DNS denying my domain

I've been noticing a problem with my DNS running on my Mac Pro servers that are running 10.4.11. On occasion we will lose power and my servers will shut down once the UPS has run out of backup power. Upon restart, my DNS doesn't seem to be working and the logs show the below which seems to suggest that my domain is denied. When I restart the service, everything starts working again. Any ideas on what the problem is after the initial restart? Any help would be appreciated. Thank you.
7-Jun-2009 08:11:34.231 listening on IPv4 interface en0, 10.15.250.3#53
7-Jun-2009 08:11:35.648 loading configuration from '/private/etc/named.conf'
7-Jun-2009 08:11:39.358 client 10.15.250.3#5353:update 'mydomain.org/IN'denied
7-Jun-2009 08:11:39.469 client 10.15.250.3#5353:update 'mydomain.org/IN'denied

Upon restart, my DNS doesn't seem to be working
When you say, 'doesn't seem to be working', can you explain?
Do you mean that clients can't perform lookups against the server? For your domain? for other domains?
Or are you basing that statement on the logs (which don't support the theory that DNS isn't working).
All the logs indicate is that a client at 10.15.250.3 tried to update the DNS for mydomain.org by registering its own name in the zone - this is common in dynamic networks and is supported by Bonjour. The fact that the registration/update failed is a matter of configuration (updates should</i<> be denied in most cases), but doesn't indicate that DNS isn't working, per se.

Similar Messages

My domain add WWW will redirect to DNS server's Domain, IE works ok,What's the reason

I have a website, and I had added both @ and WWW A record on host. I set the domain as the home page, They all work ok in IE, WWW failed work in Firefox. What are the reasons?
//My domian is http://www.hey-deals.com, hey-deals.com works fine, but http://www.hey-deals.com cannot work in Firefox! It redirect to DNS server's domain, how to set?
Thanks!

I have Windows capability but have never used it. I can't imagine anyone using anything other than Pages for Word Processing, etc. I use Safari and Firefox for Browsing. I use Safari primarily and Firefox occassionally. I have not used Internet Explorer for years and years. In fact, I was sort of surprised when I learned that some people do still use Internet Explorer.
I wasn't sure whether or not there was an Ultra-Safe way to go about checking to discover whether or not Apple Users had to worry about a problem with this particular bug.
Although there IS a link provided in the Denver Post's on-line version of this particular news article, I hated to click on a strange link - even if it was provided by the local newspaper. It is just as easy for the local newspaper to be fooled by bogus links as it is for anyone else to be fooled.
My understanding from friends is that there are a whole lot of local newspapers - all across the country - who are currently running this news article - or an article very similar to it.
So it would seem to me that a whole lot of Apple users all across the country might suddenly be wondering whether or not they have anything to worry about - and whether or not there was an Ultra-Safe way for Apple users to check all of this out.
I contacted my service provider about this issue but, so far, have not heard anything back from them.
Thanks for the response.
Sincerely,
Hannah

On my home wireless network, the iphone 5 won't let me enter the IP address, subnet mask and router info. I was able to enter the DNS and Search Domains. How do I open up those fields?

On my home wireless network, the iphone 5 won't let me enter the IP address, subnet mask and router info. I was able to enter the DNS and Search Domains. How do I open up those fields?

Apparently the router is not sending the info to the iphone. How can I make that happen?

DNS for Multiple Domains

I am trying to figure out the proper configuration for DNS that will support multiple domains. I have DSN working now for just one domain.
My XServe has a static IP connected directly to cable modem and is the master nameserver. I also have an Ubuntu server with static IP connected directly to cable modem that is the secondary (slave) nameserver.
On the XServe, I currently have a primary zone created for domain1.com. with:
* an A record for domain.com. (Fully Qualified) and the same static IP as the XServe
* an A record for ns1 (not fully qualified) and the same static IP as the XServe
* Aliases for ftp, www and mail (not fully qualified) mapped to destination ns1.domain1.com. (Fully Qualified)
Nameservers under the Primary Zone is ns1.domain1.com. and Mail Exchangers is ns1.domain1.com. with a priority of 10.
The reverse zone is getting created appropriately for me as far as I can tell. I am able to access www.domain1.com just fine as well as mail and ftp.
Now I want to add a new domain2.com to this master nameserver. I know that I will need a new Primary Zone for domain2.com. to be recognized and to setup it's aliases?
Can I use the same static IP or do I have to have a unique static IP?
Can I use the ns1.domain1.com. nameserver or does the new domain2.com need new nameservers?
Does domain2.com have it's own A records?
Does the mail exchangers need to be different for domain2.com?
It seems like all the documentation and information that I can find are just for configuring one domain and not so much for multiple domains. Any help would be greatly appreciated.
Spotted Dog

Don't think of subsequent domains as being any different from the first domain.
For every domain you need to provide certain information, including a list of the hostnames within that domain. There is no relationship between 'www' in domain1.com and 'www' in domain2.com (unless you point them to the same address, but that's a different issue).
Any host record in the zone can either be an A record (where you specify an IP address) or a CNAME (where you specify another hostname that it maps to).
In the case of your web server handling both domains you could set 'www.domain2.com' as an A record with the appropriate IP address, or you could set it as a CNAME with a value of 'www.domain1.com.' (essentially saying 'www.domain2.com has the same IP address of www.domain1.com, so go find that address').
It's also possible to use cross-domain records for things like name servers and mail servers - in other words you can set your MX record for domain2.com to mail.domain1.com (essentially saying that domain2.com's email is handled by mail.domain1.com).
Can I use the same static IP or do I have to have a unique static IP?
That's not a question for DNS. What you're defining are the hostnames in that domain. If you have one server (e.g. a web server) that can handle multiple domains (e.g. one apache server handling web traffic for both domain1.com and domain2.com) then, sure, you can use the same IP address for both.
If, on the other hand, you have specific services that cannot be multi-hosted (e.g. HTTPS) then you will need different IP addresses.
Can I use the ns1.domain1.com. nameserver or does the new domain2.com need new nameservers?
Sure, it's entirely possible to use domain1.com's name servers for domain2.com.
Does domain2.com have it's own A records?
It can do, or not, as you choose. If you're running www.domain2.com on the same server as www.domain1.com then you could use a CNAME record to point www.domain2.com to www.domain1.com.,or you could set an A record with the same IP address.
The result would be the same, but the CNAME has the advantage that if your IP address changes you only need to change your DNS in one place (www.domain1.com) and all the other addresses would automatically follow.
Does the mail exchangers need to be different for domain2.com?
Not at all, if your mail server is configured to handle mail for both domains it's entirely possible to specify mail.domain1.com as the MX record for domain2.com.

DHCP creating DNS entries in domain root.

Hello,
I have a Windows DHCP server in a child domain that serves leases to Windows and Linux clients. It also create DNS records for all current leases as well. Recently I noticed it it was creating the DNS records for a few Linux machines in the domain
root DNS and not the client domain DNS.
Is there a way to prevent the dynamic account from creating dns records in the domain root dns?
Thanks!
Shawn

Can we get some more info on your config?
- Is this only affecting non Windows boxes?
- Are your DNS zones forest integrated or just domain integrated?
- Are the DNS servers configured for the scope in the child domain and only hosting the child DNS zones?
- Is the DHCP in the child or root domain?
When dynamic DNS registration happens, it sends the DNS update to the DNS server. What I'm looking for right now in the technical manual is whether the DHCP server sends it to the scope's DNS servers or if it's using it's own DNS servers. If
the DNS server is in the root domain, maybe that could be an issue.
- If you find my posts to be helpful (or the answer), please mark them appropriately.
Chris Ream

How can I override the DNS Servers and Domain Name used by my Airport Time Capsule?

The defaults picked up from my ISP's DHCP are to use the ISP's DNS servers and ISP's domain. I do not want this.
With my prior router I set the DNS servers to Google's Public DNS (8.8.8.8 and 8.8.4.4) and my domain to either "bannister.us" (which I own) or "bannister.home". I do not want simple names resolving to some ISP default. (Yes, I know exactly what this does.)
In the Apple AIrport Utility (version 6.3.2) the fields for DNS and Domain do not allow editing. (Why??)
Is there some way to override this?

Unfortunately not one that will work with the latest version TC.
The way around it is to use a different router.. It can be a very simple router.. I usually recommend units like the TP-Link WDR3600 as they take good third party firmware like gargoyle, openwrt, dd-wrt.. ie they have real controls and beyond that a proper Linux firmware with command line interface.
You can then change the TC over to static IP. It will not be the router.. but it will effectively become the local dhcp server.
I have adsl so I cannot reproduce your system.. I have a bridged modem.. a router.. AC66U.. and a TC.. but the TC is not in bridge.. it is in static IP mode.
Let me demonstrate.
By setting a range on the main router from 1-199 (leave a space.. ) so set the TC to 192.168.2.201 and then you can set DNS and domain as you like. Set the dhcp range (leave a space) you could use 203-253.. then I use the main router as 254.
It is brilliant.. all computers behind the TC receive the IP from the TC with whatever IP and dns (and domain although I haven't changed it).. Effectively the TC works as its own dhcp device.. but is merely a secondary dhcp server to the main unit.
(This gives me netflix which is why I do it.. from well outside the US).
It may be of use.
Why leave a space.. well it helps it to work.. I have not tested it but another person reported issues and found leaving a space .. ie last ip in the router.. 199, static ip 201.. first dhcp 203 (i used 205 to help me keep count!!). worked.. I have not tried to reproduce the problem.. so I reproduce the solution.. it might be like sheep jumping over the fence.. even if the fence was removed the sheep keep jumping over at the same place. Just say bahhh and do likewise.

DNS: Forward Lookup Domain with Just the MX Record

Our Active Directory domain is olddomain.com. I have a Forward Lookup Zone for olddomain.com with CNAME, MX, and many A records. The MX record points to an internal mail server.
We just acquired newdomain.com.
newdomain.com is resolving to external DNS and it works. However, I need to route the internal mail flow of newdomain.com to our internal mail server and not have it pass out to the internet before coming back in.
I would like to add JUST the mx record for newdomain.com to DNS. All other lookups (newdomain.com, subdomains.newdomain.com, etc) should work exactly as they do now.
I have had two thoughts how to do this, but need advice:
Can I have all newdomain.com DNS lookups point to an external DNS, except for the one MX record?
Can I have all newdomain.com resolve to olddomain.com IPs (including subdomains), except for the newdomain.com MX?
I tried adding a new Forward Lookup Zone for newdomain.com with just the SOA, two NS, and the MX record. This broke resolution for http://newdomain.com and http://www.newdomain.com until I added two A records. I do not want to be manually adding records
for all of our newdomain.com subdomains.
What do you recommend?
Thank you in advance!

Can I have all newdomain.com DNS lookups point to an external DNS, except for the one MX record?
You cannot as you will face the problem you already described.
However, you might think about doing it that way:
Get a copy of your external DNS zone (If you can do it of course) using
NSlookup: http://social.technet.microsoft.com/wiki/contents/articles/29184.nslookup-for-beginners.aspx
Create a zone named newdomain.com
Develop a script that will create all the DNS records from the extracted copy except for the MX record
Can I have all newdomain.com resolve to olddomain.com IPs (including subdomains), except for the newdomain.com MX?
Same answer as before.
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile

Direct Access DNS resolution local domain network

Hey guys,
some information to my test environment...
My direct access server and my DC are based on Windows Server 2012 R2. The direct access server has one nic. Port 443 requests are forwarded through an firewall to the direct access server. The configuration for direct access is based on the built in assistens
to configure it.
On client side i am using Windows 8.1 x64.
Now the to my problem...
If I do an ping or a gpupdate when i am not connected to my local company network, the server responds and gpupdate/ping works fine. As soon as i am connected to my local company network i am not able to do a gpupdate or a ping (error in resolving dns).
But i am able to use nslookup to query names.
Anyone a suggestion where the problem could be?

Hi,
It seems that this problem is caused by the issue of Network Location Server.
Does the client know that it is connected to the local network?
When the client connects to the local network, it should show "Connected to network locally or through VPN".
Here is the screenshot of my lab server,
Aslo, we can use the command below to verify this,
netsh dns show state
The Machine location should be "Inside corporate network" when the client is connected to the local network.
If the client doesn't know that it is inside the corporate network, please check if client can access the Network Location Server.
Best Regards.
Steven Lee
TechNet Community Support

DNS problem: search domain Ian

Hi,
I had some spyware on my computer but removed it with Macscan. However, I still find the name 'Ian' in my system preferences under Network 'Search Domains'. I can't remove it. Is my Mac infected once more?
Daniel

Daniel Janssen wrote:
Hi,
I had some spyware on my computer but removed it with Macscan. However, I still find the name 'Ian' in my system preferences under Network 'Search Domains'. I can't remove it. Is my Mac infected once more?
Daniel
Do you use bit-torrent or limewire or that stuff? If so, no telling who was in your computer or what they did. If you run the computer as an administrator, it only makes things worse.
With most malware, you have to invite it into your computer.
Your best bet is to completely reinstall without migrating anything and hope that nothing much was copied from your computer.

Adding DNS server and Domain to Call Manager 9.1.1

I am removing this Post, Thanks to all the replies

The name pretty much says it all, cluster reboot, start by your PUB, wait until it comes up, next TFTP(s) wait until fully up, next SUB1, wait until fully up, and repeat until you've rebooted all servers in your cluster.
HTH
java
if this helps, please rate
www.cisco.com/go/pdihelpdesk

DNS/LDAP Issue for Trusted Domain

Hi
I'm trying to configure Configuration Manager 2012 R2 Forest Discovery to a trusted domain.
Objects from the trusted domain (users/computers) show up in the Collections, but when I check under Administration\Active Directory Forests I can see Discovery Status "Failed to connect using default account" and Publishing status "Cannot
Contact LDAP Server".
I've added the SCCM server to local admin at the trusted domain via GPO and have also created the system Management container.
When I check the log ADForestDisc.log I get this error message:
"Failed to connect to forest X. This can be because of disjoint DNS namespaces, network connectivity or server availibility issue. Error Information The specified forest does not exist or cannot be contacted."
I have setup Conditional Forwarders in DNS in both domains.
I have also read other forums about this issue and should have the answer:
"This error occurs for all of the domains that you mentioned and is typical when SRV records for DCs in those remote domains cannot be found. Forest discovery relies on DNS name resolution of SRV records to locate a suitable DC to communicate with."
"The site server performing the forest discovery must be able to resolve the SRV records for the DCs or root domain of the other forest."
We are using Windows AD integrated DNS in both domains.
I'm not so familiar with DNS configuration so I appreciate if someone could tell more specific how to fix this.
Thanks in advance

Hi
Thank you for your answer. This issue is solved. I've missed to open some ports in the router/firewall between the LANs.
The status under Active Directory Forests is Succeded now, but when I check under boundaries, I can only see the "Default-First-Site-Name" site for the first domain (same LAN as CM Server) and I can only see the IP address range for that LAN.
I don't Think this is a big issue, but shouldn't the site name and address range for the other LAN (where the trusted domain is) be automatically found to during forest Discovery when I've checked the options to create site and ip boundaries automatically?

Domain Controllers that are DNS servers DNS Client settings

[Copying verbatim from a mail by Joe ]
So I have been pinged by a few folks recently on configuration of client DNS settings on Domain Controllers that are also functioning as DNS Servers. Lots of debate. I understand there has been long time debate within MSFT as well.
From http://blogs.technet.com/b/askds/archive/2010/07/17/friday-mail-sack-saturday-edition.aspx there
is the quote
"3.When referencing a DNS server on itself, a DNS client should always use a loopback address and not a real IP address."
From http://www.microsoft.com/en-us/download/confirmation.aspx?id=9166 (Windows
Server 2008 R2 Core Network Guide)
"9. In Preferred DNS server, type the IP address of your DNS server. If you plan to use the local computer as the preferred DNS server, type the IP address of the
local computer.
10. In Alternate DNS Server, type the IP address of your alternate DNS server, if any. If you plan to use the local computer as an alternate DNS server, type the IP address of
the local computer."
From http://technet.microsoft.com/en-us/library/dd378900(v=ws.10).aspx (DNS:
DNS servers on <adapter name> should include their own IP addresses on their interface lists of DNS servers)
"The inclusion of its own IP address in the list of DNS servers improves performance and increases availability of DNS servers. However, if the DNS server is also a domain controller and it points only to
itself for name resolution, it can become an island and fail to replicate with other domain controllers. For this reason, use caution when configuring the loopback address on an adapter if the server is also a domain controller. The loopback address should
be configured only as a secondary or tertiary DNS server on a domain controller...
Add the loopback IP address to the list of DNS servers on all active interfaces. The loopback IP address should not be the first server in the list."
ESPECIALLY "For this reason, use caution when configuring the loopback address on an adapter if the server is also a domain controller. The loopback address should be configured only as a secondary or tertiary
DNS server on a domain controller." and "Add the loopback IP address to the list of DNS servers on all active interfaces. The loopback IP address should not be the first server in the list."
Why shouldn't loopback not be first, the justification is why you shouldn't only use loopback, not why it shouldn't be first.
From http://technet.microsoft.com/en-us/library/ff807362(v=ws.10).aspx (DNS:
DNS servers on <adapter name> should include the loopback address, but not as the first entry)
"If the loopback IP address is the first entry in the list of DNS servers, Active Directory might be unable to find its replication partners.
The inclusion of its own IP address in the list of DNS servers improves performance and increases availability of DNS servers. However, if the DNS server is also a domain controller and it points only to itself,
or points to itself first for name resolution, this can cause a delay during startup. For this reason, use caution when configuring the loopback address on an adapter if the server is also a domain controller. The loopback address should be configured only
as a secondary or tertiary DNS server on a domain controller."
This also seems like justification against only using loopback versus using it first.
Are there any actual real documented issues for using loopback first and a remote DNS server second and perhaps third? If the local DNS server service isn't working yet (or at all), I would expect the DNS Client process
to try to connect to it, fail, and then failover to the secondary just like I would expect it to failover if the remote DNS server was secondary and it was unavailable and it failed back to the loopback. Am I making a bad assumption?
And by documented I don't mean random responses to questions on the internet or other such items. I mean a KB article or technet article or properly researched and tested other web article from a reliable resource.
thanks,
joe

As I understand it, the scenario whereby a DC could become an 'island' if it points only to itself, or to itself first, was repaired in the Windows Server 2003 product cycle. See
http://support.microsoft.com/kb/275278 for information about this scenario.
However, there is still a known problem of slow boot times that can occur. See
http://support.microsoft.com/kb/2001093 for information about this. The scenario that is discussed assumes there is a power failure and servers shut down due to overheating while on backup power. When
multiple servers come online simultaneously after power is restored, there can be a significant delay.
The recommended configuration is one that avoids a single point of failure, but also tries to optimize the speed of resource record registration, so that Active Directory can properly synchronize.
-Greg

2 domain, each with 2 way transitive truts, with sub domains pointing to the same DNS server (how should forward and reserver look zone be configured)

Hello,
I found a test environment and I just trying to understand how it works.
If I have two domains (a.com and b.com) with sub domains(a1.com and b1.com) with two way trust and I want them to point to a Windows DNS server. How should the Forward lookup zones and Reverse lookup zones be configured? In forward lookup
zones do I just add a new zone, make them all primary since only one DNS server, add a.com and b.com and do the same for reverse zones.
Do the sub domains need to be added? What about pointers? Do I add the IP address of a.com and b.com in reverse lookup zones.
A side question: When you create a Domain with dns AD intergrated the forward and reserve lookup are automatically created. You don't need to add the zone of the domain you just created but have to add zones of other domains.

Hello,
I found a test environment and I just trying to understand how it works.
If I have two domains (a.com and b.com) with sub domains(a1.com and b1.com) with two way trust and I want them to point to a Windows DNS server. How should the Forward lookup zones and Reverse lookup zones be configured? In forward lookup
zones do I just add a new zone, make them all primary since only one DNS server, add a.com and b.com and do the same for reverse zones.
Do the sub domains need to be added? What about pointers? Do I add the IP address of a.com and b.com in reverse lookup zones.
A side question: When you create a Domain with dns AD intergrated the forward and reserve lookup are automatically created. You don't need to add the zone of the domain you just created but have to add zones of other domains.
Make each domain controller as a DNS server too. Reverse lookup zones & forwarders are not replicated automatically. You can create AD-Integrated reverse lookup zone & set the replication scope.
You can create AD-Integrated DNS zones in the parent/root domain, set the replication scope to the forest-wide & delegate the zones for handling request locally. Once you create AD-Integrated DNS zone & set the replication scope forest wide, all
the zones will appear automatically in each domain's DNS server.
http://awinish.wordpress.com/2011/04/09/configuring-dns-in-child-domain/
Awinish Vishwakarma - MVP
My Blog: awinish.wordpress.com
Disclaimer This posting is provided AS-IS with no warranties/guarantees and confers no rights.

VPN DNS (no clients) not working after installing SL; resolver w/ no domain

Unfortunately, Snow Leopard has broken VPN DNS (thanks go out to Apple's QA department).
I've tried several methods of "fixing it", but I end up seeing the following issue (output from scutil --dns):
DNS configuration
resolver #1
domain : xxxx.cc
nameserver[0] : 192.168.0.1
order : 200000
resolver #2
nameserver[0] : 10.0.2.1
nameserver[1] : 10.0.2.2
order : 100000
Notice how there is no domain on resolver #2. No matter what I do, I can't get one to populate. So, requests to my VPN domain never get to the correct DNS servers and my connections fail. I've tried manually specifying DNS servers and domains for the VPN connection, but the domain still doesn't populate. I've also tried removing all files under /Library/Preferences/SystemConfiguration/ and rebooting, however that only resolved an earlier issue with simply connecting to the VPN endpoint.
Does anyone have any suggestions on how to populate a domain name in my second resolver?

I Hope someone can figure this out. I too an having a similar problem. Its been a three fold issue. First it took me 3 days to install Snow Leopard (Disk kept ejecting during install), but once I got past that (with help from this forum) I got it installed. Once installed SL broke my internet connections. Network preferences said I was connected to my router and online (Skype showed I was connected), but iChat and Safari wouldn't connect. Again I was able to find a work around (not a true fix) on this forum which was, I had to move my system config file to the desktop and reboot, forcing the mac to create a new system config file for the internet. Now it would connect to my router and get on the internet. It did this like I was a brand new client connecting to my router. I had to re enter network key etc. Again internet is now working, however all my network profiles were gone. this now leads me to the 3rd and unresolved issue. I go through and reenter my settings and things seem to work until I get to the VPN. I use the standard PPTN VPN connection and enter my settings exactly the same as before. and it appears to work. It connects with my server, but not my compant "Intranet" Its accepts my company DNS and search domains but does nothing with them. I can't view anything internally. This exact same setup worked flawlessly in 10.5.8. Am I missing something or did I do something wrong? Please help. Need to access company resources or I will have to downgrade back to Leopard.
Thanks,
Nate

DNS domain up transfer.

I have created One domain dns server my.domain.com and
two sub domain dns servers: branch1is.my.domain.com and
branch2is.my.domain.com.
I have delgated authority for the two sub domain servers and for the domain server for their domains.
I have configured the NS and the glue A record of the sub domains on the my.domain.com server. The domain server can request and resolv the sub domains for hosts that are configured to its domain(down). But the sub domains can't see each other(up) unless there is a my.domain.com ip address in the resolv.conf file.
I am using bind 8 on solaris machine. Is this normal installation or I am missing something.
Abuch

I mean, the sub domains cannot forward requests to other servers in the mydomain.com domain tree. i.e If I want to resolv a host in b1is.mydomain.com from b2is.mydomain.com domain do I have to insert the mydomain.com ip in the resolv.conf file of the b2is.mydoman.com hosts? Or is there a method to forward the query to uper domain without writing the ip in the sub domains resolv.conf files.
Thx.

DNS denying my domain

Similar Messages

Maybe you are looking for