DDNS – Unable to Add Forward Map SERVFAIL/REFUSED

bindddnsdhcp-serverdomain-name-systemisc-dhcp

I am using bind9 on a primary dns server with two secondary dns servers in a master/slave relationship. I am attempting to implement DDNS but seem to be running into a problem when it comes to adding a forward map, I get the error

Unable to add forward map from DESKTOP-9MFAP8Q.student.co.uk to 192.168.80.51: SERVFAIL

I originally got a REFUSED error until I added the address of the DHCP server into the allow-query and allow-transfer options in named.conf.local on the primary dns. I am not sure if this is needed, it is just something I tried in order to get this to work.

I have attempted changing the permissions on the zone files using

sudo chown bind:bind /etc/bind/*.db

sudo chmod 664 /etc/bind/*.db

but that had no change on the outcome.

I will post the config files below, any help is appreciated.

Router – 192.168.80.2

DHCP – 192.168.80.3

Primary DNS – 192.168.80.4

Secondary DNS – 192.168.80.5, 192.168.80.6

————————-Primary DNS————————-

named.conf.local

//
// Do any local configuration here
//

// Consider adding the 1918 zones here, if they are not used in your
// organization
//include "/etc/bind/zones.rfc1918";

key "rndc-key" {
        algorithm hmac-sha256;
        secret "ppxPx1DgcHkDWDgngLNlgKAETBPEEL9+k8kn9zI/iKRHMdP/8G+U4FRasufyNGOKuUGgTfNqHnOyFxs3zuWlMA==";
};

zone "student.co.uk" {
        type master;
        file "/etc/bind/db.student.co.uk";
        notify no;
        allow-query {
                127.0.0.1;
                192.168.80.5;
                192.168.80.6;
                192.168.80.3;
        };
        allow-transfer {
                192.168.80.5;
                192.168.80.6;
                192.168.80.3;
        };
        allow-update {
                { key rndc-key; };
        };
};

zone "80.168.192.in-addr.arpa" {
        type master;
        file "/etc/bind/db.80.168.192.in-addr.arpa";
        notify no;
        allow-query {
                127.0.0.1;
                192.168.80.5;
                192.168.80.6;
        };
        allow-transfer {
                192.168.80.5;
                192.168.80.6;
        };
        allow-update {
                { key rndc-key; };
        };
};

named.conf.options

options {
        directory "/var/cache/bind";

        // If there is a firewall between you and nameservers you want
        // to talk to, you may need to fix the firewall to allow multiple
        // ports to talk.  See http://www.kb.cert.org/vuls/id/800113

        // If your ISP provided one or more IP addresses for stable
        // nameservers, you probably want to use them as forwarders.
        // Uncomment the following block, and insert the addresses replacing
        // the all-0's placeholder.

         forwarders {
                8.8.8.8;
                8.8.4.4;
         };
         allow-query {
                192.168.80.5;
                192.168.80.6;
                127.0.0.1;
         };
         allow-transfer {
                192.168.80.5;
                192.168.80.6;
                127.0.0.1;
         };

        //========================================================================
        // If BIND logs error messages about the root key being expired,
        // you will need to update your keys.  See https://www.isc.org/bind-keys
        //========================================================================
        dnssec-validation auto;

        listen-on-v6 { any; };
};

db.80.168.192.in-addr.arpa


; BIND reverse data file for local loopback interface
;
$TTL    604800
@       IN      SOA     localhost. root.localhost. (
                     2021020902         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;
@       IN      NS      ns1.student.co.uk.
@       IN      NS      ns2.student.co.uk.
150     IN      PTR     www.student.co.uk.
151     IN      PTR     www.student.co.uk.

db.student.co.uk


; BIND data file for local loopback interface
;
$TTL    604800
@       IN      SOA     localhost. root.localhost. (
                     2021021902         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;
@       IN      NS      ns1.student.co.uk.
@       IN      NS      ns2.student.co.uk.
ns1     IN      A       192.168.80.5
ns2     IN      A       192.168.80.6
www     IN      A       192.168.80.150
www     IN      A       192.168.80.151

————————-DHCP————————-

dhcpd.conf

# option definitions common to all supported networks...
option domain-name "student.co.uk";
option domain-name-servers 192.168.80.5, 192.168.80.6;

default-lease-time 600;
max-lease-time 7200;

# The ddns-updates-style parameter controls whether or not the server will
# attempt to do a DNS update when a lease is confirmed. We default to the
# behavior of the version 2 packages ('none', since DHCP v2 didn't
# have support for DDNS.)
ddns-updates on;
ddns-update-style standard;
update-static-leases on;

# If this DHCP server is the official DHCP server for the local
# network, the authoritative directive should be uncommented.
authoritative;

allow unknown-clients;
use-host-decl-names on;

key rndc-key {
        algorithm hmac-sha256;
        secret ppxPx1DgcHkDWDgngLNlgKAETBPEEL9+k8kn9zI/iKRHMdP/8G+U4FRasufyNGOKuUGgTfNqHnOyFxs3zuWlMA==;
};

zone student.co.uk. {
    primary 192.168.80.4;
    key rndc-key;
}

zone 80.168.192.in-addr.arpa. {
    primary 192.168.80.4;
    key rndc-key;
}

subnet 192.168.80.0 netmask 255.255.255.0 {
  range 192.168.80.50 192.168.80.100;
  option domain-name-servers 192.168.80.5, 192.168.80.6;
  option domain-name "student.co.uk";
  ddns-domainname "student.co.uk.";
   ddns-rev-domainname "in-addr.arpa.";
  option subnet-mask 255.255.255.0;
  option routers 192.168.80.2;
  option broadcast-address 192.168.80.255;
  default-lease-time 600;
  max-lease-time 7200;

  host DOMAIN1 {
    hardware ethernet 00:0c:29:20:87:b0;
    fixed-address 192.168.80.99;
    ddns-hostname "test";
  }
}

Best Answer

General recommendation

Check the logs for BIND (as that is where the error occurred from the looks of it), you should find relevant error messages from the update attempts there.

My hunch (educated guess, if you will)

BIND is probably unable to create/modify files.

Either the directory and/or files are not writable as per the filesystem permissions or some additional layer like Selinux/Apparmor disallows writing outside of the expected directories for the particular service.

Root cause theory (assuming my hunch is correct)

You are placing these writable files in rather unconventional places, this likely goes right against what the package maintainer has prepared for (both in terms of filesystem permissions and any Selinux/Apparmor profiles).

Normally you would use something like /var/lib/bind for writable files (or /var/cache/bind for "cache" files), not /etc/bind as that is normally read-only configuration.

I would suggest confirming the appropriate directory and use that rather making additional system changes unless there is an important reason to use a different directory.

Sidenote: I would suggest using a specific key for these dhcpd-sourced updates rather than repurposing a key named such that it appears to be intended for rndc usage (and presumably also valid for this?).

Related Topic