News for hackers. Stuff that matters.

A comment on Why is DNS still hard to learn?. Parent comment

Re:Why is DNS still hard to learn? by haroldp on Friday July 28, 2023 @03:37PM (#36912154)
Can you help me find the mistake in my zone file?

  $ORIGIN example.net.
  $TTL 900
  @    IN    SOA    ns1.example.com. [email protected]. (
        20230728001
        1800
        300
        3600
        172800
    )
  @    IN    NS      8.8.8.8.
  @    IN    NS      8.8.4.4.

  @    IN    CNAME example.com.
  @    IN    MX    10    172.253.124.27
  www  IN    CNAME example.com
[ Parent | on HN ]
Re:Why is DNS still hard to learn? by throw0101b on Friday July 28, 2023 @04:00PM (#36912492)
Off the top of my head (haven't had to do zone files for ~2 years):

* [email protected] -> hostmaster.example.com

* NS records are usually hostnames (not sure if IPs are even valid)

* Ditto for MX records ; also add a period to the end, otherwise example.net will get appended

* Also appending with the www record

See also:

* https://linux.die.net/man/8/named-checkzone

[ Parent | on HN ]
Re:Why is DNS still hard to learn? by TheNewsIsHere on Friday July 28, 2023 @04:48PM (#36913100)
To add —

You can do delegated zones by specifying NS records for a subdomain within the parent zone. If you’re talking about NS for a second level domain (“example” in example.com) you would want glue records which are essentially a “lookaside” to prevent circular dependencies. Glue records are really just A records with clout, returned with the IP of your name server. This glue is maintained by the higher level authoritative zone. So you query for example.org and the nameserver for .org returns ns1.example.org as the name server for your zone, as well as the IP address for that server.

This is why you could run a DNS server at ns1.example.org as your authoritative DNS.

[ Parent | on HN ]
Re:Why is DNS still hard to learn? by haroldp on Friday July 28, 2023 @08:40PM (#36915470)
Pretty good! :)

Besides what was mentioned by others, there are two more mistakes in the SOA and one in each NS.

[ Parent | on HN ]
Re:Why is DNS still hard to learn? by throw0101b on Friday July 28, 2023 @10:01PM (#36916040)
> mistakes in the SOA

I figured there was since (e.g.) the numbers looked 'off' (regular TTL vs. negative TTL), but couldn't be arsed to look up the exact SOA format.

[ Parent | on HN ]
Re:Why is DNS still hard to learn? by somat on Friday July 28, 2023 @04:37PM (#36912970)
Also the CNAME if you have a cname you don't want any other records with the same name. It ends up being a confusing and ambiguous situation to be if. You are supposed to use the cname to jump the the actual record. but now there is also a MX record here are we supposed to do anything with it?
[ Parent | on HN ]
Re:Why is DNS still hard to learn? by creeble on Friday July 28, 2023 @07:11PM (#36914641)
Indeed, a semi-common footgun that is allowed by BIND and I think many other servers.
[ Parent | on HN ]