DNS problem
 

Hi any one, I'had this problem:
Went i write the comand
# dig www.xxx.com @192.168.XXX.XXX

; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5_4.2 <<>> www.xxx.com @192.168.XXX.XXX
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28283
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 0

;; QUESTION SECTION:
;www.xxx.com. IN A

;; ANSWER SECTION:
www.xxx.com. 86400 IN A XXX.XXX.XXX.XXX

;; AUTHORITY SECTION:
xxx.com. 86400 IN NS ns1.xxx.com.
xxx.com. 86400 IN NS ns2.xxx.com.

;; Query time: 0 msec
;; SERVER: 192.168.XXX.XXX#53(192.168.XXX.XXX)
;; WHEN: Mon Jul 12 21:52:11 2010
;; MSG SIZE rcvd: 83

and whent I' write the comand
# dig www.xxx.com @XXX.XXX.XXX.XXX (IP name server)

; <<>> DiG 9.3.6-P1-RedHat-9.3.6-4.P1.el5_4.2 <<>> www.xxx.com @XXX.XXX.XXX.XXX
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 54142
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;www.xxx.com. IN A

;; Query time: 1 msec
;; SERVER: XXX.XXX.XXX.XXX#53(XXX.XXX.XXX.XXX)
;; WHEN: Mon Jul 12 22:05:46 2010
;; MSG SIZE rcvd: 31

in the panel ISPconfig give me the error Server MyDNS: out of line

Can you help me any one?

CENTOS 5.5 and ISPcongif 3.0

Looks as if your dns server is not listening on localhost (IP 127.0.0.1). Please post the output of the command:

netstat -tap | grep dns

netstat -tap
 

# netstat -tap
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address Stat e PID/Program name
tcp 0 0 *:imaps *:* LIST EN 2856/dovecot
tcp 0 0 *:pop3s *:* LIST EN 2856/dovecot
tcp 0 0 localhost.localdomain:10024 *:* LIST EN 2902/amavisd (maste
tcp 0 0 localhost.localdomain:10025 *:* LIST EN 2959/master
tcp 0 0 *:mysql *:* LIST EN 2818/mysqld
tcp 0 0 *:pop3 *:* LIST EN 2856/dovecot
tcp 0 0 localhost.local:dyna-access *:* LIST EN 2734/clamd
tcp 0 0 *:imap *:* LIST EN 2856/dovecot
tcp 0 0 *:sunrpc *:* LIST EN 2393/portmap
tcp 0 0 web.xxx.com:domain *:* LIST EN 2365/named
tcp 0 0 *:ftp *:* LIST EN 3006/pure-ftpd (SER
tcp 0 0 *:918 *:* LIST EN 2432/rpc.statd
tcp 0 0 localhost.localdomain:ipp *:* LIST EN 2718/cupsd
tcp 0 0 *:smtp *:* LIST EN 2959/master
tcp 0 0 localhost.localdomain:rndc *:* LIST EN 2365/named
tcp 0 0 *:imaps *:* LIST EN 2856/dovecot
tcp 0 0 *:pop3s *:* LIST EN 2856/dovecot
tcp 0 0 *:pop3 *:* LIST EN 2856/dovecot
tcp 0 0 *:imap *:* LIST EN 2856/dovecot
tcp 0 0 *:webcache *:* LIST EN 2990/httpd
tcp 0 0 *:http *:* LIST EN 2990/httpd
tcp 0 0 *:tproxy *:* LIST EN 2990/httpd
tcp 0 0 *:ftp *:* LIST EN 3006/pure-ftpd (SER
tcp 0 0 localhost6.localdoma:domain *:* LIST EN 2365/named
tcp 0 0 *:ssh *:* LIST EN 2705/sshd
tcp 0 0 localhost6.localdomain:rndc *:* LIST EN 2365/named
tcp 0 0 *:https *:* LIST EN 2990/httpd
tcp 0 2520 web.xxx.com:ssh xx.Red-217-127-xxx.sta:nirp ESTA BLISHED 19937/0

netstat -tap | grep dns
 

no repli this comand

DNS repli Ok in localhost
 

Good de comand dig repli OK now in localhost:
dig www.xxxxx.com @localhost

BUT NOT IN EXTERNAL ANSWER: IN INTERNET REQUEST.

dig www.xxxxx.com @IP of ns1.

port in firewall is OK 53 tcp - udp
NAT port in ruter OK 53 tcp - udp

I work a lot hours and nothing.

Some one can help my.

thank.

I see this in the reg system of tab monitor
 

ul 13 17:17:00 web named[31628]: client 66.249.xxx.xxx#59173: query (cache) 'something.org/A/IN' denied
Jul 13 17:17:04 web named[31628]: client 66.249.xxx.xxx#51912: query (cache) 'something.org/A/IN' denied
Jul 13 17:18:41 web named[31628]: client 210.19.xxx.xxx#1026: query 'any.com/MX/IN' denied
Jul 13 17:18:46 web named[31628]: client 218.248.xxx.xxx#3946: query 'any.com/MX/IN' denied
Jul 13 17:18:52 web named[31628]: client 218.248.xxx.xxx#26147: query 'any.com/MX/IN' denied

What's the output of ?

It looks like you haven't allowed authoritative requests from off your network.

I don't use MyDNS or whatever ISPConfig uses for DNS, but if it's bind, have a look in your config at the options statement and check your external facing interface is in the listen-on list, and that allow-query (if it exists) lists who should be able to access it. Usually, you would want "any;" for a publically accessable authoritative name server.

comand getenforce
 

Hi falko this is the result of getenforce:

Disabled

Looks good. If you use BIND - can you post your named.conf?