Hello,
could you please help me with knot resolver configuration in the case when I
need to redirect each variation for the domain to some address.
e.g.
www.example.com, m.example.com, domain.example.com ...
like wildcard record
*.example.com 10.0.0.50
In my configuration is it handeled by file with static records
-- load static records
hints.add_hosts('/etc/knot-resolver/static_records.txt')
which contains address to be redirected and the domain.
10.0.0.50 1xbet.com
10.0.0.50 thelotter.com
10.0.0.50 webmoneycasino.com
10.0.0.50 betworld.com
10.0.0.50 bosscasino.eu
10.0.0.50 sportingbull.com
But I´m not able to handle the correct syntax for a wildcard domain
redirection.
Best regards,
--
Smil Milan Jeskyňka Kazatel
Hi,
i installed knot-resolver on my mail server and i see a issue with a specific domain, dovecot.org.
Everything is working as expected but this single domain doesn't always resolve.
After some time postfix cannot check the domain where mails coming from and doesn't accept them.
If i do dig dovecot.org, i get this (SERVFAIL):
dig dovecot.org
; <<>> DiG 9.11.26-RedHat-9.11.26-6.el8 <<>> dovecot.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 27594
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;dovecot.org. IN A
;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Fr Apr 29 08:34:55 CEST 2022
;; MSG SIZE rcvd: 40
it starts working again if do dig +cd, like this:
dig +cd dovecot.org
; <<>> DiG 9.11.26-RedHat-9.11.26-6.el8 <<>> +cd dovecot.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56130
;; flags: qr rd ra cd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;dovecot.org. IN A
;; ANSWER SECTION:
dovecot.org. 300 IN A 94.237.12.234
;; Query time: 245 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Fr Apr 29 08:34:59 CEST 2022
;; MSG SIZE rcvd: 56
i didn't have this kind of issue using unbound before i switched, so i think here would be the right place to ask.
i'm using the knot-resolver 5.5.0 package from epel on rockylinux 8.5 and my kresd config is very simple:
net.listen('127.0.0.1', 53, { kind = 'dns' })
net.listen('127.0.0.1', 853, { kind = 'tls' })
--net.listen('127.0.0.1', 443, { kind = 'doh2' })
net.listen('::1', 53, { kind = 'dns', freebind = true })
net.listen('::1', 853, { kind = 'tls', freebind = true })
--net.listen('::1', 443, { kind = 'doh2' })
-- Load useful modules
modules = {
'hints > iterate', -- Allow loading /etc/hosts or custom root hints
'stats', -- Track internal statistics
'predict', -- Prefetch expiring/frequent records
}
-- Cache size
cache.size = 100 * MB
-- use /etc/hosts entries
-- hints.add_hosts()
net.ipv6 = false
Anything i can do to track this down?
Thanks in advance for your help.
Juergen
Hello,
We are using Knot-Resolver 5.5.0 with rebinding protection:
modules.load('rebinding < iterate')
We have some complains about an invalid domain name being returned in
the additional section of the response to the blocked request:
;; ADDITIONAL SECTION:
explanation.invalid. 10800 IN TXT "blocked by DNS
rebinding protection"
It looks like some windows domain controllers running DNS clients do not
like it and log an error:
The DNS server encountered an invalid domain name in a packet from
<Knot-Resolver IP> The packet will be rejected. The event data contains
the DNS packet.
Is there a way how to suppress this? Or even better response with SERVFAIL?
Thanks
Ales Rygl
Hello,
I'd would like to ask for help with preload module. The issue is that
when running multiple instatnces of kresd under systemd usualy just one
of them is able to start correctly. The other hangs and fails to start.
The config is just copy/paste from the documentation:
modules.load('prefill')
prefill.config({
['.'] = {
url = 'https://www.internic.net/domain/root.zone',
interval = 86400, -- seconds
}
})
Starting instances in a sequence does not help, the 2nd one hangs - and
only if the 1st one is killed/stopped the 2nd one goes on and processes
the root zone.
Did I miss something in the documentation?
With regards
Ales Rygl
