Authoritative master only replies to SOA, how to debug/fix?

[kde99]

Hello everyone!

I am running 2 DNS servers that are separated by location. The obvious way was to set them up as master/slave with AXFR between them. Both are running powerdns 4.9.2 on Ubuntu 22.04. It goes something like this:

• ns.something.com is the primary one, and we have all the domains here set to type=MASTER in the database
• ns2.something.com is the secondary
• both are added to the NS record of all the domains so that's not an issue
• ns.something.com and ns2.something.com resolves to the good IP of the servers

What happens is if I do a dig ourdomain.com @ns.something.com it only says ;; communications error to IP#53: timed out, which is not ideal. When I do the same with ns2 it replies with the correct information.

What's more so interesting is if I query the SOA record by hand dig SOA ourdomain.com @ns.something.com I do get the correct SOA back, just not any of the other records. ns2 replies to all queries perfectly.

Now you'd wonder if there are issues with AXFR, nope, AXFR works perfectly fine. If I update the zones on ns.something.com it send it over to ns2.something.com.

In trying to figure out what is happening I have set loglevel=9 on ns.something.com, but there are 0, none, null, logs about the requests, it only seems to log the successful ones even with max logging, which sucks. I have even turned on query-logging which also prints no logs for the failed requests, as if PowerDNS silently discards them for some reason.

Is discarding ALL requests on PRIMARY an intended mode of operation? If so why isn't it in the documentation? If not then how do I debug this issue?

[rgacogne]

Is discarding ALL requests on PRIMARY an intended mode of operation? If so why isn't it in the documentation? If not then how do I debug this issue?

No, something else is happening. You might want to try using strace to first confirm that the queries are actually received by the authoritative server process.

[kde99]

That strace tip was lifesaver. The packets do make it over but are thrown out, so far seems to be

1. got itself firewalled by fail2ban (fixed it)
2. the dnsdist in front of it is not working properly, the backend pdns is set up with proxy (to log ips), but dnsdist is not sending correct headers, or for that matter probably is badly configured all together, as it doesn't even work when I turned proxying off... I will have to fix that

Thanks for your help!