Question about DNS / bind9 / authoritative and NXDOMAIN vs NOERROR (NODATA)

[Greg Choules]

Hi Michel.
You will get an authoritative answer (AA bit = 1) if the server is either
primary (master) or secondary (slave) for the QNAME (query name); in this
case "reseau1.lan". From the config snip you provided this is because you
have the config:

zone "reseau1.lan" {
   type master;
...
};

If you make a query for "xxx.reseau1.lan" to this server, the response you
get back will depend on whether you have anything in the zone file
("db.reseau1.lan")
that would match that QNAME. If you do not have "xxx" or "*" (wildcard)
then there will be no match and the response will be (authoritative)
NXDOMAIN - this name does not exist at all.
Personally I would not use a wildcard because it gives the impression that
any name exists when really it doesn't.

NOTE that the existence of "reseau1.lan" means that ALL names beneath this
point will be swallowed by the server, e.g. "a.b.c.d.e.f.reseau1.lan" will
all return NXDOMAIN +AA=1

What behaviour do you think you would like to see?

Looking at another part of your config, you should not need this at all:

options {
   forwarders {8.8.8.8;};
...
};

If your server can reach the Internet it can recurse all on its own.

I hope that helps.
Greg

On Wed, 13 Dec 2023 at 16:29, Michel Diemer via bind-users <
bind-users at lists.isc.org> wrote:

>
> ‌
> Dear Bind user,
>
> I am a teacher and trying to understand how dns works. I am spending hours
> reading various sources without finding satisfying information. For
> teaching purposes I have created a virtual machine with isc dhcp server and
> bind9 and another virtual machine that uses the first one as ics dhcp and
> dns server.
>
> I have disabled IPv6 by setting link-local: [] in netplan's setting.
>
> The name of the network (dns zone) is "reseau1.lan". When I "dig -4
> reseau1.lan" the AUTHORITY bit is set to 1.
>
> Why or when should the AUTHORITY bit set to 1 ? What does it take for
> nslookup to give me an authoritative answer ?
>
> If I "ping xxx.reseau1.lan" I get an NXDOMAIN answer. Why NXDOMAIN and not
> NOERROR (NODATA) ? The domain "reseau1.lan" exists and my dns server is
> authoritative for this zone (SOA record) but the computer "xxx" on this
> domain does not. Should I use a wildcard dns record ?
>
> I have tryed to empty the list of forwarders and disable the dns cache ...
> should I configure a dns-resolver only for the domain reseau1.lan and then
> a dns forwared for external dns queries ? Or maybe configure the resolver
> for the lan network interface and the forwarder on the internet network
> interface on the dns server ?
>
> I managed to get "AUTHORITY: 1" when typing "dig -4 soa reseau1.lan" by
> disabling the forwarders and the cache so I guess I should configure bind
> per network interface. But when typing "dig -4 pc1.reseau1.lan" the
> AUTHORITY bit is always set to 0.
>
>
> ͏‌
>
>
>
> ͏‌
>
>
> Kind Regards,
>
> Michel Diemer
> --
> Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe
> from this list
>
> ISC funds the development of this software with paid support
> subscriptions. Contact us at https://www.isc.org/contact/ for more
> information.
>
>
> bind-users mailing list
> bind-users at lists.isc.org
> https://lists.isc.org/mailman/listinfo/bind-users
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20231213/02035b29/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 3944472000000002embeddedImage
Type: image/png
Size: 19746 bytes
Desc: not available
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20231213/02035b29/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 4119250999999996embeddedImage
Type: image/png
Size: 14489 bytes
Desc: not available
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20231213/02035b29/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 4303235embeddedImage
Type: image/png
Size: 44718 bytes
Desc: not available
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20231213/02035b29/attachment-0005.png>