User profile for user: jimfromma
jimfromma Author
User level: Level 1
4 points

dns server hangs on lookup

We recently set up a new file server using a MacMini and Lion Server. After pain staking research to rectify a permissions issue, we are now having problems with the DNS server portion of the software. We upgraded from an old XServer running 10.4 that was set up as the DNS for our intranet. We changed the old server name and IP so as to be able to mimic all of the IP's and server name on the new one. Once we unplug the old server from the network, our ability to use the internet or email is radically deminished. When I plug the old server back into the network, everything works great. Any ideas?

Mac mini, Mac OS X (10.7.2)

Posted on Feb 2, 2012 6:11 AM

Reply
13 replies
User profile for user: Camelot
Camelot
User level: Level 9
58,329 points

Feb 2, 2012 10:07 AM in response to jimfromma

That's impossible to answer without more information about the server setup, or at least an idea of the symptoms (e.g. what does dig or nslookup return when you try?)


I'm guessing this is just a configuration issue. By default the DNS server is only configured to respond to zones that it's responsible for (e.g. it won't resolve other domains). You need to enable recursion or forwarding for your clients in order for the server to do this. You don't state whether you've done that or not.

Reply
User profile for user: jimfromma
jimfromma Author
User level: Level 1
4 points

Feb 2, 2012 11:33 AM in response to Camelot

Let's just say I'm not an IT expert, just a button pusher. I wasn't here when the 10.4 XServe was set up, but it seems as though it was configured to be the Intranet DNS. So, when we set up the Lion Server we attempted to mirror all of the settings used on the 10.4 box.


I just try'd the "dig" on both machines and get the exact same results on both machines.


The problem is that I can't unplug the old server from the network or it takes a gadzillion years to lookup an address when online, and our mail programs barely load messages.


It seems sparatic, as 1 session online the sites will pop up at normal speed, then the lookup will take a minute or more.


The one thing I do know is that the "Recursive" option is not readily available in 10.7 as it was in 10.4. Is there a secret to allowing recursive in 10.7?

Reply
User profile for user: Camelot
Camelot
User level: Level 9
58,329 points

Feb 2, 2012 2:02 PM in response to jimfromma

I just try'd the "dig" on both machines and get the exact same results on both machines.


which was...? Knowing the specific messages returned from dig will be useful.


The problem is that I can't unplug the old server from the network or it takes a gadzillion years to lookup an address when online, and our mail programs barely load messages.


You shouldn't need to unplug and swap this live. There are at least two better ways of doing this.


One is to install and configure the server at a different IP address and make sure it works there (including configuring a single client on the LAN to use this server for lookups), then swap servers once you're sure.

Another option is to configure the server at a new address and migrate services to it. If your LAN systems are all using DHCP then it's a simple matter to change the DHCP server settings and wait for the new settings to propogate.

The one thing I do know is that the "Recursive" option is not readily available in 10.7 as it was in 10.4. Is there a secret to allowing recursive in 10.7?

Really? It looks the same to me.


Server Admin -> (server) -> DNS -> Settings -> Accept recursive queries from the following networks:


Add your local subnet to this list and the server will recursively answer lookups for your LAN clients.

Reply
User profile for user: jimfromma
jimfromma Author
User level: Level 1
4 points

Feb 3, 2012 9:48 AM in response to Camelot

Below are the results from using the scutil --dns. Note the difference in information given. Is there an option I need to add in 10.7 that wasn't necessary in 10.4? Unix is unix is it not?


Just to be clear, I don't believe I need to set this up as a standalone DNS server, just using it to point to the ISP's name server. (I believe)


Lion Server


server:etc lionserver$ scutil --dns

DNS configuration


resolver #1

nameserver[0] : 192.9.200.4


resolver #2

domain : local

options : mdns

timeout : 5

order : 300000


resolver #3

domain : 254.169.in-addr.arpa

options : mdns

timeout : 5

order : 300200


resolver #4

domain : 8.e.f.ip6.arpa

options : mdns

timeout : 5

order : 300400


resolver #5

domain : 9.e.f.ip6.arpa

options : mdns

timeout : 5

order : 300600


resolver #6

domain : a.e.f.ip6.arpa

options : mdns

timeout : 5

order : 300800


resolver #7

domain : b.e.f.ip6.arpa

options : mdns

timeout : 5

order : 301000


DNS configuration (for scoped queries)


resolver #1

nameserver[0] : 192.9.200.4

if_index : 4 (en0)

flags : Scoped

server:etc lionserver$


Old Server DNS

server:~ admin$ scutil --dns

DNS configuration


resolver #1

nameserver[0] : 192.9.200.4

order : 200000


resolver #2

domain : local

nameserver[0] : 224.0.0.251

nameserver[1] : ff02::fb

options : attempts:4

port : 5353

timeout : 2

order : 300000


resolver #3

domain : 254.169.in-addr.arpa

nameserver[0] : 224.0.0.251

nameserver[1] : ff02::fb

options : attempts:4

port : 5353

timeout : 2

order : 300001


resolver #4

domain : 0.8.e.f.ip6.arpa

nameserver[0] : 224.0.0.251

nameserver[1] : ff02::fb

options : attempts:4

port : 5353

timeout : 2

order : 300002

server:~ admin$


dig results


; <<>> DiG 9.7.3-P3 <<>>

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34346

;; flags: qr rd ra; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 14


;; QUESTION SECTION:

;. IN NS


;; ANSWER SECTION:

. 515255 IN NS k.root-servers.net.

. 515255 IN NS m.root-servers.net.

. 515255 IN NS j.root-servers.net.

. 515255 IN NS d.root-servers.net.

. 515255 IN NS e.root-servers.net.

. 515255 IN NS b.root-servers.net.

. 515255 IN NS h.root-servers.net.

. 515255 IN NS l.root-servers.net.

. 515255 IN NS a.root-servers.net.

. 515255 IN NS f.root-servers.net.

. 515255 IN NS i.root-servers.net.

. 515255 IN NS c.root-servers.net.

. 515255 IN NS g.root-servers.net.


;; ADDITIONAL SECTION:

a.root-servers.net. 601655 IN A 198.41.0.4

a.root-servers.net. 601655 IN AAAA 2001:503:ba3e::2:30

b.root-servers.net. 601655 IN A 192.228.79.201

c.root-servers.net. 601655 IN A 192.33.4.12

d.root-servers.net. 601655 IN A 128.8.10.90

d.root-servers.net. 601655 IN AAAA 2001:500:2d::d

e.root-servers.net. 601655 IN A 192.203.230.10

f.root-servers.net. 601655 IN A 192.5.5.241

f.root-servers.net. 601655 IN AAAA 2001:500:2f::f

g.root-servers.net. 601655 IN A 192.112.36.4

h.root-servers.net. 601655 IN A 128.63.2.53

h.root-servers.net. 601655 IN AAAA 2001:500:1::803f:235

i.root-servers.net. 601655 IN A 192.36.148.17

i.root-servers.net. 601655 IN AAAA 2001:7fe::53


;; Query time: 2 msec

;; SERVER: 192.9.200.4#53(192.9.200.4)

;; WHEN: Fri Feb 3 12:47:07 2012

;; MSG SIZE rcvd: 512

Reply
User profile for user: Camelot
Camelot
User level: Level 9
58,329 points

Feb 3, 2012 11:25 AM in response to jimfromma

If this is internal then there's no real issue - even if I learn, for example, that your internal DNS server is at 192.168.84.72 it means nothing - I can't hit that, query it, or wean any information from it.


If you want to mask your domain name, that's fine.


The example you posted, though, doesn't help - you just ran 'dig' but didn't query any hostname, so all it returned were the public root servers (that everyone knows). Please re-post with examples of querys against both your own domains and a public/external hostname such as www.apple.com.

Reply
User profile for user: jimfromma
jimfromma Author
User level: Level 1
4 points

Feb 6, 2012 9:09 AM in response to jimfromma

Ok, after reading up on the dig command, I was able to get some of the information you mentioned.


From one of my Mac workstations I used the basic default query and came up with the following results.


mac002:~ mac002$ dig server.millenniumpress.internal


; <<>> DiG 9.6-ESV-R4-P3 <<>> server.millenniumpress.internal

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28692

;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0


;; QUESTION SECTION:

;server.millenniumpress.internal. IN A


;; ANSWER SECTION:

server.millenniumpress.internal. 10800 IN A 192.9.200.4


;; AUTHORITY SECTION:

millenniumpress.internal. 10800 IN NS server.millenniumpress.internal.


;; Query time: 0 msec

;; SERVER: 192.9.200.4#53(192.9.200.4)

;; WHEN: Mon Feb 6 11:47:11 2012

;; MSG SIZE rcvd: 79


2.


mac002:~ mac002$ dig yahoo.com


; <<>> DiG 9.6-ESV-R4-P3 <<>> yahoo.com

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50105

;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 0


;; QUESTION SECTION:

;yahoo.com. IN A


;; ANSWER SECTION:

yahoo.com. 3317 IN A 72.30.2.43

yahoo.com. 3317 IN A 98.137.149.56

yahoo.com. 3317 IN A 98.139.180.149

yahoo.com. 3317 IN A 209.191.122.70


;; Query time: 15 msec

;; SERVER: 192.9.200.5#53(192.9.200.5)

;; WHEN: Mon Feb 6 11:43:24 2012

;; MSG SIZE rcvd: 91


then, I ran this one again (?)


mac002:~ mac002$ dig yahoo.com


; <<>> DiG 9.6-ESV-R4-P3 <<>> yahoo.com

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7239

;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 7, ADDITIONAL: 7


;; QUESTION SECTION:

;yahoo.com. IN A


;; ANSWER SECTION:

yahoo.com. 3078 IN A 98.137.149.56

yahoo.com. 3078 IN A 98.139.180.149

yahoo.com. 3078 IN A 209.191.122.70

yahoo.com. 3078 IN A 72.30.2.43


;; AUTHORITY SECTION:

yahoo.com. 93280 IN NS ns2.yahoo.com.

yahoo.com. 93280 IN NS ns6.yahoo.com.

yahoo.com. 93280 IN NS ns4.yahoo.com.

yahoo.com. 93280 IN NS ns8.yahoo.com.

yahoo.com. 93280 IN NS ns5.yahoo.com.

yahoo.com. 93280 IN NS ns3.yahoo.com.

yahoo.com. 93280 IN NS ns1.yahoo.com.


;; ADDITIONAL SECTION:

ns1.yahoo.com. 89645 IN A 68.180.131.16

ns2.yahoo.com. 89645 IN A 68.142.255.16

ns3.yahoo.com. 89645 IN A 121.101.152.99

ns4.yahoo.com. 89645 IN A 68.142.196.63

ns5.yahoo.com. 89645 IN A 119.160.247.124

ns6.yahoo.com. 96874 IN A 202.43.223.170

ns8.yahoo.com. 96874 IN A 202.165.104.22


;; Query time: 0 msec

;; SERVER: 192.9.200.4#53(192.9.200.4)

;; WHEN: Mon Feb 6 11:52:14 2012

;; MSG SIZE rcvd: 329



Note the Query time.


When I turn off the DNS services on the old server(192.9.200.5), this is the query time. It still goes out but...


;; Query time: 5234 msec

;; SERVER: 192.9.200.4#53(192.9.200.4)

;; WHEN: Mon Feb 6 12:06:31 2012

;; MSG SIZE rcvd: 249

Reply
User profile for user: jimfromma
jimfromma Author
User level: Level 1
4 points

Feb 6, 2012 9:19 AM in response to jimfromma

Some addition information when I did a reverse lookup after turning the DNS services back on the old server.


mac002:~ mac002$ dig -x 192.9.200.5


; <<>> DiG 9.6-ESV-R4-P3 <<>> -x 192.9.200.5

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 54834

;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0


;; QUESTION SECTION:

;5.200.9.192.in-addr.arpa. IN PTR


;; AUTHORITY SECTION:

200.9.192.in-addr.arpa. 10800 IN SOA 200.9.192.in-addr.arpa. admin.200.9.192.in-addr.arpa. 2012020103 86400 3600 604800 345600


;; Query time: 0 msec

;; SERVER: 192.9.200.4#53(192.9.200.4)

;; WHEN: Mon Feb 6 12:17:25 2012

;; MSG SIZE rcvd: 84


mac002:~ mac002$ dig -x 192.9.200.4


; <<>> DiG 9.6-ESV-R4-P3 <<>> -x 192.9.200.4

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62308

;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1


;; QUESTION SECTION:

;4.200.9.192.in-addr.arpa. IN PTR


;; ANSWER SECTION:

4.200.9.192.in-addr.arpa. 10800 IN PTR Server.millenniumpress.internal.


;; AUTHORITY SECTION:

200.9.192.in-addr.arpa. 10800 IN NS Server.millenniumpress.internal.


;; ADDITIONAL SECTION:

Server.millenniumpress.internal. 10800 IN A 192.9.200.4


;; Query time: 0 msec

;; SERVER: 192.9.200.4#53(192.9.200.4)

;; WHEN: Mon Feb 6 12:17:54 2012

;; MSG SIZE rcvd: 117

Reply
User profile for user: Camelot
Camelot
User level: Level 9
58,329 points

Feb 7, 2012 12:56 AM in response to jimfromma

So these are public DNS servers? serving your .internal domain? and you work for Sun/Oracle (because that's who 'owns' the 192.9.x.x network)?


From the data posted so far I'm going to hazard a guess that the .4 server is configured to use .5 as a forwarder, so queries to .4 are being passed to .5 for resolution. That's just a guess, though. It certainly points to some configuration error, but it's going to be hard to troubleshoot that without revealing more about your network/server setup than you might be comfortable with.

Reply

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

dns server hangs on lookup

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.
Learn more Sign up