Introducing SOC Insights for BloxOne Threat Defense: Boost your SOC efficiency with AI-driven insights to eliminate manual work and accelerate investigation and response times. Read the blog announcement here.

NIOS DNS DHCP IPAM

Reply

servfail forwarding .local queries

Techie
Posts: 3
1172     0

Recently had an issue when setting up a conditional forwarder zone from NIOS (8.6.2) DNS appliance, forwarding to a Microsoft DNS server.

 

One forwarder zone would not resolve (others worked fine) - and the problem zone was a '.local' zone.

 

Queries to the NIOS DNS server returned a servfail, with dig includeing a message about "local is reserved for multicast dns".

In the NIOS syslog, it had error messages like: insecurity proof failed resolving local

 

This last error message led me to DNSSEC validation, and turning validation OFF in the NIOS DNS configuration "fixed the issue" - queries now resolved!

 

Is this really the fix or workaround for forwarding .local queries? Anything else worth trying?

 

In general, I know .local should not be used in this instance, and for sure it's not a good idea to create an AD domain as  .local. But, I can't go back 10 years or so and get the AD guys to change it. Or suggest the proper fix is to migrate AD away from .local now. Smiley Wink

 

Thanks!

-Kier.

Re: servfail forwarding .local queries

Techie
Posts: 3
1173     0

Negative Trust Anchor is the way to 'fix' this, without having to disable DNSSEC validation totally.

 

Added the abc.local zone name as a NTA and all is still working. Smiley Happy

-Kier.

Re: servfail forwarding .local queries

New Member
Posts: 1
1173     0

Alternatively, disable validation for the zone permanently (since NTAs expire automatically) by adding the abc.local zone name to a validate-except clause in your server's options settings:

 

options {

   ...

        validate-except { abc.local; };

   ...

};

Showing results for 
Search instead for 
Did you mean: 

Recommended for You