.yyy;
};

where xxx.xxx.xxx.xxx is your ip address same for yyy.yyy.yyy.yyy.
for cpanel users, you can find yours ips in the follow file: /etc/nameserverips

after that, inside the options add after the line "// query-source address * port 53;" the follow:
allow-recursion { trusted; };
allow-notify { trusted; };
allow-transfer { trusted; };

also uncomment the line

"// query-source address * port 53;"

to

"query-source address * port 53;" without the (double-quotes).

restart your service.

Verify again your status with DNSreport.

close your open DNS servers

For who have recently notice that now DNSreport do verify if your DNS is recursive lookup or not, here is the tip on how to set it up.

open you named.conf and add before options { the follow lines:

acl "trusted" {
xxx.xxx.xxx.xxx;
yyy.yyy.yyy.yyy;
};

where xxx.xxx.xxx.xxx is your ip address same for yyy.yyy.yyy.yyy.
for cpanel users, you can find yours ips in the follow file: /etc/nameserverips

after that, inside the options add after the line "// query-source address * port 53;" the follow:
allow-recursion { trusted; };
allow-notify { trusted; };
allow-transfer { trusted; };

also uncomment the line "// query-source address * port 53;" "to query-source address * port 53;" with out the " (double-quotes).

restart your service.

Verify again your status with DNSreport.

Observation: you can also set up a version line it should be like:
version "Oh come on why do you want to know witch version my DNS server is ?";

this line can be add iside your named.conf

close your open DNS servers

Howto: Check and close your open DNS servers

I just noticed www.dnsreport.com seems to have new check: it checks for open DNS server. This is how you check:

1) Go to http://www.dnsreport.com/tools/dnsreport.ch?domain=yourdoamin.com
2) Check for BIG RED "FAIL" (7th box, going down from up) saying "Open DNS servers".

If you see the message, you can correct it the following way:

1) login to your server as root
2) nano -w /etc/named.conf (if you are running Bind)
3) Look for // query-source address * port 53; and right below write the following line:

recursion no;

4) Save and exit, restart Bind by typing service named restart
5) Check DNSReport.com to make sure it went right. You should not see the error message anymore.

If you run something else than Bind then please check http://www.dnsreport.com/info/opendns.htm for instructions.

recursion restrictions for named.conf

Check /etc/named.conf for recursion restrictions
I'm getting this warning from check server security option in csf :

You have a local DNS server running but do not have any recursion restrictions set in /etc/named.conf. This is a security and performance risk and you should look at restricting recursive lookups to the local IP addresses only
--
solution:
Make backup copy of named.conf
#cp /etc/named.conf /etc/named.conf-backup

#vi /etc/named.conf

The top of your named.conf should look something like:
-------------------------------------------------------------------
include "/etc/namedb/rndc.key";

controls {
inet 127.0.0.1 allow { localhost; } keys { "rndc-key"; };
};

acl "trusted" {
127.0.0.1;
};

options {
pid-file "/var/run/named/named.pid";
directory "/etc/namedb";
dump-file "/var/dump/named_dump.db";
statistics-file "/var/stats/named.stats";
version "BIND";
allow-recursion { trusted; };
allow-notify { trusted; };
allow-transfer { trusted; };
forwarders { 127.0.0.1; };
};
------------------------------

If you don't have the lines in bold, add them to your named.conf (make a backup first!) and restart BIND. You can also add additional IP addresses if you have other servers in the DNS cluster.

Restart bind.

SOA parameters for a DNS server

To set the SOA parameters for a DNS server, perform the following steps:

1. Set the following parameters

1. Set the following parameters

Parameter Name	Description	Notes
E-mail	the mailbox of the person responsible for this DNS server.
TTL	"time-to-live": the time, in seconds, this DNS server caches (keeps) a piece of information received from your server before it asks your server again.	If you set the value too low, your server will get loaded down with too many repeat requests. If you set it too high, the information you change will not get distributed in a reasonable amount of time. By default, 86400 seconds (1 day) is set. The solution is as follows: If particular information is not expected to change in the near future, one can have a high TTL (anywhere between a day (86400 seconds) and a week (604800 seconds) If information is known to change soon, it can be transmitted with a low TTL (an hour to a day). It is standard practice to reduce the TTL transmitted with information that is scheduled to change in order to make that change visible rapidly throughout the Internet; once the change has happened, the TTL is increased again.
Refresh	the time interval, in seconds, before which the zones need to be updated.	By default, 10800 (3 hours) is set. A good value here would be 3600 (1 hour).
Retry	the time interval, in seconds, after which the next attemp of refresh should be taken, after a refresh failure.	By default, 3600 (1 hour) is set. A good value here would be 600 (10 minutes).
Expire	the upper limit, in seconds, on the time interval that can elapse before the zones are no longer authoritative	By default, 604800 (7 days) is set. A nice value here would be 3600000 (42 days).
Minimum TTL	the minimum number of seconds to be used for TTL value in RRs.	By default, 86400 (1 day) is set, which is a good value.

Reverse DNS: how to check it?

Check RDNS using NSLOOKUP command ,HOST (on linux server ) command or centralops.net.

NSLOOKUP
--------------
1)You can check RDNS is setup or not from command prompt using nslookup command
Server which has RDNS set-

C:\>nslookup 10.11.12.13

Server: vnsc-pri.sys.gtei.net
Address: 4.2.2.1
Name: host.myhostname.com
Address: 10.11.12.13

Here if "Name" is your "hostname" then RDNS is setup for this server.


If RDNS is not setup you will see the "datacenter name " in front of "Name" as below.
C:\>nslookup 11.12.13.14
Server: vnsc-pri.sys.gtei.net
Address: 14.13.12.11
Name: bc.d3.7bae.static.theplaneet.com
Address: 11.12.13.14

Here "Name" is not your hostname, thus rdns is not set up for this server.


Using HOST command (on linux server)
-----------------------------------------------
1)on server
root@shell [~]# host 10.11.12.13
output-
13.12.11.10.in-addr.arpa domain name pointer host.myhostname.com.
=> If output line is ended with hostname, then rdns is setup for this.

2)on linux server -
root@shell [~]# host 1.2.3.4
output-
4.3.2.1.in-addr.arpa domain name pointer bc.d3.7bae.static.theplanet.com.
=> output line is not ended with hostname, thus rdns is not set for this .


Use centralops.net
---------------------------------------
browse http://centralops.net
1) open browser http://centralops.net/co/ >> Domain Dossier
put ip in it and see dns report
canonical name should be your hostname
and in dns report

13.12.11.10.in-addr.arpa IN PTR host.myhostname.com

ptr line should contain hostname.


3) open browser http://centralops.net/co/ >> Domain Dossier
put ip in it and see dns report
canonical name should be your hostname
and in dns report

"4.3.2.1.in-addr.arpa IN PTR ba.d3.7bae.static.theplanet.com"

ptr line does not contain hostname, thus no rdns set for this.