Reverse DNS for multiple sites on same external subnet

Discussion in 'ISPConfig 3 Priority Support' started by DantePasquale, Jul 17, 2016.

  1. DantePasquale

    DantePasquale Member HowtoForge Supporter

    Hi Everyone,
    OK, I'm thoroughly confused. Number 1 by my OLD ISP not deleting the PTR records for mail.cocoanet.us and mail.dantesinfernophotography.com and now they can't delete them. Then add that my new ISP says I have to override their PTR records for the new IPs for the above mentioned sites!
    So, here's the info:

    My External Subnet 99.78.112.49/29
    mail.cocoanet.us should be using 99.78.112.51
    mail.dantesinfernophotography.com should be using 99.78.112.52

    I've never set up reverse DNS for a subnet that has multiple domains.
    What is the best/proper way to do this?
     
  2. florian030

    florian030 ISPConfig Developer ISPConfig Developer

    There is no difference betwwen rdns for a single-ip or more ips. Just define one rdns-record for each ip.
     
  3. DantePasquale

    DantePasquale Member HowtoForge Supporter

    Can I do that via ISPConfig CP? I don't see a template for the reverse DNS or whatever the proper name is ;)

    And I think I've got a big mess on my hands with this. If I visit network-tools.com it can't find domain entries for my domains and I'm not sure why. traceroute to any of my IPs is not always succeeding and sometimes takes vastly different routes.

    If I specify the IP of the domain on dig, it returns what I expect -- dig @99.78.112.51 -t SOA cocoanet.us
    So it's basically working but not authoritative????
    The domain is at register.com and I've set their DNS to point to ns1.cocoanet.us and ns2.cocoanet.us which it can't see to find.
    Very confused right now :(

    From ISPConfig point of view, do I need 1 IP for each:
    1. website?
    2. mail?
    3. ns?

    or can I combine them, for example ns and mail have the same IP?

    Info:
    Code:
    [99.78.112.49] returned an authoritative response in 63 ms:
    
    Answer records
    name    class    type    data    time to live
    cocoanet.us    IN    MX   
    preference:    10
    exchange:    mail.cocoanet.us
    3600s    (1h)
    cocoanet.us    IN    NS    inferno.cocoanet.us    8640s    (2h 24m)
    cocoanet.us    IN    TXT    v=spf1 ip4:99.78.112.0/29 a:mail.dantesinfernophotography.com include:dantesinfernophotography.com +all    86400s    (1d)
    cocoanet.us    IN    SOA   
    server:    inferno.cocoanet.us
    email:    webadmin@cocoanet.us
    serial:    2016071706
    refresh:    28800
    retry:    7200
    expire:    604800
    minimum ttl:    86400
    8640s    (2h 24m)
    Authority records
    [none]
    Additional records
    name    class    type    data    time to live
    mail.cocoanet.us    IN    A    99.78.112.51    3600s    (1h)
    inferno.cocoanet.us    IN    A    99.78.112.49    86400s    (1d)
    -- end --
    
     
    Last edited: Jul 19, 2016
  4. DantePasquale

    DantePasquale Member HowtoForge Supporter

    hmmm, I gave up for now and put all DNS on register.com just to get things working tonight. That has issues too, but I can deal with those, kind of ;)
     
  5. DantePasquale

    DantePasquale Member HowtoForge Supporter

    Just a quick update - I setup just an email server through ISPConfig on Linode.com and let everything else default. I used Linode.com's DNS manager and have Register.com point to Linode's DNS servers (ns1.linode.com-ns4.linode.com) and now emails can be sent and received. Websites in that DNS point to IPs on my server that's inside of AT&T now and those work. So, I'm not sure how to proceed :)

    1. Can I share IP addresses for multiple uses (ns1 == www == mail)
    2. In that scenario, will having reverse DNS for mail mess up www? I'm not 100% sure on how vhosts use or don't use reverse DNS
    3. In order to get the websites to work, I still have to have named running on my server, but I need to make sure that linode DNS is the authoritative DNS. Is this right?

    Thanks, Dante
     
  6. florian030

    florian030 ISPConfig Developer ISPConfig Developer

    1. yes
    2. the rdns-record are import to send mail. just make sure, the rdns matches the hostname for the server.
    3. if you use the linode dns, you don't need bind on your server
     
  7. DantePasquale

    DantePasquale Member HowtoForge Supporter

    Thanks for the info -- I'm going to try to make the linode instance go away and run everything on my servers again ;)
    But, in the meantime I installed your DKIM patch and set that up but one of the dkim validators is complaining about the public key being invalid. Other validators just display it and don't tell me anything at all. It looks OK to me so I'm not sure how to proceed.

    Here's the output:
    Code:
    DKIM Information:
    DKIM Signature
    Message contains this DKIM Signature:
    DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cocoanet.us; h=
        content-transfer-encoding:content-type:content-type:mime-version
        :user-agent:reply-to:from:from:subject:subject:date:date
        :message-id; s=1468988950; t=1469073561; x=1470887962; bh=w4Va78
        4NFqLUcWtHceBS+rkBsTQvT0TDTU2B+2dClxI=; b=SGWOuU7vCN3z0/Y/BEPBvv
        HdwdXMnfLxRjjwo3TPl1pQrzcUwQBTAibxs+4YZW6GJTGba4eCPAUCwMEWcB6jNo
        8V2mwgTcSLgXpq23aPsASm13Pi+cr2C7h7heuJpw0/ejoEwZN5+z7U6by4HCzAAz
        hvZanbKwKzcied4tAIqE8=
    
    Signature Information:
    v= Version:         1
    a= Algorithm:       rsa-sha256
    c= Method:          relaxed/simple
    d= Domain:          cocoanet.us
    s= Selector:        1468988950
    q= Protocol:       
    bh=                 w4Va78
        4NFqLUcWtHceBS+rkBsTQvT0TDTU2B+2dClxI=
    h= Signed Headers:  content-transfer-encoding:content-type:content-type:mime-version
        :user-agent:reply-to:from:from:subject:subject:date:date
        :message-id
    b= Data:            SGWOuU7vCN3z0/Y/BEPBvv
        HdwdXMnfLxRjjwo3TPl1pQrzcUwQBTAibxs+4YZW6GJTGba4eCPAUCwMEWcB6jNo
        8V2mwgTcSLgXpq23aPsASm13Pi+cr2C7h7heuJpw0/ejoEwZN5+z7U6by4HCzAAz
        hvZanbKwKzcied4tAIqE8=
    Public Key DNS Lookup
    
    Building DNS Query for 1468988950._domainkey.cocoanet.us
    Retrieved this publickey from DNS: "v=DKIM1; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCjYUZjEAOXVqaCLcSIKYYCiAnIdip4xK62Yey0rA0ziamHZ0eBtwzcU/jHVK40IEtt4GuqqLX1L/4dpqgnmTNc3PBtFOBu83xlgu5ANWYLvfEwv/Zf66wy0TFxQ9I6MBkotTbgCCyIbxMW/OcIbxXHlc4qZNIBSd6BE4lGJ8+L4QIDAQAB"
    
    Validating Signature
    result = invalid
    Details: public key: invalid data
     
  8. florian030

    florian030 ISPConfig Developer ISPConfig Developer

    Seems, that the queried dns does not have your current public-key yet.
     
  9. DantePasquale

    DantePasquale Member HowtoForge Supporter

    I think the problem was that I entered the TXT entries with double quotes around them and then the receiver couldn't find the TXT starting with v= because it was getting back "v=

    Thinks look OK.. Thanks. Now I just have to have some time to get the permanent email server working. I wonder if I should re-install ISPConfig instead of upgrading since so much has changed?
     

Share This Page