This is a multi-part message in MIME format.
On 14/3/23 06:23, Jeremy Ardley wrote:
I had a signed DNS error in a similar configuration using a bind
authoritive and caching server. It turned out it was systemd-resolved interfering and/or replacing part of the DNS chain
FYI systed-resolved is the inbuilt debian caching DNS server which may
be enabled by default. If you run that you don't need a bind9 caching
name server
What does this report ?
systemctl status systemd-resolved
If there is anything there at all, check logs. You may find something
Also FYI you can run bind9 and systemd-resolved at the same time and set
bind9 to use systemd-resolved as forwarder
|options { directory "/var/cache/bind"; // Use systemd-resolved as a DNS resolver forwarders { 127.0.0.53 port 53; }; dnssec-validation auto; auth-nxdomain no; # conform to RFC1035 ... Its probably a good idea to
not be too keen on dnssec validation - as above. |
--
Jeremy
(Lists)
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p><br>
</p>
<div class="moz-cite-prefix">On 14/3/23 06:23, Jeremy Ardley wrote:<br>
</div>
<blockquote type="cite"
cite="mid:
44493370-d84a-0d12-a3de-4d9b3daa82c0@ardley.org">
<br>
I had a signed DNS error in a similar configuration using a bind
authoritive and caching server. It turned out it was
systemd-resolved interfering and/or replacing part of the DNS
chain
<br>
<br>
FYI systed-resolved is the inbuilt debian caching DNS server which
may be enabled by default. If you run that you don't need a bind9
caching name server
<br>
<br>
What does this report ?
<br>
<br>
systemctl status systemd-resolved
<br>
<br>
If there is anything there at all, check logs. You may find
something
<br>
<br>
</blockquote>
<p>Also FYI you can run bind9 and systemd-resolved at the same time
and set bind9 to use systemd-resolved as forwarder</p>
<p><br>
</p>
<pre class="moz-signature" cols="72"><code class="!whitespace-pre hljs language-cpp">options {
directory <span class="hljs-string">"/var/cache/bind"</span>;
<span class="hljs-comment">// Use systemd-resolved as a DNS resolver</span>
forwarders {
<span class="hljs-number">127.0</span><span class="hljs-number">.0</span><span class="hljs-number">.53</span> port <span class="hljs-number">53</span>;
};
dnssec-validation <span class="hljs-keyword">auto</span>;
auth-nxdomain no; <span class="hljs-meta"># conform to RFC1035
...
Its probably a good idea to not be too keen on dnssec validation - as above. </span></code>
--
Jeremy
(Lists)</pre>
</body>
</html>
--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)