<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns:mv="http://macVmlSchemaUri" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Title" content="">
<meta name="Keywords" content="">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:Calibri;
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:Calibri;
color:windowtext;}
span.msoIns
{mso-style-type:export-only;
mso-style-name:"";
text-decoration:underline;
color:teal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body bgcolor="white" lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">Solution found (or, if not, a workaround):<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">IPA replicas must be named in the root domain/zone and not in a subdomain, else DNS fails to serve records in the root domain. Once we changed our configuration to reflect this, DNS returned
to normal.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">—Dan<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal" style="text-autospace:none"><a href="http://www.high5games.com/"><span style="font-size:18.0pt;text-decoration:none"><img border="0" width="220" height="50" id="_x0000_i1026" src="cid:image001.jpg@01D1CB9B.D6819140"></span></a><span style="font-size:15.0pt;font-family:Calibri"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><b><span style="font-family:Calibri">Daniel Alex Finkelstein</span></b><span style="font-family:Calibri">| Lead Dev Ops Engineer<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><u><span style="font-family:Calibri;color:blue"><a href="mailto:Dan.Finkelstein@h5g.com">Dan.Finkelstein@h5g.com</a></span></u><span style="font-family:Calibri"> | 212.604.3447</span><span style="font-size:15.0pt;font-family:Calibri"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Calibri">One World Trade Center, New York, NY 10007<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Calibri"><a href="http://www.high5games.com/">www.high5games.com</a><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Calibri">Play
<a href="https://apps.facebook.com/highfivecasino/">High 5 Casino</a> and <a href="https://apps.facebook.com/shakethesky/">
Shake the Sky</a><o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Calibri">Follow us on: <a href="http://www.facebook.com/high5games">Facebook</a>, <a href="https://twitter.com/High5Games">Twitter</a>, <a href="http://www.youtube.com/High5Games">YouTube</a>, <a href="http://www.linkedin.com/company/1072533?trk=tyah">Linkedin</a><o:p></o:p></span></p>
<p class="MsoNormal"><i><span style="font-size:10.0pt;font-family:Calibri"><o:p> </o:p></span></i></p>
</div>
<p class="MsoNormal"><i><span style="font-size:10.0pt;font-family:Calibri">This message and any attachments may contain confidential or privileged information and are only for the use of the intended recipient of this message. If you are not the intended recipient,
please notify the sender by return email, and delete or destroy this and all copies of this message and all attachments. Any unauthorized disclosure, use, distribution, or reproduction of this message or any attachments is prohibited and may be unlawful.</span></i><span style="font-size:11.0pt;font-family:Calibri"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-family:Calibri;color:black">From: </span>
</b><span style="font-family:Calibri;color:black"><freeipa-users-bounces@redhat.com> on behalf of Daniel Finkestein <Dan.Finkelstein@high5games.com><br>
<b>Date: </b>Tuesday, June 21, 2016 at 07:21<br>
<b>To: </b>"freeipa-users@redhat.com" <freeipa-users@redhat.com><br>
<b>Subject: </b>Re: [Freeipa-users] CentOS 7 & FreeIPA 4.2: DNS resolution at the top-level domain/zone<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">Hi Petr,</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">Top level means the root zone of the various DNS trees we serve. For example, h5g.com would be the root and dev.h5g.com, test.h5g.com, etc., would be the subdomains. Our subdomains query
fine, but any hosts in the root domain no longer resolve.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">An example of an unresolvable name is IPA itself: ipa.h5g.com. Here's output from dig:</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:Calibri">root@ipa ~]# dig ipa.h5g.com</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:Calibri"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:Calibri">; <<>> DiG 9.9.4-RedHat-9.9.4-29.el7_2.3 <<>> ipa.h5g.com</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:Calibri">;; global options: +cmd</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:Calibri">;; Got answer:</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:Calibri">;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 52405</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:Calibri">;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:Calibri"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:Calibri">;; OPT PSEUDOSECTION:</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:Calibri">; EDNS: version: 0, flags:; udp: 4096</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:Calibri">;; QUESTION SECTION:</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:Calibri">;ipa.h5g.com. IN A</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:Calibri"> </span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:Calibri">;; Query time: 0 msec</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:Calibri">;; SERVER: 10.55.10.31#53(10.55.10.31)</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:Calibri">;; WHEN: Tue Jun 21 07:15:14 EDT 2016</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:Calibri">;; MSG SIZE rcvd: 42</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">We expect that its IP address returns from dig, but it doesn't.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">We have 100 zones defined, including forward and reverse zones — all active.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">We do use DNS forwarding, but in a very unsophisticated way: we set up the forwarders to go to Google if our DNS can't resolve a name.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">Thanks and regards,</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri">Dan</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"> </span><o:p></o:p></p>
<div>
<p class="MsoNormal" style="text-autospace:none"><a href="http://www.high5games.com/"><span style="font-size:18.0pt;text-decoration:none"><img border="0" width="220" height="50" id="_x0000_i1025" src="cid:image002.jpg@01D1CB9B.D6819140"></span></a><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><b><span style="font-family:Calibri">Daniel Alex Finkelstein</span></b><span style="font-family:Calibri">| Lead Dev Ops Engineer</span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><u><span style="font-family:Calibri;color:blue"><a href="mailto:Dan.Finkelstein@h5g.com">Dan.Finkelstein@h5g.com</a></span></u><span style="font-family:Calibri"> | 212.604.3447</span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Calibri">One World Trade Center, New York, NY 10007</span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Calibri"><a href="http://www.high5games.com/">www.high5games.com</a></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Calibri">Play
<a href="https://apps.facebook.com/highfivecasino/">High 5 Casino</a> and <a href="https://apps.facebook.com/shakethesky/">
Shake the Sky</a></span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:10.0pt;font-family:Calibri">Follow us on: <a href="http://www.facebook.com/high5games">Facebook</a>, <a href="https://twitter.com/High5Games">Twitter</a>, <a href="http://www.youtube.com/High5Games">YouTube</a>, <a href="http://www.linkedin.com/company/1072533?trk=tyah">Linkedin</a></span><o:p></o:p></p>
<p class="MsoNormal"><i><span style="font-size:10.0pt;font-family:Calibri"> </span></i><o:p></o:p></p>
</div>
<p class="MsoNormal"><i><span style="font-size:10.0pt;font-family:Calibri">This message and any attachments may contain confidential or privileged information and are only for the use of the intended recipient of this message. If you are not the intended recipient,
please notify the sender by return email, and delete or destroy this and all copies of this message and all attachments. Any unauthorized disclosure, use, distribution, or reproduction of this message or any attachments is prohibited and may be unlawful.</span></i><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:Calibri"> </span><o:p></o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-family:Calibri;color:black">From: </span>
</b><span style="font-family:Calibri;color:black"><freeipa-users-bounces@redhat.com> on behalf of Petr Spacek <pspacek@redhat.com><br>
<b>Organization: </b>Red Hat<br>
<b>Date: </b>Tuesday, June 21, 2016 at 06:04<br>
<b>To: </b>"freeipa-users@redhat.com" <freeipa-users@redhat.com><br>
<b>Subject: </b>Re: [Freeipa-users] CentOS 7 & FreeIPA 4.2: DNS resolution at the top-level domain/zone</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal">On 21.6.2016 11:23, <a href="mailto:Dan.Finkelstein@high5games.com">
Dan.Finkelstein@high5games.com</a> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #B5C4DF 4.5pt;padding:0in 0in 0in 4.0pt;margin-left:3.75pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt" id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE">
<div>
<p class="MsoNormal">We've recently set up a "clean" install of FreeIPA replete with replicas, but we just noticed an odd behavior in the DNS service: hosts in the top level domain (like ipa.example.com) do not resolve, whereas hosts in subdomains (like ipa.dev.example.com)
do. I'm not sure what to look for in the various log files but I don't see any obvious errors. I thought perhaps this might have some guidance
<a href="https://www.redhat.com/archives/freeipa-users/2015-July/msg00102.html">https://www.redhat.com/archives/freeipa-users/2015-July/msg00102.html</a>, and maybe it does, but I'm not sure how to rescue my top-level domain names.<o:p></o:p></p>
</div>
</blockquote>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Hi,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">we can certainly debug this but first of all, please clarify what 'top-level'<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">means.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">If you really want help please do not obfuscate any DNS names. It often hides<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">real problems while not improving security in any way. (BTW you do not need to<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">hide domain names like 'NY5-EXMB1.High5.local' because these already leaked<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">through e-mail headers :-)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">So, here are the important questions:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">0) What name is unresolvable?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">$ dig the.problematic.name.example.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">1) What is the expected result from "dig"?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">2) What DNS zones are configured in IPA?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">$ ipa dnszone-find<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">3) Do you use DNS forwarding? (--forwarders option during IPA install or<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">commands ipa dnsforwardzone-*, ipa dnsconfig-mod etc.)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">-- <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Petr^2 Spacek<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">-- <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Manage your subscription for the Freeipa-users mailing list:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Go to <a href="http://freeipa.org">http://freeipa.org</a> for more info on the project<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>