Solved

How to fix DNS mx record that is not returned by dig?

Posted on 2010-11-22
12
948 Views
Last Modified: 2012-06-27
Hi
This is such a simple setup I can't believe that it is not working.  I've configured pleny of dns zones with mx records in the past, but they have always been in the one zone, whereas this mx record points to a sub domain.  Is this even a valid way to configure DNS, having the mx and ns records pointing to a sub domain?  Are there any tools to validate bind files?

[domain name changed to acme to protect the innocent]

Basically the mail and name server for acme.com.au are in prv.acme.com.au.
Both domains are on the same server on a 192.168.1 network.

I recently found that some new cron jobs could not send email to the acme.com.au domain because the linux `mail` process couldn't read the mx record.

So I ran dig to verify and sure enough the mx record is not returned.
dig @localhost acme.com.au mx
; <<>> DiG 9.3.4 <<>> @localhost acme.com.au mx
; [b](2 servers found)[/b]
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 52342
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;acme.com.au.	IN	MX

;; AUTHORITY SECTION:
acme.com.au. 86400	IN	SOA	server2.prv.acme.com.au. root.acme.com.au. 2010102511 10800 3600 604800 86400

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Nov 22 21:27:40 2010
;; MSG SIZE  rcvd: 94

Open in new window


Here is the acme.com.au.db file which shows the mx record is there, pointing to the sub domain
$ORIGIN .
$TTL 86400	; 1 day
acme.com.au	IN SOA	server2.prv.acme.com.au. root.acme.com.au. (
				2010102511 ; serial
				10800      ; refresh (3 hours)
				3600       ; retry (1 hour)
				604800     ; expire (1 week)
				86400      ; minimum (1 day)
				)
			NS	server2.prv.acme.com.au.
$ORIGIN acme.com.au.
mail			MX	10 server2.prv
ns1			NS	server2.prv

Open in new window


Not sure if the reverse dns zone is useful, but here it is...
1.168.192.IN-ADDR.ARPA.db
$ORIGIN .
$TTL 86400	; 1 day
1.168.192.IN-ADDR.ARPA	IN SOA	server2.prv.acme.com.au. root.1.168.192.IN-ADDR.ARPA. (
				2010112221 ; serial
				10800      ; refresh (3 hours)
				3600       ; retry (1 hour)
				604800     ; expire (1 week)
				86400      ; minimum (1 day)
				)
			NS	server2.prv.acme.com.au.
$ORIGIN 1.168.192.IN-ADDR.ARPA.
200			PTR	server2.prv.acme.com.au.

Open in new window


I have restarted the named process (many times) plus deleted and reinserted the mx record and even renamed the acme.com.au.db file.

What is the best way to get the mx record working?

Cheers
Gordon
0
Comment
Question by:blokeman
  • 7
  • 5
12 Comments
 
LVL 70

Expert Comment

by:Chris Dent
ID: 34188536

You do not have an MX record defined for acme.com.au.

You do have an MX record defined for mail.acme.com.au.

You want this to add an MX to acme.com.au, assuming the origin is currently acme.com.au.

                  MX      10 server2.prv

Side-notes:

 - Your $ORIGIN statement is pointless (sets @, you don't use @).
 - This sets the Name Server for a sub-domain called ns1, seems a bit weird:

    ns1                  NS      server2.prv

HTH

Chris
0
 

Author Comment

by:blokeman
ID: 34188748
Well spotted! I made a modification:
$ORIGIN .
$TTL 86400	; 1 day
acme.com.au	IN SOA	server2.prv.acme.com.au. root.acme.com.au. (
				2010102541 ; serial
				10800      ; refresh (3 hours)
				3600       ; retry (1 hour)
				604800     ; expire (1 week)
				86400      ; minimum (1 day)
				)
			NS	server2.prv.acme.com.au.
$ORIGIN acme.com.au.
acme.com.au	MX	10 server2.prv
mail			A	192.168.1.200
ns1			NS	server2.prv

Open in new window


but dig still does not give me the mx record!?

dig mx acme.com.au @localhost

; <<>> DiG 9.3.4 <<>> mx acme.com.au @localhost
; (2 servers found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33581
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;acme.com.au.	IN	MX

;; AUTHORITY SECTION:
acme.com.au. 86400	IN	SOA	server2.prv.acme.com.au. root.acme.com.au. 2010102541 10800 3600 604800 86400

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Nov 22 23:26:12 2010
;; MSG SIZE  rcvd: 94

Open in new window

0
 
LVL 70

Accepted Solution

by:
Chris Dent earned 500 total points
ID: 34188764

You *must* terminate names if you're giving it the full name.

Now you have an MX Record for acme.com.au.acme.com.au :) Make it one of these:

acme.com.au.      MX      10 server2.prv

Or:

@                  MX      10 server2.prv

Or:

                  MX      10 server2.prv

The last only works if the entry above uses the origin (@, or acme.com.au.).

Chris
0
 
LVL 70

Expert Comment

by:Chris Dent
ID: 34188779

Incidentally, the same applies to your SOA record. I suggest you opt for @ where you want to use acme.com.au. as the name.

Chris
0
 

Author Comment

by:blokeman
ID: 34188873
Hmm..Don't go away...looking at it right now ! :-)
0
 
LVL 70

Expert Comment

by:Chris Dent
ID: 34188915

No problem, no rush :)

Chris
0
Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

 

Author Comment

by:blokeman
ID: 34190259
Hi Chris,
Have you ever used Novell's eDirectory integrated DNS?

The iManager and the Java DNS management gui's both prompt for a hostname for the resource record.  I received an "invalid hostname" error if I tried to terminate the resource record name "acme.com.au.".

Plus the GUI doesn't allow one to adjust any of the $ORIGIN directives.
So I was stuck in a bind ;-D, and ended up with the following each time I tried to recreate the MX record:
$ORIGIN acme.com.au.
acme.com.au      MX      10 server2.prv

Which is as you mentioned equivalent to acme.com.au.acme.com.au

So in the end I exported the zone to a BIND format, which the gui allowed me to do.  Then edited it by hand to come up with :

$ORIGIN acme.com.au.
@            IN      SOA      server2.prv.acme.com.au. networkadmin.acme.com.au. (
                              2010102581      ; Serial
                              10800      ; Refresh
                              3600      ; Retry
                              604800      ; Expire
                              86400 )      ; Minimum;


$ORIGIN com.au.
acme            IN      NS      server2.prv.acme.com.au.

$ORIGIN acme.com.au.
@                        MX      10      server2.prv.acme.com.au.
mail                        IN      A      192.168.1.200
ns1                        IN      NS      server2.prv.acme.com.au.

Then I imported the Bind file and the GUI presented the MX record correctly, but most of all, dig mx returns a result!! :-)

What a PITA this exercise has been...I am sure that there must be a bug in the iManager and Java DNS module so I'll follow up on that another day.

Thanks for your input, you got me on the right track and showed me the light!!
0
 
LVL 70

Expert Comment

by:Chris Dent
ID: 34190553

I haven't used it I'm afraid. I use BIND (command line only) or MS DNS, the latter lets oyu leave the name field blank to generate the @ records. I guess that doesn't work here?

Chris
0
 

Author Comment

by:blokeman
ID: 34190682
OMG!  I just tried leaving the name blank and it worked!! WTF!!
I am not impressed by software that prompts you to enter data in a field that is not needed!!!
What is the logic of that?  

From you experience with MS DNS, are there scenarios where you need to enter the resource record name when creating a MX record?
 -- Gordon
0
 
LVL 70

Expert Comment

by:Chris Dent
ID: 34190712

Only if you're setting up a sub-domain. e.g.

company.acme.com.au.  IN MX  10  mail.acme.com.au.

Giving mail for bob@company.acme.com.au somewhere to go.

Graphical interfaces are overrated :)

Chris
0
 

Author Comment

by:blokeman
ID: 34190825
Thanks Chris!  That makes sense. "You da Genius man"!

Yeah Graphical interfaces are overrated, a bit like my Bind knowledge!! :-D

--Gordon
0259hrs and signing off
0
 
LVL 70

Expert Comment

by:Chris Dent
ID: 34190830

Sleep well :)

Chris
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
asa failover 3 37
SPF Record 9 38
What is UDP port 389 used for? 5 62
Parse DNS log 3 36
Please see preceding article here: http://www.experts-exchange.com/Networking/Operating_Systems/A_11209-Root-Bridge-Election.html Figure 1 After Root Bridge has been elected, then what?..... Let's start by defining a Root Port in la…
BIND is the most widely used Name Server. A Name Server is the one that translates a site name to it's IP address. There is a new bug in BIND (https://kb.isc.org/article/AA-01272), affecting all versions of BIND 9 from BIND 9.1.0 (inclusive) thro…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now