I have clients configured via GPO with the following settings enabled:   Dynamic Update Primary DNS Suffix Register DNS records with connection-specific DNS suffix Register PTR Records: Register   I also have two DHCP servers that are servicing the clients performing updates to the DNS records using a configured user (which is part of the DNSUpdateProxy security group).  The following is currently occurring:  1) A records are updated by clients.  ACLs look fine (the clients' computer objects have write access to their own records).  2) PTR records appear to be updated once by the configured DNSUpdateProxy user on the DHCP server(s).  ACLs look fine (the clients' computer object has write access).  3) Client machines don't appear to be trying to update the PTR records (although I've not pcaped anything yet); I say this because there are no errors logged by Dnsapi after ipconfig /registerdns.  So, what is going on here?  If I enable scavenging, the PTR records will be deleted as their timestamps are all from way back when they were originally registered.
122404
I've stumbled upon a strange behaviour with Windows machines, which seems to be fairly consistent between all Windows versions from Vista/2008 to 8.1/2012 R2; it doesn't happen instead when using Windows XP or Windows Server 2003.  The problem is this: when the network adapter is configured for DHCP and the DHCP server doesn't register DNS records on behalf of its clients (because it can't, or because it's not configured to do so), then the forward A record gets registered, but the reverse PTR record doesn't.  Some more details:   Both the forward and the reverse DNS zones are AD-integrated and accept dynamic updates. All computers are joined to the domain. All computers use the correct internal DNS servers, both when configured statically and when getting their configuration from DHCP. "Register this connection's addresses in DNS" is enabled in the network adapters. Everything is fine when a computer has a static IP address; both the forward and the reverse records get automatically registered. When the same computer is configured for DHCP, the forward record is registered, but the reverse record isn't. This happens for all computers with an OS version >= 6.0, and it's definitely not related to a single machine. No amount of ipconfig /registerdns will change anything. No errors are logged anywhere.   Why does this happen, and how can it be fixed?  And no, configuring the DHCP server to perform DNS registration is not an option here.
56269
What is the best way to add a DNS wildcard record for a domain?  I want example.net, www.example.net, a.b.c.www.example.net, ... going to one server.  Now I use:  example.net.    60  IN  A       1.2.3.4 *.example.net.  60  IN  CNAME   example.net.   Is it possible to do it simpler?
63541
we have an godaddy account for dns, and we registered our servers in godaddy dns admin console, right now we have an problem, our case is our registered server ip in godaddy dns can able to register  any one of other dns service providers, it might be an issue, someone can easily able to register subdomains to our server ip easily.For eg: if some one have to register subdomain in the name of porn sites and those subdoamins it's pointing to our servers directly it would be an issue for us.How to avoid this case.Please can anyone help for this problem.
42125
Even though I have seen and read quite a few similar Q's I was still unable to understand what is required for me to be able to do this.  I have an internal network. One of the machines is a web server. The router is configured for NAT redirecting a specific port to to that machine.  A public domain name is configured using dynamic DNS to point to my external address.  So incoming communication hits the router from its WAN interface and gets pointed to the internal server on the right port.  But if I try to use my public domain name from another machine within my network if fails to be redirected to the server.    In a way I would like that the same NAT rules would apply not only to incoming traffic but to outgoing (sort-of) traffic and have it sent back to the right server.  Assuming this helps, my router (D-Link DSL-2760U) does support static routing, but I am not sure how to configure it. It has the following parameters:   IP Version DstIP/PrefixLength Gateway Interface Metric
52819
I want to use certain DNS servers regardless of whatever I get through DHCP. I'm trying to configure dhclient to ignore those, but I can't seem to get it to work.  Per advice from  I added supersede domain-name-servers 8.8.8.8, 8.8.4.4; stanza to my /etc/dhcp/dhclient.conf file. I also tried  and removed domain-name-servers and domain-search values from request directive. Both of those, applied separately as well as together, seem to have no effect. After running sudo dhclient -r and then sudo dhclient, I still find following entries in /etc/resolvconf/run/interfaces/enp2s0.dhclient:  domain lan nameserver 192.168.1.1   which prompt resolvconf to put nameserver 192.168.1.1 in my /etc/resolv.conf file.  I double-checked if I don't miss any semicolons or similar syntax elements. How can I get my configuration to work? I don't want to remove resolvconf, since it manages changes in my nameservers when I use corporate VPN and it does it well. It looks like dhclient is the offending party here.  Here's my current /etc/dhcp/dhclient.conf with default comments removed for the sake of clarity:  option rfc3442-classless-static-routes code 121 = array of unsigned integer 8;  send host-name = gethostname(); request subnet-mask, broadcast-address, time-offset, routers,         domain-name, host-name,         dhcp6.name-servers, dhcp6.domain-search, dhcp6.fqdn, dhcp6.sntp-servers,         netbios-name-servers, netbios-scope, interface-mtu,         rfc3442-classless-static-routes, ntp-servers;  #supersede domain-name-servers 8.8.8.8, 8.8.4.4;   Update: per request in comment, here's output of ps ax | grep dhcp:  23528 pts/2    S+     0:00 grep dhcp
12392
This is a  about securing public DNS resolvers   Open DNS servers seem pretty neat and convenient, as they provide IP addresses that we can use consistently across our company regardless of where they are located. Google and OpenDNS provide this functionality, but I'm not sure that I want these companies to have access to our DNS queries.  I want to set up something like this for use by our company, but I hear a lot about this being dangerous practice (particularly in regards to ) and I want to make sure that we do this right. What things do I need to keep in mind when building this type of environment?
119472
Part of a firewall on a server :  iptables -A INPUT -p tcp --dport 22 -m state NEW --state -m recent --set  iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 100 --hitcount 10 -j DROP   When I search online I always see NEW being used in that rule but I'm having a hard time understanding why ESTABLISHED and RELATED aren't being used.  Like this :  iptables -A INPUT -p tcp --dport 22 -m state NEW,ESTABLISHED,RELATED --state -m recent --set  iptables -A INPUT -p tcp --dport 22 -m state --state NEW,ESTABLISHED,RELATED -m recent --update --seconds 100 --hitcount 10 -j DROP   Can someone explain to me when exactly a NEW packet changes into ESTABLISHED and RELATED ?
41911
I'm running MySQL5.6.3 on a CentOS 6.1 virtual machine running on Windows XP in .  The network card is configured in bridge mode, so my physical &amp; virtual machines share the same ethernet card.  On the virtual machine, everything works fine: internet access, DNS lookups. However, connections to the MySQL daemon take a while, and the logs keep showing this warning:     [Warning] IP address '192.168.1.201' could not be resolved: Temporary   failure in name resolution   192.168.1.201 is my host machine on which I'm runnning the MySQL client.  Looks like although DNS lookups work fine, reverse DNS lookups end up in a timeout.  Here is the virtual machine configuration:  # cat /etc/sysconfig/network-scripts/ifcfg-eth0 DEVICE="eth0" HWADDR="08:00:27:4B:3D:7C" NM_CONTROLLED="yes" ONBOOT="yes" NETMASK=255.255.255.0 IPADDR=192.168.1.200 GATEWAY=192.168.1.1 PEERDNS=yes  # cat /etc/resolv.conf nameserver 192.168.1.1   Is there something wrong in my network configuration?
116725
I've just read  which essentially says that when I set up DNS for example.com, the root record can't be a CNAME, it has to be an A record.  My question is, why?   I'm sure the clever people who designed DNS didn't make arbitary restrictions for no reason, but I don't see what we gain by requring root domains to be A records. I would love to just point my example.com domain to someserver.somewebhost.example and forget about it, but I can't.  Please enlighten me, billpg.
69713
I have a feeling that there must be client-server synchronization patterns out there. But i totally failed to google up one.  Situation is quite simple - server is the central node, that multiple clients connect to and manipulate same data. Data can be split in atoms, in case of conflict, whatever is on server, has priority (to avoid getting user into conflict solving). Partial synchronization is preferred due to potentially large amounts of data.  Are there any patterns / good practices for such situation, or if you don't know of any - what would be your approach?  Below is how i now think to solve it: Parallel to data, a modification journal will be held, having all transactions timestamped.  When client connects, it receives all changes since last check, in consolidated form (server goes through lists and removes additions that are followed by deletions, merges updates for each atom, etc.). Et voila, we are up to date.  Alternative would be keeping modification date for each record, and instead of performing data deletes, just mark them as deleted.  Any thoughts?
20502
Let me narrate you my small story:  So right now, I am using an Ubuntu 16.04 LTS distribution in my lab. After installing Ubuntu, I tried just check my Internet access by googling. However that was impossible. So firstly I try to ping Google's server:  ping 8.8.8.8   This first ping was successful. So secondly I try to ping yahoo site:  ping yahoo.com   The answer was that the name was unknown so I decide to check the resolv.conf file in /etc:  # Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8) #     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN nameserver 127.0.0.1 search &lt;www.some-sites&gt;   The problem is the nameserver. My collaborators told me that the have copied some lines in /etc/resolvconf/resolv.config.d/base:  domain bla.bla search &lt;www.some-sites&gt; nameserver 111.222.3333.4444 nameserver 555.666.7777.8888   They proposed me to reboot or just run the following commands  resolvconf --enable-updates resolvconf -u   When I checked /etc/resolv.conf it was again the same as that beginning   Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8) #     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN nameserver 127.0.1.1 search &lt;www.some-sites&gt;   So how I can input the domain and my two new specific nameservers??? I don't really know hot to configure interfaces and if it is possible. I cannot also understand why this happened since base is a file that should be copied into resolv.conf file. Could you explain me why that error happened?  Thank you
38361
We have an SMTP only mail server behind a firewall which will have a public A record of mail..  The only way to access this mail server is from another server behind the same firewall.  We do not run our own private DNS server.  Is it a good idea to use the private IP address as an A record in a public DNS server - or is it best to keep these server records in each servers local hosts file?
18491
This is a  about DNS server administration.   I have one hundred or so domains. All of these domains need to be configured identically, but it seems like a huge waste of time to have to configure a new zone and/or zonefile for every one of these domains. There has to be a better way to automate this!  I think I'm on to something...if I create a zone called ., or use some other feature in my DNS software to always return a specific IP when an A record is requested, this seems to get me pretty close to my desired end result. My server is responding authoritatively to the requests and it's so much easier to manage!  This was working great until nameserver validation software started checking these domains. I figured out that I can make most of the errors go away by adding NS records, but my software won't let me put more than one SOA record in the same zone file.  How do I work around this multiple SOA record problem?
103626
I've been having an issue on my network that has completely vexed me.  I have three workstations running Ubuntu 13.04, one Windows 7 workstation, and three servers on Ubuntu Server 12.04. One of the servers is a domain controller running Samba4 and handles DNS, Kerberos, NTP, and DHCP.  Today I was trying to add a laptop to the domain, running Ubuntu 13.10. I issue net ads join -U AdminUser and the laptop joins the domain with no errors. I literally copied and pasted the config files from the other workstations and verified the permissions.  When I run wbinfo I can see the domain users and groups. However, when I run getent I see only local users and groups. If I run wbinfo -a domainuser --verbose, I am asked for the user's password and the password is accepted with no errors. Kerberos works as well.  nsswitch.conf, pam.d/common-auth, pam.d/common-session, pam.d/common-account, smb.conf, and krb5.conf are all exact copies of the other systems (which work), and I've even read through them all to verify this.  Is there something I've overlooked?   Is there something that was changed on Ubuntu between 13.04 and 13.10?   Any help would be appreciated!
89674
Q1: Does a DNS rule for *.domain.com match multi-level domain names? In other words, if I just set *.domain.com in my DNS records, will it match all of:  a.domain.com b.a.domain.com c.b.a.domain.com   as many levels deep as needed, with just that one wildcard DNS specifier?  We have a use case for multi-level DNS and I would like to confirm that we are doing the right thing in setting one wildcard DNS setting for the root domain.  Q2: will this work with round-robin DNS?
96492
I want to debug a router that is giving strange DHCP settings, but I don't know how to check it without having to make my system take all the configurations. Isn't there a utility that returns all DHCP settings (like NTP, WINS, DNS, IP, router) whenever a client connects?  Preferably that is platform independent, and that won't require changing the client's configuration to trigger the DHCP.
60162
I've created accounts and hostnames within my  account, which is by  far the most commonly used service for my type of server. Can somebody walk me through the configuration process of using ddclient with no-ip, as I'm a command line noob?