Changing DNS Servers

[Ed Hon]

I've been using a DNS server outside our firewall at address 130.110... Now I want to use a DNS server on a Windoze machine inside the fire wall at address 10.64... Using SAM I added the address as first Name Resolver, but when I tried an nslookup, after a long wait it gave me:

# nslookup xyz.us.abc.com

*** Can't find server name for address 10.64...: Server failed
Using /etc/hosts on: hpysm

looking up FILES
Trying DNS
Name: xyz.us.abc.com


Why can't I get 10.64... to work?

[john kingsley]

Look at your /etc/resolv.conf file.
It should contain the following lines:

domain
nameserver 10.64...
nameserver

Make sure both nameservers are valid, and be sure to use IP addresses.

Is "us.abc.com" your clients domain name? Check with your windows admin to make sure the DNS server is configured to resolve hosts outside of your domain.

[Sundar_7]

Start with ping.

# ping 10.64.xxx.xxx

and then telnet to port 53

# telnet 10.64.xxx.xxx 53

Try from a machine that can reach the DNS server without using the firewall.

Since the DNS server is inside the firewall, check with your firewall admin if the port 53 UDP/TCP is resticted to only some clients

[Ed Hon]

us.abb.com is in the client's domain. The 10.64... address is reachable by ping and telnet port 53. /etc/resolv.conf looks good. I wonder - does the IP address of the DNS server itself have to be in the name resolution table?

[Thomas Bianco]

reguarding the DNS server name in the hosts file, it doesn't need to be, but it's a good idea.

check your nssswitch.conf and make sure the hosts line looks something like this

hosts: DNS [not found=continue error=continue] FILES

could someone check the syntax of that, it's been a while. i'm certain of the content, just not the puncuation.

[Jeff_Traigle · Accepted solution]

Judging from the output, I would say the DNS service isn't running on the Windows box (or at least not functioning properly... hard to believe on a Windows system, I know :). The resolver is trying to talk to it first (after it looks in /etc/hosts) and is timing out trying to communicate with the server. That's why you're getting the delay in response. Since you still have the original DNS server defined as the secondary DNS server to use, it's still resolving once the resolver moves on and attempts the resolution through it.

It also looks like you have an nsswitch.conf file configured to look in files first since DNS is the first method by default. Make sure the hosts entry in the looks like the following so binaries compiled with the 10.X libraries resolve the same way as 11.X binaries:

hosts: files [SUCCESS=return NOTFOUND=continue TRYAGAIN=continue UNAVAIL=continue] dns

I'm guessing you're not using NIS since that would typically be between files and dns in the resolution order.

[Ed Hon]

Everything on the HP side looks good. I think it's an issue with the Windows DNS server. We've worked around the problem by finding another DNS server outside the firewall. I think I recall something about Windows clients working ok with a Windows DNS server, but not when a Unix computer tries to access it.

[Thomas Bianco]

be aware it can be done. I am, quite successfully, using a windows DNS server (in fact, an AD intergrated DNS server) to serve both HPUX and Windows clients. it's in the default configuration, nothing specail.