How to enable nameserver recursion?

Question

On Ubuntu 14.04, when I'm performing a

dig google.de

on my machine, I get a REFUSED status (reducing to relevant lines):

me@machine:~# dig google.de
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 26926
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

My /etc/resolv.conf knows three nameservers:

nameserver 1.2.3.4
nameserver 1.2.3.5
nameserver 8.8.8.8

where the first two are corporate owned nameservers. But at least the last one (8.8.8.8) shouldn't return a refused status. So how can I enable recursion so that the last nameserver is considered?

There is no `named.conf` on that machine; `find / -name "named.conf"` returns nothing... — Gottlieb Notschnabel, Aug 05 '15 at 06:42

neuron · Accepted Answer · 2015-08-05T08:46:42.813

10

The DNS resolver will only move onto the other name servers if the first one returns an error (i.e SERVFAIL) or can't be reached. If the DNS server returns NXDOMAIN then the resolver considers that the proper answer and won't check the others. NXDOMAIN is considered a final definitive answer that the requested domain does not exist.

In your case the first namserver is reached and is denying you.

In that namserver's named.conf you should have something like allow-query { any; };

Or

One solution might be to temporarily change the order of the nameservers in /etc/resolv.conf & put 8.8.8.8 first

Or

Just to direct dig to use 8.8.8.8 as the DNS server at command line you can do :

dig @8.8.8.8 google.de

edited Aug 05 '15 at 08:46

answered Aug 05 '15 at 06:52

neuron

1,941
11
20

Thank you! Do I have to restart something after modifying `resolv.conf` (and if yes: how)? – Gottlieb Notschnabel Aug 05 '15 at 06:57
No, that's not necessary. It will be picked up immediately. – Wouter Verhelst Aug 05 '15 at 06:59
Funnily I still get the same behaviour. And although `8.8.8.8` is the first nameserver now, `dig` still returns `;; SERVER: 1.2.3.4#53(1.2.3.4)`... – Gottlieb Notschnabel Aug 05 '15 at 07:38
1

@Neuron, you can specify a server for lookup in the dig command avoiding modifying files: `dig @8.8.8.8 google.de` – YoMismo Aug 05 '15 at 08:21
@YoMismo: Agree, edited my post to include your suggestion – neuron Aug 05 '15 at 08:47

How to enable nameserver recursion?

1 Answers1

Or

Or