DNS Setup Breaks Internal Access to Our Own Site & Email

[cyburk]

Sorry to start out with such a basic question, but I’ve read this site’s Best Practices article, this forum, Apple’s documentation, and pretty much everything else Google could find for me and I’m at my wits’ end.

Our network consists of an Xserve running Tiger Server (10.4.3), a few printers, and a half dozen client machines (all Macs). The whole thing is behind a router that provides a firewall, NAT, and DHCP. The Xserve is an Open Directory Master that runs AFP and Web services for our website. We have a dynamic IP from our ISP so we use dyndns.org for our domain.

This weekend I completely reinstalled the server so I could start DNS for the purpose of complying with best practices (everyone says OS X Server works best with DNS properly configured) and to enable portable home directories. The setup seems to be good in the sense that internally the FQDN of xserve.ourdomain.com resolves to the Xserve’s private IP (10.0.1.10) and vice versa. The test iMac is bound to the Xserve and the portable home directory on that machine seems to work well. The problem is that, while the iMac can browse the internet it cannot load our own website (www.ourdomain.com) or retrieve email (user@ourdomain.com), although the site remains accessible from outside our network.

I have no interest in running a full DNS server if I can avoid it. I would simply like to have internal requests for xserve.ourdomain.com to resolve to the Xserve, and to defer to our ISP’s nameservers for everything else (including http://www.ourdomain.com and user@ourdomain.com). From what I’ve read I’m guessing this has something to do with forwarding or caching, but I’m at a loss as to what specific changes I need to make.

Any help (and particularly anything that will spare me from having to read an entire book on BIND) would be most sincerely appreciated.

[Anonymous]

The reason that it is failing is that your server is authoritive for your domain and so does not look to your isp’s dns servers for resolution on your domain. (but does for other domains)

If your zone files do not have a record for http://www.yourdomain.com pointing to the correct place your clients will not be able to find it.
In my case I had the company web site hosted with the isp so had to put a record in pointing to the isp’s webserver external address

For your email you will need to put in an mx record pointing to your isp’s email server.

I hope this helps. Took me a lot of head scratching to start with, just keep going and testing results with the network utility.

James Turner

[cyburk]

James Turner wrote:

If your zone files do not have a record for http://www.yourdomain.com pointing to the correct place your clients will not be able to find it. In my case I had the company web site hosted with the isp so had to put a record in pointing to the isp’s webserver external address

For your email you will need to put in an mx record pointing to your isp’s email server.

James,

This does help a lot because it confirms the concept of what I figured to be the problem. I’m still at something of a loss, though, as to how to fix it. I’m guessing it has something to do with adding a couple of lines to either the “named.conf” file or a “resolv.conf” file, but beyond that I’m stuck. Would you or someone else be willing to do a little hand-holding on this point?

If it makes any difference, our domain and email addresses were all set up with Godaddy, but we’re using dyndns.org’s nameservers and we have an MX record set up there so email still works from Godaddy’s mailservers.

Thanks a bunch.

[Jimbo]

You need to add the records using the dns settings in Server Admin.
If you added the mx record to dyndns.org you can use the same info to add an mx record to your internal zone.

If you do not know what your dyndns info is you can check this out using http://www.dnsreport.com/ and entering your domain name.

This long winded report will give you what mx records are being used and also what www record is used.
With this info you can create the required records internally.

You don’t really need to get into the conf files manually but you can if your feeling brave. Remember that the Server admin dns setting may stop working if you manually change the files.

James

[cyburk]

Jimbo wrote:

You need to add the records using the dns settings in Server Admin.

Sheesh! Have I really been making it this hard? Before I haul off and get too excited, let me make sure I’ve got this straight:

In Server Admin I stop DNS. I click on the ZONES tab and double-click the name of my existing zone file to edit it. Then I click the MACHINES tab and add a new entry for a machine called “www” with the IP address of a dyndns.org nameserver. I also create a new machine called “mail” with an IP address of the Godaddy mailserver, and enable “This machine is a mail server for the zone.” I click SAVE and then start DNS again.

Can that really be all?

Unless I’m completely off-base with the above I guess my only other question is whether/how I can add additional IP addresses for the “www” and “mail” machines. (I have 5 separate nameservers for dyndns.org and 2 mailservers at Godaddy.)

Thanks again to everyone for being so patient and helpful. This whole site in general and these forums in particular are fantastic resources.

[Jimbo]

Just to clarify you are adding machines with the ip address of the www. record in the nameserver not the nameserver it’s self.
Which is not quite what I read below.

Then I click the MACHINES tab and add a new entry for a machine called “www” with the IP address of a dyndns.org nameserver

Another way to find this info is correct is to set a client with your isp’s dns servers in the network pref pane then use the network utility to dig on the http://www.yoursite.com and see what the answer is. This is also done easily via the terminal with the dig command if you want to look hard. 🙂

Happy Hunting

James

[cyburk]

Jimbo wrote:

Just to clarify you are adding machines with the ip address of the www. record in the nameserver not the nameserver it’s self.

Well, crud. This doesn’t give me joy. We have a dynamic IP address, so is the net effect of this that I’m going to have to manually update our www record in Server Admin everytime our WAN IP changes? Surely, if everyone else in the world can find us when our IP changes, there must be a way for our LAN machines to do it too…?

[Author]

Posts