Operations grimoire/DNS - Revision history

Yousra at 16:21, 23 February 2026

2026-02-23T16:21:48Z

← Older revision		Revision as of 16:21, 23 February 2026
Line 15:		Line 15:
	# Edit the relevant zone file in {{Ops file\|roles/dns/knot/files/zones/}}		# Edit the relevant zone file in {{Ops file\|roles/dns/knot/files/zones/}}
	# Deploy from Complector with <code>salt dns-001 state.apply roles/dns/knot/config</code>		# Deploy from Complector with <code>salt dns-001 state.apply roles/dns/knot/config</code>
	# Lint the zone on dns-001 with <code>~~zonecheck~~ /var/db/knot/nasqueron.org.zone</code>		# Lint the zone on dns-001 with <code>kzonecheck /var/db/knot/nasqueron.org.zone</code>
	# Reload Knot server with <code>service knot reload</code>		# Reload Knot server with <code>service knot reload</code>
	# Check new record with nslookup or dig against ns1.nasqueron.org		# Check new record with nslookup or dig against ns1.nasqueron.org

Dereckson: /* Notify is refused */

2025-10-20T20:38:13Z

Notify is refused

← Older revision		Revision as of 20:38, 20 October 2025
Line 84:		Line 84:
	Oct 18 22:34:21 dns-001 knot[20816]: warning: [nasqueron.org.] notify, outgoing, remote 216.218.130.2@53 TCP, server responded with error 'REFUSED'		Oct 18 22:34:21 dns-001 knot[20816]: warning: [nasqueron.org.] notify, outgoing, remote 216.218.130.2@53 TCP, server responded with error 'REFUSED'

	The task {{T\|~~2149~~}} has been created to track this issue.		The task {{T\|2148}} has been created to track this issue.

	== Useful links ==		== Useful links ==

	* [https://netbox.nasqueron.org/ipam/services/?filter=web-domains-cname CNAME for web domains] (NetBox)		* [https://netbox.nasqueron.org/ipam/services/?filter=web-domains-cname CNAME for web domains] (NetBox)

Dereckson: /* Troubleshoot */

2025-10-18T22:39:54Z

Troubleshoot

← Older revision		Revision as of 22:39, 18 October 2025
Line 78:		Line 78:
	-nasqueron.org. 86400 IN NS ns5.he.net.		-nasqueron.org. 86400 IN NS ns5.he.net.
	</syntaxhighlight>		</syntaxhighlight>

			==== Notify is refused ====
			A known issue with the current configuration is HE refuses DNS notify requests:

			Oct 18 22:34:21 dns-001 knot[20816]: warning: [nasqueron.org.] notify, outgoing, remote 216.218.130.2@53 TCP, server responded with error 'REFUSED'

			The task {{T\|2149}} has been created to track this issue.

	== Useful links ==		== Useful links ==

	* [https://netbox.nasqueron.org/ipam/services/?filter=web-domains-cname CNAME for web domains] (NetBox)		* [https://netbox.nasqueron.org/ipam/services/?filter=web-domains-cname CNAME for web domains] (NetBox)

Dereckson at 20:59, 18 October 2025

2025-10-18T20:59:12Z

← Older revision		Revision as of 20:59, 18 October 2025
Line 1:		Line 1:
	DNS is ~~currently not hosted directly~~ on Nasqueron:		DNS is provided both on Nasqueron and Hurricane Electric infrastructures.
	* for nasqueron.org, IPv6 blocks and ~~most domains, DNS is hosted by~~ Hurricane Electric ~~-> reach Dereckson for modifications~~
	* for eglide.~~org, it's managed by Gandi -> reach Sandlayth for modifications~~

	Knot DNS ~~is currently being installed in our servers by Dorian, to act~~ as primary server.		== Nasqueron primary DNS server ==
	~~Content of the zones will be stored in operation repository~~.		Knot serves our DNS records from dns-001 as ns1.nasqueron.org primary server.

	~~== DNS change workflow ==~~		Zone is then automatically submitted to Hurricane Electric as secondary servers.

	~~# If needed, open a task, or include to an existing task you need the DNS change~~		=== Scope ===
	~~# Reach DNS contact, ask them to comment back on the task when done~~		; ICANN Domains
			* nasqueron.org: {{Ops file\|roles/dns/knot/files/zones/nasqueron.org.zone}}

	=== ~~Tips~~ ===		=== Edit a zone ===
			To update records for our DNS:

	~~Web domains use CNAME, see [https:~~//~~netbox~~.nasqueron.org/~~ipam~~/~~services/?filter~~=~~web-domains-cname CNAME for web domains] (NetBox)~~ for ~~the full list~~.		# Edit the relevant zone file in {{Ops file\|roles/dns/knot/files/zones/}}
			# Deploy from Complector with <code>salt dns-001 state.apply roles/dns/knot/config</code>
			# Lint the zone on dns-001 with <code>zonecheck /var/db/knot/nasqueron.org.zone</code>
			# Reload Knot server with <code>service knot reload</code>
			# Check new record with nslookup or dig against ns1.nasqueron.org
			# Check a little later against ns2.he.net

			== Hurricane Electric as primary DNS servers ==
			Some DNS zones aren't currently hosted directly on Nasqueron.

			In such case, open a task on DevCentral or reach Dorian or Dereckson for modifications.

	== ~~Proposals to host DNS at Nasqueron~~ ==		=== Scope ===
			* IPv6 blocks (nasqueron account)
			* Most extra domains (dereckson account)

	~~Network:~~		== Special cases ==
	* 172.27.27.2/28 is ~~reserved for a primary DNS server~~ -> ~~we'd also need an IPv4~~		=== Eglide ===
	* Secondary can be hosted in another datacenter, or to an external provider with zone replication (HE?)		The eglide org domain is managed by Gandi -> reach Sandlayth for modifications

	~~How we want to work:~~		== Tips ==
	* Git repository with the direct configuration files or YAML template to generate it
	* Web visualisation of the current zone
	* DNSSEC

	~~Products comments~~:		Web domains use CNAME, see [https://netbox.nasqueron.org/ipam/services/?filter=web-domains-cname CNAME for web domains] (NetBox) for the full list.
	* We liked in the past:
	** djbdns isn't maintained anymore (fork dnbns neither)
	** Unbound, but it's not an authoritative server
	* The decision is to be analyzed amongst
	** BIND - ~~de facto standard~~
	** CoreDNS - ~~a newcomer~~ for ~~Kubernetes - is it suitable for non-Docker workload too? If not, we could use CoreDNS with Kubernetes subdomains, and another product~~ for ~~other records.~~
	** Knot DNS - maintained actively by CZ.NIC, the .~~CZ domain registry, oriented security (DNSSEC), registries are first stakeholders, but with features like DynDNS support, it's a full authoritative server~~
	** PowerDNS - used by various ISP

	== Troubleshoot ==		== Troubleshoot ==

Dereckson: /* kzonecheck: error: failed to run semantic checks */

2025-09-22T20:02:56Z

kzonecheck: error: failed to run semantic checks

← Older revision		Revision as of 20:02, 22 September 2025
Line 44:		Line 44:

	If you run it directly in /usr/local/etc/knot against a .zone file, there is a syntax error.		If you run it directly in /usr/local/etc/knot against a .zone file, there is a syntax error.
	Check there is no jinja like <code>{{ identity }}</code> in it, if so perhaps it has been copied instead of deployed through Salt.		Check there is no jinja like <code><nowiki>{{ identity }}</nowiki></code> in it, if so perhaps it has been copied instead of deployed through Salt.

	==== kzonecheck: 1 missing SOA at the zone apex ====		==== kzonecheck: 1 missing SOA at the zone apex ====

Dereckson: Documentation to troubleshoot Knot DNS

2025-09-18T16:58:30Z

Documentation to troubleshoot Knot DNS

@@ Line 3: / Line 3: @@
 * for eglide.org, it's managed by Gandi -> reach Sandlayth for modifications
-KnotDNS is currently being installed in our servers by Dorian, to act as primary server.
+Knot DNS is currently being installed in our servers by Dorian, to act as primary server.
 Content of the zones will be stored in operation repository.
@@ Line 35: / Line 35: @@
 ** Knot DNS - maintained actively by CZ.NIC, the .CZ domain registry, oriented security (DNSSEC), registries are first stakeholders, but with features like DynDNS support, it's a full authoritative server
 ** PowerDNS - used by various ISP
 == Useful links ==
 * [https://netbox.nasqueron.org/ipam/services/?filter=web-domains-cname CNAME for web domains] (NetBox)

Dereckson at 23:15, 12 September 2025

2025-09-12T23:15:37Z

← Older revision		Revision as of 23:15, 12 September 2025
Line 2:		Line 2:
	* for nasqueron.org, IPv6 blocks and most domains, DNS is hosted by Hurricane Electric -> reach Dereckson for modifications		* for nasqueron.org, IPv6 blocks and most domains, DNS is hosted by Hurricane Electric -> reach Dereckson for modifications
	* for eglide.org, it's managed by Gandi -> reach Sandlayth for modifications		* for eglide.org, it's managed by Gandi -> reach Sandlayth for modifications

			KnotDNS is currently being installed in our servers by Dorian, to act as primary server.
			Content of the zones will be stored in operation repository.

	== DNS change workflow ==		== DNS change workflow ==

Dereckson: /* DNS change workflow */

2023-05-23T09:28:08Z

DNS change workflow

← Older revision		Revision as of 09:28, 23 May 2023
Line 7:		Line 7:
	# If needed, open a task, or include to an existing task you need the DNS change		# If needed, open a task, or include to an existing task you need the DNS change
	# Reach DNS contact, ask them to comment back on the task when done		# Reach DNS contact, ask them to comment back on the task when done

			=== Tips ===

			Web domains use CNAME, see [https://netbox.nasqueron.org/ipam/services/?filter=web-domains-cname CNAME for web domains] (NetBox) for the full list.

	== Proposals to host DNS at Nasqueron ==		== Proposals to host DNS at Nasqueron ==

Dereckson: Created page with "DNS is currently not hosted directly on Nasqueron: * for nasqueron.org, IPv6 blocks and most domains, DNS is hosted by Hurricane Electric -> reach Dereckson for modifications * for eglide.org, it's managed by Gandi -> reach Sandlayth for modifications == DNS change workflow == # If needed, open a task, or include to an existing task you need the DNS change # Reach DNS contact, ask them to comment back on the task when done == Proposals to host DNS at Nasqueron == Net..."

2023-05-23T09:27:30Z

Created page with "DNS is currently not hosted directly on Nasqueron: * for nasqueron.org, IPv6 blocks and most domains, DNS is hosted by Hurricane Electric -> reach Dereckson for modifications * for eglide.org, it's managed by Gandi -> reach Sandlayth for modifications == DNS change workflow == # If needed, open a task, or include to an existing task you need the DNS change # Reach DNS contact, ask them to comment back on the task when done == Proposals to host DNS at Nasqueron == Net..."

New page

DNS is currently not hosted directly on Nasqueron:
* for nasqueron.org, IPv6 blocks and most domains, DNS is hosted by Hurricane Electric -> reach Dereckson for modifications
* for eglide.org, it's managed by Gandi -> reach Sandlayth for modifications

== DNS change workflow ==

# If needed, open a task, or include to an existing task you need the DNS change
# Reach DNS contact, ask them to comment back on the task when done

== Proposals to host DNS at Nasqueron ==

Network:
* 172.27.27.2/28 is reserved for a primary DNS server -> we'd also need an IPv4
* Secondary can be hosted in another datacenter, or to an external provider with zone replication (HE?)

How we want to work:
* Git repository with the direct configuration files or YAML template to generate it
* Web visualisation of the current zone
* DNSSEC

Products comments:
* We liked in the past:
** djbdns isn't maintained anymore (fork dnbns neither)
** Unbound, but it's not an authoritative server
* The decision is to be analyzed amongst
** BIND - de facto standard
** CoreDNS - a newcomer for Kubernetes - is it suitable for non-Docker workload too? If not, we could use CoreDNS with Kubernetes subdomains, and another product for other records.
** Knot DNS - maintained actively by CZ.NIC, the .CZ domain registry, oriented security (DNSSEC), registries are first stakeholders, but with features like DynDNS support, it's a full authoritative server
** PowerDNS - used by various ISP

== Useful links ==

* [https://netbox.nasqueron.org/ipam/services/?filter=web-domains-cname CNAME for web domains] (NetBox)