Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Split DNS not working

    Scheduled Pinned Locked Moved DHCP and DNS
    18 Posts 3 Posters 10.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      awesomekyle
      last edited by 

      #
# Mac OS X Notice
#
# This file is not used by the host name and address resolution
# or the DNS query routing mechanisms used by most processes on
# this Mac OS X system.
#
# This file is automatically generated.
#
domain example.com
nameserver 192.168.1.1
nameserver 2601:7:2000:34:20c:xxxx:xxxx:xxxx

      The IPv6 nameserver is my router.

      The same settings are listed in System Preferences under DNS Servers and Search Domains.

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        OK.  So we also have IPv6 in the mix.

        All your external DNS looks good on dyn.

        dig @192.168.1.1 fqdn a
        dig @192.168.1.1 fqdn aaaa
        dig -6 @2601:7:2000:34:20c:xxxx:xxxx:xxxx fqdn a
        dig -6 @2601:7:2000:34:20c:xxxx:xxxx:xxxx fqdn aaaa

        Does any of that turn up any clues as to where the problem is?

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • A
          awesomekyle
          last edited by 

          ➜  ~  dig @192.168.1.1 gitlab.example.com a

; <<>> DiG 9.8.3-P1 <<>> @192.168.1.1 gitlab.example.com a
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9719
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;gitlab.example.com.		IN	A

;; ANSWER SECTION:
gitlab.example.com.	1	IN	A	192.168.1.21

;; Query time: 30 msec
;; SERVER: 192.168.1.1#53(192.168.1.1)
;; WHEN: Tue Aug 12 06:59:45 2014
;; MSG SIZE  rcvd: 56

➜  ~  dig @192.168.1.1 gitlab.example.com aaaa

; <<>> DiG 9.8.3-P1 <<>> @192.168.1.1 gitlab.example.com aaaa
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57959
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;gitlab.example.com.		IN	AAAA

;; ANSWER SECTION:
gitlab.example.com.	572	IN	CNAME	example.com.

;; AUTHORITY SECTION:
example.com.	1772	IN	SOA	ns1.mydyndns.org. zone-admin.dyndns.com. 2011111880 10800 1800 604800 1800

;; Query time: 30 msec
;; SERVER: 192.168.1.1#53(192.168.1.1)
;; WHEN: Tue Aug 12 06:59:48 2014
;; MSG SIZE  rcvd: 124

➜  ~  dig -6 @2601:7:2000:34:xxxx:xxxx:xxxx:xxxx gitlab.example.com a

; <<>> DiG 9.8.3-P1 <<>> -6 @2601:7:2000:34:xxxx:xxxx:xxxx:xxxx gitlab.example.com a
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33894
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;gitlab.example.com.		IN	A

;; ANSWER SECTION:
gitlab.example.com.	1	IN	A	192.168.1.21

;; Query time: 29 msec
;; SERVER: 2601:7:2000:34:xxxx:xxxx:xxxx:xxxx#53(2601:7:2000:34:xxxx:xxxx:xxxx:xxxx)
;; WHEN: Tue Aug 12 07:00:49 2014
;; MSG SIZE  rcvd: 56

➜  ~  dig -6 @2601:7:2000:34:xxxx:xxxx:xxxx:xxxx gitlab.example.com aaaa

; <<>> DiG 9.8.3-P1 <<>> -6 @2601:7:2000:34:xxxx:xxxx:xxxx:xxxx gitlab.example.com aaaa
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48424
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;gitlab.example.com.		IN	AAAA

;; ANSWER SECTION:
gitlab.example.com.	329	IN	CNAME	example.com.

;; AUTHORITY SECTION:
example.com.	148	IN	SOA	ns1.mydyndns.org. zone-admin.dyndns.com. 2011111880 10800 1800 604800 1800

;; Query time: 31 msec
;; SERVER: 2601:7:2000:34:xxxx:xxxx:xxxx:xxxx#53(2601:7:2000:34:xxxx:xxxx:xxxx:xxxx)
;; WHEN: Tue Aug 12 07:00:51 2014
;; MSG SIZE  rcvd: 124

          So it looks like Dyn is the authoritative DNS server. Is that likely what the problem is?

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            Do you have DNS overrides in pfSense for both gitlab.example.com and example.com?  I just looked at your images.  I would get rid of the domain override for .com and set host overrides for example  .com  and gitlab  example.com.

            I have personally never used the dnsmasq overrides to set an A record on a 2nd level domain name.  I can see how that might be problematic.

            dyn is going to be authoritative.  That's how it's set up.  I wouldn't worry too much about that.  From the mac you could also:

            dig @192.168.1.1 example.com ns
            dig -6 @@2601:7:2000:34:20c:xxxx:xxxx:xxxx example.com ns

            To see what name servers are being returned.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • A
              awesomekyle
              last edited by

              @Derelict:

              I would get rid of the domain override for .com and set host overrides for example  .com  and gitlab  example.com.

              Do you mean set an override for example.com to point to 192.168.1.1 and gitlab.example.com to 192.168.1.21? I tried that and every *.example.com hostname resolved to my router, even gitlab.example.com.

              @Derelict:

              dig @192.168.1.1 example.com ns
              dig -6 @@2601:7:2000:34:20c:xxxx:xxxx:xxxx example.com ns

              
➜  ~  dig @192.168.1.1 example.com ns

; <<>> DiG 9.8.3-P1 <<>> @192.168.1.1 example.com ns
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 19718
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;example.com.		IN	NS

;; ANSWER SECTION:
example.com.	21599	IN	NS	ns2200.dns.dyn.com.
example.com.	21599	IN	NS	ns3131.dns.dyn.com.
example.com.	21599	IN	NS	ns4191.dns.dyn.com.
example.com.	21599	IN	NS	ns1171.dns.dyn.com.

;; Query time: 231 msec
;; SERVER: 192.168.1.1#53(192.168.1.1)
;; WHEN: Tue Aug 12 18:50:28 2014
;; MSG SIZE  rcvd: 125

➜  ~  dig -6 @2601:7:2000:34:xxxx:xxxx:xxxx:xxxx example.com ns

; <<>> DiG 9.8.3-P1 <<>> -6 @2601:7:2000:34:xxxx:xxxx:xxxx:xxxx example.com ns
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36010
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;example.com.		IN	NS

;; ANSWER SECTION:
example.com.	21599	IN	NS	ns2200.dns.dyn.com.
example.com.	21599	IN	NS	ns1171.dns.dyn.com.
example.com.	21599	IN	NS	ns3131.dns.dyn.com.
example.com.	21599	IN	NS	ns4191.dns.dyn.com.

;; Query time: 183 msec
;; SERVER: 2601:7:2000:34:xxxx:xxxx:xxxx:xxxx#53(2601:7:2000:34:xxxx:xxxx:xxxx:xxxx)
;; WHEN: Tue Aug 12 18:50:48 2014
;; MSG SIZE  rcvd: 125
              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                No.  You have a domain override sending all .com queries to 192.168.1.1 (http://i.imgur.com/zgAByBc.png)  Delete that.

                And the record for gitlab has .com as the domain name.  That should be gitlab with example.com as the domain.

                Is this name server the pfSense DNS forwarder?  nameserver 2601:7:2000:34:20c:xxxx:xxxx:xxxx

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  I think this will fix your problem as long as that IPv6 name server is NOT external but is the local pfSense dns forwarder.  When you're doing split dns like this, you cannot have internal hosts querying both internal and external nameservers.

                  1.  Delete all host overrides and domain overrides.

                  2.  Create a host override for:

                  host gitlab
                  domain example.com
                  ip 192.168.1.21

                  3.  Create a host override for:

                  host example
                  domain com
                  ip 192.168.1.21

                  Try again.

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • A
                    awesomekyle
                    last edited by

                    @Derelict:

                    And the record for gitlab has .com as the domain name.  That should be gitlab with example.com as the domain.

                    I should've made it more clear, it's domain is correct, I was just trying to obfuscate it.

                    @Derelict:

                    I think this will fix your problem as long as that IPv6 name server is NOT external but is the local pfSense dns forwarder.  When you're doing split dns like this, you cannot have internal hosts querying both internal and external nameservers.

                    1.  Delete all host overrides and domain overrides.

                    2.  Create a host override for:

                    host gitlab
                    domain example.com
                    ip 192.168.1.21

                    3.  Create a host override for:

                    host example
                    domain com
                    ip 192.168.1.21

                    Try again.

                    That appears to have worked, though I'm not sure why. I had already tried removing the domain override, which didn't fix the issue. Adding the host override for example with the .com domain seems to have resolved it.

                    Why is that? Is OS X resolving both gitlab.example.com and example.com simultaneously when I try to connect? Shouldn't the host override for gitlab be enough?

                    1 Reply Last reply Reply Quote 0
                    • DerelictD
                      Derelict LAYER 8 Netgate
                      last edited by

                      Is the IPv6 nameserver 2601:7:2000:34:20c:xxxx:xxxx:xxxx any server other than the pfSense DNS forwarder?

                      Chattanooga, Tennessee, USA
                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                      1 Reply Last reply Reply Quote 0
                      • A
                        awesomekyle
                        last edited by

                        @Derelict:

                        Is the IPv6 nameserver 2601:7:2000:34:20c:xxxx:xxxx:xxxx any server other than the pfSense DNS forwarder?

                        Nope, it's the pfSense LAN IPv6 address.

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.