Hi Rob,
Thanks a lot for your response. Please find my responses inline. Btw,
your last suggestion has helped me achieve the desired result though I
still feel it would be great to have dnsmasq return NXDOMAIN only for a
particular domain and forward the remainig domain queries to upstream
servers. For example, dnsmasq should be configurable such that query for
_kerberos-master._udp.example.com is returned as NXDOMAIN where as
queries for _kerberos._udp.example.com and _kpasswd._udp.example.com are
forwarded to upstream server.
Thanks and Regards,
Rahul.
Post by /dev/rob0Post by Rahul AmaramPost by Simon KelleyI think you have mis-interpreted the way this works. NXDOMAIN
means that there is no data in the DNS for the given domain. That
is not what's happening here. The example line returns a valid
SRV record for _ldap._tcp.example.com which happens to be empty.
The "domain" refers to _ldap._tcp.example.com and not the domain
which may be returned as part of the reply.
Have you encountered real-world problems with the existing
behaviour?
Well yes. I have encountered some problems with this. I am using
Kerberos in my company LAN. While performing kinit on my system,
the SRV record for _kerberos-master.udp.EXAMPLE.COM is looked up.
Show the dig(1) results to demonstrate this.
# dig +short _kerberos-master._udp.example.com SRV [Request forwarded
to upstream server]
# echo 'srv-host=_kerberos-master._udp.example.com' >> /etc/dnsmasq.conf
# /etc/init.d/dnsmasq restart
Restarting DNS forwarder and DHCP server: dnsmasq.
# dig +short _kerberos-master._udp.example.com SRV
0 0 1 . [Response from dnsmasq. I want this response to be NXDOMAIN)
#
Post by /dev/rob0Is EXAMPLE.COM your
company LAN domain? Does _kerberos-master.udp.EXAMPLE.COM exist in
the form of any RR type, SRV or otherwise?
EXAMPLE.COM is the kerberos realm. I could even have SYNOVEL.COM as the
realm.
Post by /dev/rob0Show what Kerberos is actually looking up. Is it as you said,
_kerberos-master.udp.EXAMPLE.COM, or is is perhaps as per the
documented LDAP example, "_kerberos-master._udp.EXAMPLE.COM"?
I do not understand the difference. If the kerberos realm is
"EXAMPLE.COM" it looks up "_kerberos-master._udp.example.com". If the
kerberos realm is "SYNOVEL.COM", it looks up
"_kerberos-master._udp.synovel.com".
Post by /dev/rob0Post by Rahul AmaramNow if an NXDOMAIN is not returned but instead the default port 1
with empty host is returned, the kinit command tries to further
resolve that empty host (which I think is replaced with<ROOT>
somehow) and this causes a extereme slowdown of kinit.
I think there should be some configuration option to say that an
NXDOMAIN should be returned for a particular SRV record. This
would be really helpful. What are your thoughts about this?
Useless. NXDOMAIN, as Simon explained, means that there is no record
of any RR type for the given name. If you want NXDOMAIN, define
yourself as authoritative for any level of the parent domain[s] in
question.
local=/EXAMPLE.COM/
local=/_tcp.EXAMPLE.COM/
local=/_udp.EXAMPLE.COM/
Then, any name NOT defined under those domains will be NXDOMAIN. I
suspect you have misdiagnosed your original issue.
Thanks. This solution works perfectly. I have added
"local=/_tcp.EXAMPLE.COM/" to dnsmasq.conf and now I am able to get the
desired result.