Re: dnsmasq and SOA

[Jacques Rodary <rodaryj@free.fr>]

On 09/03/2018 08:32, Reco wrote:
> 	Hi.
>
> On Fri, Mar 09, 2018 at 03:34:27AM +0100, Jacques Rodary wrote:
>
> > ;; AUTHORITY SECTION:
> > rodary.net.             600     IN      NS      .
> > rodary.net.             600     IN      NS      ns6.gandi.net.
Here is my new dnsmasq.conf:
    no-dhcp-interface=enp2s0
    auth-server=ns.rodary.net,88.170.1.143
    auth-zone=rodary.net
    auth-soa=2018022800,root.ns.rodary.net,10800,3600,10800
    auth-sec-servers=ns6.gandi.net
    dhcp-range=10.42.0.20,10.42.0.200,infinite
I added the auth-server line, and "dig in soa rodary.net" gives:
    ;; ANSWER SECTION:
    rodary.net.             600     IN      SOA     ns.rodary.net. 
root.ns.rodary.net. 2018022801 10800 3600             10800 600
    ;; AUTHORITY SECTION:
    rodary.net.             600     IN      NS      ns.rodary.net.
    rodary.net.             600     IN      NS      ns6.gandi.net.
    ;; Query time: 0 msec
    ;; SERVER: 88.170.1.143#53(88.170.1.143)
which means ns.rodary.net is SOA of my zone and ns6.gandi.net is slave 
server. Without master server the root zone "." servers were 
authoritative for my zone (as they are for all zones).
> > Hate to break it to you, but it seems to fail for everyone else.
> > Today "dig in soa rodary.net" gives me SERVFAIL.
Tell me please if it works now.
> > and even if I don't quite understand why "." (the root) is my secondary
> > server, I suppose it means  I succeeded to have my host as a stealth server!
> I believe that it means that somehow you're announcing authority on root
> domain. I would advise against it.
No, root servers announced authority on rodary.net, since nobody else 
delegated this authority.
> > I don't understand quite well how NetworkManager works.
> I don't understand it either, but frankly I don't need to. IP adresses,
> routing table and packet flow are the state of the kernel. Using
> always-running userland tool for their configuration *may* be
> appropriate in certain cases (DHCP, anyone?), but for your typical
> server environment such cases do not apply.
> That said, for your typical server environment nothing beats ifupdown.
> So my advice is - if you need a predictable behaviour - you exterminate
> NetworkManager, connman and other fancy toys, and stick to the ifupdown,
> or maybe systemd-networkd.
I may do that soon. Thanks for your precious help.
    Jacques