Reverse DNS and AOL [Quasi-solved]

gpeangel · Last edited by gpeangel on Sun Mar 27, 2005 11:14 pm; edited 1 time in total

I'm in a bit of a bind (sorry, couldn't resist).

AOL has begun enforcing reverse DNS in order to validate e-mail sent to AOL accounts. This has forced me into the fabulous realm of DNS, admittedly a weak area in my SA capabilities.

I have a DSL line with a static IP NAT'ed via a firewall to a mail server on the inside. My DNS servers (primary and secondary) are run by the registrar of my domain name (DomainMonger.com). I now appears I need to run a primary DNS server at my IP address since there doesn't seem to be a way to modify the DNS records at the domain registrar to enable reverse DNS.

I'm in the process of configuring BIND on my server at the moment. It's proving to be slow and confusing so any pointers would be appreciated. I'll be posting my successes in this thread for others.

Has anyone else encountered and solved this issue with AOL and reverse DNS? The forums revealed one thread but no usable specifics for my situation.

Many thanks...
_________________
Gregory Engel
Web Master
www.javazen.com
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
My other computer is spongy gray matter.

adaptr · Posted: Wed Mar 23, 2005 6:23 pm Post subject:

I'll go you one worse: you can't actually influence rDNS yourself at all - in no way.
AOL rents you the line, so AOL sets your IP address and its reverse name.
The only way you can set rDNS yourself is if you get authority over your own IP.
Or the day dawns that AOL lets you set it yourself (as my ISP does...) which basically is the same as the above.
_________________
>>> emerge (3 of 7) mcse/70-293 to /
Essential tools: gentoolkit eix profuse screen

gpeangel · Posted: Wed Mar 23, 2005 6:34 pm Post subject:

adaptr · Posted: Wed Mar 23, 2005 6:52 pm Post subject:

Phew, saved from the edge of madness.. ;-)

In that case, as long as you can get your ISP and the people you get the domain from to let you handle all nameserver requests, you should be good.

By now you have already discovered that DNS is composed of two separate parts: your domain resolution and your IP ranges.
These have to come together at your nameserver in order to do your own rDNS.
In other words:
- your nameserver = authoritative AND primary nameserver for your domain; the only entries the domain provider has for your domain is that you are its primary NS and they are your secondary NS.
- your nameserver = authoritative for your IP range, i.e. your ISP points to your nameservers for rDNS on that block

Then you have to set up a master / slave relationship to do zone transfers (not hard) and populate your DNS with values that seem vaguely entertaining to you ;-)

NS and MX realnames are mandatory, the rest is up to you.
_________________
>>> emerge (3 of 7) mcse/70-293 to /
Essential tools: gentoolkit eix profuse screen

gpeangel · Posted: Fri Mar 25, 2005 4:21 pm Post subject:

Well, I'm getting closer. I installed and configured BIND, starting simple to just handle a zone for my primary domain. Via the DNS Plus panel with DomainMonger.com (my domain registrar) I then set this box to be the primary DNS server and DomainMonger.com's DNS servers as secondary and tertiary. I also tried setting up a PTR reference with DomainMonger.com, but it ended up looking like

adaptr · Posted: Fri Mar 25, 2005 4:44 pm Post subject:

Phew... it's never easy trying to explain DNS to first-timers ;-)

1. You should never create a zone for a host - which is what you're doing with bigc.
2. You should never mix internal and external addresses - which is what you're doing on javazen.
3. No, the origin may obviously not include the final host; it is an origin - the root of a zone.
4. You should never hang localhost off your regular domain - it's merely confusing and may screw things up.
5. What IP you should enter for rDNS depends on where you want to resolve it - for external queries you should of course always reply with the external IP.

I'll try to run through it again:

1. create a javazen.com zone file with the following info:
- SOA (mandatory)
- NS (mandatory)
- MX (mandatory)
- short hostnames of each and every host that should be reachable from the outside; at least the MX host's name has to resolve to an actual address right here.

2. create a reverse zone file for javazen with the following:
- SOA
- NS
- host pointers to equal the forward zone, with the final dot appended to the FQDN hostnames (absolutely mandatory, don't ask why)

3. now, in order for this to work at all, the host you specify as NS in the forward zone has to be duplicated in the providers' root zone file (he administers part of the .com uber-zone) as the primary NS.

This is not shown by your outputs, and is the primary reason it dun't work.
If I

adaptr · Posted: Fri Mar 25, 2005 4:51 pm Post subject:

As an add-on: I just digged javazen.com, and it resolves directly to your IP.
This is not what you want - if you don't take control of your domain then you can't set up rDNS.

The provider's DNS web panel thingy probably doesn't do exactly what you expected...

As an MX, you have set carbon - which again reslves to the same IP.
This is exactly what causes the mail servers' reverse lookup to fail.
It will query carbon.javazen.com, which is 65.102.212.1, then does an rDNS query and it gets... javazen.com.
Which means it fails.

The only thing that matters for the mail servers is that the MX host resolves correctly in both directions.
_________________
>>> emerge (3 of 7) mcse/70-293 to /
Essential tools: gentoolkit eix profuse screen

gpeangel · Posted: Fri Mar 25, 2005 5:03 pm Post subject:

Thanks for you patience, it is greatly appreciated. I hope the forum will benefit from my trip up the learning curve.

See below for my current named.conf. It references other zone files which I have not posted as they didn't seem relevant to the issue. I can post those if necessary.

As I understand it, the localhost is included for the benefit of the internal network. It appeared in a number of examples, however, its certainly possible I didn't understand the examples. Would I include localhost references if DNS was for the benefit of an internal network and not intended as a primary DNS, but not include localhost references if the DNS server is meant to be a primary DNS (public) server?

gpeangel · Posted: Fri Mar 25, 2005 5:09 pm Post subject:

gpeangel · Posted: Fri Mar 25, 2005 5:32 pm Post subject:

gpeangel · Posted: Fri Mar 25, 2005 5:55 pm Post subject:

adaptr · Posted: Fri Mar 25, 2005 6:00 pm Post subject:

None of this will ever set your rDNS correctly, as you are not an autoritative NS for the domain.

gpeangel · Posted: Fri Mar 25, 2005 8:22 pm Post subject:

This is interesting. Before making the above changes to my domain DNS record with the domain registrar, dig reported

ak7 · n00b Joined: 02 Jan 2005 Posts: 52

Reverse DNS is a huge weakness for most ISPs. Its a fairly simple process until you try to define it on an ip by ip basis.

The official name servers for your domain are defined when your domian is registered. To change the authoritative DNS servers you will need to change your domain registration so the defined DNS servers point at your own DNS servers.

Your ISP should be able to create the reverse entries you need. If they won't then it might be time to find a smarter ISP.

RFC 2317 defines a classless reverse technique that does not require your ISP to delegate an IP address to you. In essence, they would create an alias that you would later define. The RFC explains the process in detail. About 25% of the ISP's I've worked with will support Classless Reverse Addressing, the other 75% charge a monthly fee for DNS and don't want to lose their cash cow.

The O'Reiley book on DNS is a must read for anyone contemplating hosting their own DNS!

gpeangel · Posted: Sun Mar 27, 2005 11:14 pm Post subject:

After much effort, I have been unable to configure a DNS server to properly handle reverse DNS requests. My sense is there is a way, but my understanding of DNS is weak. I've acquired the O'Reilly book on BIND and DNS (as well as the cookbook) and once I've worked my way through these, I'll try again.

In the short term, I discovered that my ISP (Qwest) has a feature for those of us who have leased a small block of IP addresses which allows us to specify a single domain per IP address for reverse DNS lookup. This seems to have solved the issue. But not everyone uses Qwest so I don't consider this issue completely resolved. Here's what dig reports now: