# BIND Setup - Root Domain for Website hosted on External Server



## fencepencil (May 4, 2020)

```
uname -a
FreeBSD lb-dns-1 12.1-RELEASE-p3 FreeBSD 12.1-RELEASE-p3 GENERIC  amd64
```


```
named -v
BIND 9.16.2 (Stable Release) <id:b310dc7>
```

I'm having an issue with my root domain not being able to resolve. I've got 2 public DNS servers, both running BIND in a master/slave relationship. I've also got an external Web Server, which is also using a public address:

ns1.linuxbsd.io - 216.182.105.50
ns2.linuxbsd.io - 216.182.105.55
linuxbsd.io - running CentOS - 216.182.105.51

Here is the relevant configuration for ns1...


```
cat /etc/resolv.conf

domain linuxbsd.io
nameserver 216.182.105.50
nameserver 216.182.105.55
```

Named.Conf File


```
cat /usr/local/etc/namedb/named.conf

//
// named.conf for the LinuxBSD.io domain
//

options {
    directory    "/usr/local/etc/namedb/dynamic";
    pid-file    "/var/run/named/pid";
    dump-file    "/var/dump/named_dump.db";
    statistics-file    "/var/stats/named.stats";
    listen-on    { 127.0.0.1; 216.182.105.50;  };
    key-directory "/usr/local/etc/namedb/keys";
    allow-transfer { localhost; 216.182.105.55; };
    notify yes;
    max-cache-size 2048M;
    recursive-clients 10000;

    // Access Control
    allow-query { any; };

    // DDOS Mitigation
    rate-limit {
        responses-per-second 10;
    };
};

logging {
    category lame-servers { null; };
    category resolver { null; };
};

// LinuxBSD.io Zones
zone "linuxbsd.io" {
    type master;
    file "/usr/local/etc/namedb/dynamic/db.linuxbsd.io";
    auto-dnssec maintain;
    inline-signing yes;
};

// Hint Zone
zone "." { type hint; file "/usr/local/etc/namedb/named.root"; };
```

SOA - Header File


```
cat /usr/local/etc/namedb/includes/include.header

$ORIGIN linuxbsd.io.
$TTL 3600
@             IN    SOA    ns1.linuxbsd.io. hostmaster.linuxbsd.io. (
                    2020050101    ; Serial
                    43200        ; Refresh - 12 Hours
                    900        ; Retry - 15 Minutes
                    1209600        ; Expire - 2 weeks
                    3600 )        ; Negative Cache Time - 1 hour

@                       IN      NS      ns1.linuxbsd.io.
@                       IN      NS      ns2.linuxbsd.io.
```

My Zone File


```
cat /usr/local/etc/namedb/dynamic/db.linuxbsd.io

;
; Zone File for LinuxBSD.io Zone
;

$INCLUDE /usr/local/etc/namedb/includes/include.header

;
; Name Servers
;

ns1            IN    A    216.182.105.50
ns2            IN    A    216.182.105.55

;
; Web Servers
;

@                 IN    A    216.182.105.51
www            IN    A    216.182.105.51

;
; Database Servers
;

db            IN    A    216.182.105.52
```

Check config and Check Zone both come back good:


```
named-checkzone linuxbsd.io /usr/local/etc/namedb/dynamic/db.linuxbsd.io

zone linuxbsd.io/IN: loaded serial 2020050101
OK
```

When I run nslookup on my name servers, everything comes back just fine:


```
nslookup ns1.linuxbsd.io

Server:        216.182.105.50
Address:    216.182.105.50#53

Name:    ns1.linuxbsd.io
Address: 216.182.105.50

nslookup ns2.linuxbsd.io

Server:        216.182.105.50
Address:    216.182.105.50#53

Name:    ns2.linuxbsd.io
Address: 216.182.105.55
```

However, running the same command on the root domain returns nothing:


```
nslookup linuxbsd.io

Server:        216.182.105.50
Address:    216.182.105.50#53

*** Can't find linuxbsd.io: No answer
```

Any thoughts on what might be wrong here?


----------



## trev (May 5, 2020)

Where's your reverse zone file?


----------



## usdmatt (May 5, 2020)

Reverse dns is irrelevant. Considering these are public addresses, reverse dns for them is probably controlled by the ISP anyway.

To be honest the error doesn't really make much sense. You appear to be testing against ns1, get a response for ns1/ns2, but "no answer" for the domain itself - which suggests the server isn't even answering. I'd be intrigued to see what happens if you try an soa or any query, ideally at localhost on ns1/ns2 directly, then via the public ip from another host if that is working.


```
# drill @localhost soa linuxbsd.io
# drill @localhost any linuxbsd.io
```


----------



## fencepencil (May 5, 2020)

usdmatt said:


> Reverse dns is irrelevant. Considering these are public addresses, reverse dns for them is probably controlled by the ISP anyway.
> 
> To be honest the error doesn't really make much sense. You appear to be testing against ns1, get a response for ns1/ns2, but "no answer" for the domain itself - which suggests the server isn't even answering. I'd be intrigued to see what happens if you try an soa or any query, ideally at localhost on ns1/ns2 directly, then via the public ip from another host if that is working.
> 
> ...



It's weird, right? Even on MXToolbox, ns1 and ns2 resolve, but nothing else does...


```
;; QUESTION SECTION:
;; linuxbsd.io.    IN    SOA

;; ANSWER SECTION:
linuxbsd.io.    3600    IN    SOA    ns1.linuxbsd.io. hostmaster.linuxbsd.io. 2020050105 43200 900 1209600 3600
```


```
;; QUESTION SECTION:
;; linuxbsd.io.    IN    ANY

;; ANSWER SECTION:
linuxbsd.io.    3600    IN    RRSIG    NS 8 2 3600 20200529192333 20200502145508 12963 linuxbsd.io. peYNYE0yLbMtvJKCnXNwQ4JusqJIvS7fuVf12a1pSupZf8FYFUi4z8RmdlPCEWW4PnT8Z3yBWVFdT+nOmgW4jOo9AERqMlprR/OfTdGB6aCUjvAQxh7zCvlfT1TAzy4m1+Xe9rnBLaZVew/SvlcvGdcKLsc1wbPI3VytZjYH+GTyYaSmcERVLC2KVom8F/HTjSdpIEvFYDs0RHAOBobrbJlyVn+/qkMkVl0P0Vn3zDehp8ID95+wt3FJgzQhehF/PZrzg23/Wf31UazfgIRk1asfUliAWGjlNnHm4uHYnLFbuzYsmSyzXQQlCZ6s+fHhI2+yIdvQ6BJrmUnHCgEIQQ==
```


----------



## fencepencil (May 5, 2020)

trev said:


> Where's your reverse zone file?



I do maintain the reverse records as well, here is the one for this zone:


```
;
; Data file for reverse address to hostname.
;
$TTL 3600
@         IN    SOA    ns1.linuxbsd.io. hostmaster.linuxbsd.io. (
                2020050101    ; Serial
                43200        ; Refresh - 12 Hours
                900        ; Retry - 15 Minutes
                1209600        ; Expire - 2 weeks
                3600 )        ; Negative Cache Time - 1 hour

@        IN    NS    ns1.linuxbsd.io.
@        IN    NS    ns2.linuxbsd.io.

$GENERATE 0-49        $    PTR    ip-216-182-105-$.linuxbsd.io.
50            IN    PTR    ns1.linuxbsd.io.
51            IN    PTR    lb-web-1.linuxbsd.io.
52            IN    PTR    lb-db-1.linuxbsd.io.
$GENERATE 53-54        $    PTR    ip-216-182-105-$.linuxbsd.io.
55            IN    PTR    ns2.linuxbsd.io.
$GENERATE 56-255    $    PTR    ip-216-182-105-$.linuxbsd.io.
```


----------



## Jose (May 5, 2020)

I think `$ORIGIN` gets added to any field that does not end in a dot. I have this in one of my zone files:

```
NS      ns1
```
And that gets `domain.tld` added to the blank initial field, and to `ns1` thus yielding an effective record of:

```
domain.tld                   NS      ns1.domain.tld
```
I think that by using `@` in the first line, you are adding `linuxbsd.io` to the record twice, for an effective record of

```
linuxbsd.io.linuxbsd.io                 IN    A    216.182.105.51
```
Try it without the `@`, or with `@.` or try `nslookup linuxbsd.io.linuxbsd.io`


----------



## usdmatt (May 5, 2020)

> And that gets domain.tld added to the blank initial field,



@ gets replaced with the current value of $ORIGIN, which is this case is linuxbsd.io., which is fine. It's pretty much standard to see just @ on the first (SOA) record.

A blank entry takes the value from above, so for instance you can do stuff like the following -


```
$ORIGIN linuxbsd.io.
@     IN    SOA ... (<- uses "linuxbsd.io.")
      IN    NS ns1 (<- expansion also works for values that expect an fqdn)
      IN    NS ns2
www   IN    A 1.2.3.4 (<- No dot so $ORIGIN will be appended)
      IN    A 1.2.3.5 (<- second A record for www.linuxbsd.io.)
```

I'm not sure what happens if you leave it blank on the first record. I suspect it will either error (most likely) or just default to the value of $ORIGIN. (Edit: as expected it complains - "zone:5: no current owner name")

$ORIGIN defaults to the zone, which does bring up a strange choice in the original config. There is an include file for the zone header, but it specifically sets the origin to linuxbsd.io. Not only is this line not necessarily required as the origin would be that anyway for this zone, but it means that include header is only of use for this domain anyway, rendering the include file fairly useless.


----------



## Jose (May 5, 2020)

Edit: NM, I think you meant in the SOA record, not the first host record. If you look at his config, he doesn't have blank-IN he has @-IN in his host records. The IN is optional and the default, BTW. I'd like to have a beer with you if you've ever had to configure BIND for Chaosnet or Hesiod.



usdmatt said:


> I'm not sure what happens if you leave the it blank on the first record. I suspect it will either error (most likely) or just default to the value of $ORIGIN.


Works just fine. Gets replaced with `$ORIGIN`.


```
$ORIGIN example.com.
@                   SOA ns1.example.com. dns.example.com. (
                        2020041101  ; se = serial number
                        1h          ; ref = refresh
                        15m         ; ret = update retry
                        2w          ; ex = expiry
                        1h          ; min = minimum
                    )
                    NS      ns1
                    MX      10 mail.example.org.
```


----------



## usdmatt (May 5, 2020)

> Works just fine. Gets replaced with $ORIGIN.



I meant literally leaving the first line blank, e.g

```
$ORIGIN example.com
     IN SOA ...
     IN NS ...
```

It errors.

As in my example zone above, there is no problem with putting "@" on the first record, then leaving the ones underneath blank, same as your last example.


----------



## usdmatt (May 5, 2020)

Doesn't go anywhere to solving the origin problem of course. It's strange that the ANY query just returns an RRSIG record. It's possible that DNSSEC could be causing a problem. I haven't actually used DNSSEC yet as it's not exactly straight forward and an easy way to wipe your entire domain off the Internet if you get it wrong. It's also complicated by the fact that names under the same domain are being used for NS records.

Any queries I do just come back SERVFAIL

```
# drill a ns2.linuxbsd.io
;; ->>HEADER<<- opcode: QUERY, rcode: SERVFAIL, id: 40823
;; flags: qr rd ra ; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
```


----------



## Jose (May 5, 2020)

Heh, I should've tried it. I get a ton of stuff from that domain:

```
$ nslookup -query=any linuxbsd.io
Server:        172.16.1.10
Address:    172.16.1.10#53

Non-authoritative answer:
linuxbsd.io
    origin = ns1.linuxbsd.io
    mail addr = hostmaster.linuxbsd.io
    serial = 2020050105
    refresh = 43200
    retry = 900
    expire = 1209600
    minimum = 3600
linuxbsd.io    rdata_48 = ...
linuxbsd.io    rdata_48 = ...
linuxbsd.io    rdata_46 = DNSKEY ...
linuxbsd.io    rdata_46 = DNSKEY ...
linuxbsd.io    rdata_46 = SOA ...
linuxbsd.io    rdata_47 = linuxbsd.io.linuxbsd.io. NS SOA RRSIG NSEC DNSKEY
linuxbsd.io    rdata_46 = NSEC ...
linuxbsd.io    rdata_46 = NS ...
...
linuxbsd.io    nameserver = ns2.linuxbsd.io.
linuxbsd.io    nameserver = ns1.linuxbsd.io.

Authoritative answers can be found from:
ns1.linuxbsd.io    internet address = 216.182.105.50
ns2.linuxbsd.io    internet address = 216.182.105.55
```
And

```
$ nslookup linuxbsd.io.linuxbsd.io
Server:        172.16.1.10
Address:    172.16.1.10#53

Non-authoritative answer:
Name:    linuxbsd.io.linuxbsd.io
Address: 216.182.105.51
```

The `@` in the first field of his host record is definitely the problem.


----------



## usdmatt (May 5, 2020)

You said yourself in #8 that there is nothing wrong with using @. The $ORIGIN is clearly set to "linuxbsd.io." so that is what the records with @ in the first field will be using. They will not be appending the zone twice.

Testing a similar config works as expected

```
# cat test.inc
$ORIGIN example.net.
@              86400   IN   SOA     ns.example.net. hostmaster.example.net. (
                        2017041101 3600 600 1209600 3600 )
@  IN        NS ns.example.net.

# cat test.zone
$INCLUDE test.inc
ns  IN A 1.2.3.4
@  IN A 2.3.4.5

# named-checkzone -D example.net test.zone
test.inc:4: using RFC1035 TTL semantics
zone example.net/IN: loaded serial 2017041101
example.net.                                  86400 IN SOA      ns.example.net. hostmaster.example.net. 2017041101 3600 600 1209600 3600
example.net.                                  86400 IN NS       ns.example.net.
example.net.                                  86400 IN A        2.3.4.5
ns.example.net.                               86400 IN A        1.2.3.4
OK
```

There's definitely something strange going on though. Testing via Google dns just gives me server error, but I can get a response from the DNS servers directly -


```
linuxbsd.io.    3600    IN      SOA     ns1.linuxbsd.io. hostmaster.linuxbsd.io. 2020050105 43200 900 1209600 3600
linuxbsd.io.    3600    IN      NS      ns1.linuxbsd.io.
linuxbsd.io.    3600    IN      NS      ns2.linuxbsd.io.
linuxbsd.io.    3600    IN      RRSIG

... bunch of DNSSEC stuff...
```

The response includes those NS records, but none of the A records from the main zone file, even though I can spot no obvious problem with that file (assuming what has been posted is exactly what is being used).

Can we get the output of `named-checkzone -D linuxbsd.io /path/to/db.linuxbsd.io` to see exactly what bind makes of the zone config?


----------



## fencepencil (May 5, 2020)

I think you guys were right about the`@` symbol being in there. I ran nslookup on `linuxbsd.io.linuxbsd.io` and it returned the address of the web server...

Here is the output from the checkzone command: What's weird here is ns2 is pointed to the web server's IP address


```
solson@lb-dns-1:~ % named-checkzone -D linuxbsd.io /usr/local/etc/namedb/dynamic/db.linuxbsd.io
zone linuxbsd.io/IN: loaded serial 2020050101
linuxbsd.io.                      3600 IN SOA    ns1.linuxbsd.io. hostmaster.linuxbsd.io. 2020050101 43200 900 1209600 3600
linuxbsd.io.                      3600 IN NS    ns1.linuxbsd.io.
linuxbsd.io.                      3600 IN NS    ns2.linuxbsd.io.
db.linuxbsd.io.                      3600 IN A        216.182.105.52
ns1.linuxbsd.io.                  3600 IN A        216.182.105.50
ns2.linuxbsd.io.                  3600 IN A        216.182.105.51
ns2.linuxbsd.io.                  3600 IN A        216.182.105.55
www.linuxbsd.io.                  3600 IN A        216.182.105.51
OK
```

I checked on the ns2 server and here's the output from that box (errors all over the place). I'm using the RNDC utility to reload the secondary server from the primary. Is there another command that will push the right config to the secondary server?


```
solson@lb-dns-2:/usr/local/etc/namedb/dynamic % named-checkzone -D linuxbsd.io /usr/local/etc/namedb/dynamic/db.linuxbsd.io
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:1: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:2: unexpected end of line
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:2: unexpected end of input
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:4: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:4: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:4: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:4: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:4: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:4: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:4: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:4: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:4: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:4: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:4: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:4: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:4: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:4: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:4: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:4: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:4: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:4: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:5: isc_lex_gettoken() failed: unbalanced parentheses
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:5: unbalanced parentheses
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:5: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:5: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:5: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:5: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:5: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:5: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:5: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:5: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:5: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:5: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:5: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:5: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:5: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:5: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:5: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:5: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:5: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:6: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:6: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:7: unexpected end of line
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:7: unexpected end of input
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:8: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:8: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:8: isc_lex_gettoken() failed: unbalanced parentheses
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:8: unbalanced parentheses
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:8: isc_lex_gettoken() failed: unbalanced parentheses
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:8: unbalanced parentheses
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:8: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:8: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:8: isc_lex_gettoken() failed: unbalanced quotes
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:8: unbalanced quotes
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:10: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:10: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:10: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:10: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:10: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:10: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:10: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:10: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:10: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:10: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:10: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:10: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:10: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:10: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:10: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:10: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:10: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:10: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:10: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:10: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:10: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:10: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:10: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:10: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:10: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:10: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:10: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:10: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:10: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:10: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:10: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:10: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:10: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:10: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:11: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:12: isc_lex_gettoken() failed: unbalanced quotes
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:12: unbalanced quotes
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:13: isc_lex_gettoken() failed: unbalanced quotes
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:13: unbalanced quotes
/usr/local/etc/namedb/dynamic/db.linuxbsd.io:14: unknown RR type '<H�%�U^��'
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:15: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:15: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:15: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:15: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:15: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:15: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:15: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:15: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:15: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:15: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:15: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:15: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:15: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:15: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:15: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:15: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:18: isc_lex_gettoken() failed: unbalanced quotes
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:18: unbalanced quotes
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:20: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:20: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:20: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:20: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:20: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:20: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:20: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:20: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:20: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:20: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:20: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:20: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:20: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:20: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:20: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:20: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:21: syntax error
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:21: isc_lex_gettoken() failed: unbalanced parentheses
dns_master_load: /usr/local/etc/namedb/dynamic/db.linuxbsd.io:21: unbalanced parentheses
/usr/local/etc/namedb/dynamic/db.linuxbsd.io: file does not end with newline
zone linuxbsd.io/IN: loading from master file /usr/local/etc/namedb/dynamic/db.linuxbsd.io failed: syntax error
zone linuxbsd.io/IN: not loaded due to errors.
```


----------



## Jose (May 5, 2020)

usdmatt said:


> You said yourself in #8 that there is nothing wrong with using @. The $ORIGIN is clearly set to "linuxbsd.io." so that is what the records with @ in the first field will be using. They will not be appending the zone twice.


You're right. The only way I could reproduce the duplicate owner name was like this:

```
NS      ns1
example.com         A       172.16.1.10
```

Leading `@` works just fine. Double `@@` is an error. I find the origin replacement rules tricky. I would recommend typing out the entire origin with a trailing dot to get it working, and then go back and replace it with `@` or leave it blank, as appropriate.


----------



## fencepencil (May 5, 2020)

If I use this config file, I get a good checkzone:


```
$ORIGIN linuxbsd.io.
$TTL 3600
@             IN    SOA    ns1.linuxbsd.io. hostmaster.linuxbsd.io. (
                    2020050101    ; Serial
                    43200        ; Refresh - 12 Hours
                    900        ; Retry - 15 Minutes
                    1209600        ; Expire - 2 weeks
                    3600 )        ; Negative Cache Time - 1 hour

            IN      NS      ns1.linuxbsd.io.
            IN      NS      ns2.linuxbsd.io.
           
ns1            IN    A    216.182.105.50
ns2            IN    A    216.182.105.55
@            IN    A    216.182.105.51
www            IN    A    216.182.105.51
db            IN    A    216.182.105.52
```


```
named-checkzone -D linuxbsd.io /usr/local/etc/namedb/dynamic/db.linuxbsd.io
zone linuxbsd.io/IN: loaded serial 2020050101
linuxbsd.io.                      3600 IN SOA    ns1.linuxbsd.io. hostmaster.linuxbsd.io. 2020050101 43200 900 1209600 3600
linuxbsd.io.                      3600 IN NS    ns1.linuxbsd.io.
linuxbsd.io.                      3600 IN NS    ns2.linuxbsd.io.
linuxbsd.io.                      3600 IN A        216.182.105.51
db.linuxbsd.io.                      3600 IN A        216.182.105.52
ns1.linuxbsd.io.                  3600 IN A        216.182.105.50
ns2.linuxbsd.io.                  3600 IN A        216.182.105.55
www.linuxbsd.io.                  3600 IN A        216.182.105.51
OK
```

If I DON'T use the @ symbol, it pulls the last one in the file, which in this case is ns2. That's why a checkzone without the @ symbol says ns2 is pointed to the ip address of the web server.


----------



## Jose (May 5, 2020)

fencepencil said:


> ```
> $ORIGIN linuxbsd.io.
> $TTL 3600
> @             IN    SOA    ns1.linuxbsd.io. hostmaster.linuxbsd.io. (
> ...



Right. Blank gets replaced with the last owner-name or the value of `$ORIGIN`. The last owner-name is "ns2" so this is expected

If you moved the record up a few lines like this

```
$ORIGIN linuxbsd.io.
$TTL 3600
@             IN    SOA    ns1.linuxbsd.io. hostmaster.linuxbsd.io. (
                    2020050101    ; Serial
                    43200        ; Refresh - 12 Hours
                    900        ; Retry - 15 Minutes
                    1209600        ; Expire - 2 weeks
                    3600 )        ; Negative Cache Time - 1 hour

            IN      NS      ns1.linuxbsd.io.
            IN      NS      ns2.linuxbsd.io.
            IN    A    216.182.105.51          
ns1            IN    A    216.182.105.50
ns2            IN    A    216.182.105.55
www            IN    A    216.182.105.51
db            IN    A    216.182.105.52
```
You would get an A record for the `$ORIGIN` pointed at 216.182.105.51.

I find it useful to write in the expanded values when troubleshooting:

```
$TTL 3600
linuxbsd.io.             IN    SOA    ns1.linuxbsd.io. hostmaster.linuxbsd.io. (
                    2020050101    ; Serial
                    43200        ; Refresh - 12 Hours
                    900        ; Retry - 15 Minutes
                    1209600        ; Expire - 2 weeks
                    3600 )        ; Negative Cache Time - 1 hour

linuxbsd.io.            IN      NS      ns1.linuxbsd.io.
linuxbsd.io.            IN      NS      ns2.linuxbsd.io.
linuxbsd.io.            IN    A    216.182.105.51          
ns1.linuxbsd.io.            IN    A    216.182.105.50
ns2.linuxbsd.io.            IN    A    216.182.105.55
www.linuxbsd.io.            IN    A    216.182.105.51
db.linuxbsd.io.            IN    A    216.182.105.52
```

I find the origin expansion rules tricky: https://www.zytrax.com/books/dns/apa/dot.html


----------



## fencepencil (May 5, 2020)

I removed DNSSEC and everything is working fine. I appreciate your guys' help with this. I guess I'll have to lookup the official way to implement DNSSEC.


----------

