4 ms·
In my experience, we're already past the point where DNS is too complex. I worked with a customer who had a postage meter that refused to work correctly. Afte
by lostapathy 8y ago
In my experience, we're already past the point where DNS is too complex.
I worked with a customer who had a postage meter that refused to work correctly. After tons of troubleshooting, it turned out the issue is that the postage company had DNAME records in the mix ... and the DNS server on that network doesn't support DNAME at all. That troublesome DNS server is the (then, at least) current version of Samba.
I tried contacting the vendor to report the issue and, in typical fashion, I don't think I even got a ticket escalated to somebody who understood it. We put the postage meter on a VLAN with different DNS to work around it.
I've also seen major issues with US government websites advertising AAAA records for websites that aren't actually available on ipv6 - and again, no way to report/resolve it, we just disabled ipv6 on the workstation we file those reports from.
Both experiences made me realize how fragile DNS is, how hard it is to get anything fixed once you do diagnose it, and that a lot of "flakey" tech probably suffers from DNS issues outside either the vendor or consumer's control.
- marcosdumay 8y agoSamba shouldn't be trying to deal with records it does not understand, and those AAAA records aren't exactly a DNS issue. The Internet has become way too complex lately and DNS gets to carry the burden of gluing everything together. It may be wise to rethink its role, make it more general, and stack things on top of it, instead of inside.
- lostapathy 8y agoSamba isn't "dealing with" them, it's just dropping them because it doesn't know anything about them.
- marcosdumay 8y agoDropping them is dealing with them. DNS is an opaque key-value registry, you get a record from upstream, you store it and repeat to everybody that asks.
- amaccuish 8y agoThe problem is that Samba 4 has to deal with them, since it will look them up in ldb, and if they're not there, forward them. I guess it doesn't blindly pass records through that it can't look up in LDAP. As a side note, although I love AD DNS, MS are so slow to add new record support. I still can't add SSHFP records to Samba. :(
- gerdesj 8y agoYou don't have to use the built in DNS server in Samba. You can use BIND - https://wiki.samba.org/index.php/BIND9_DLZ_DNS_Back_End https://wiki.samba.org/index.php/BIND9_DLZ_DNS_Back_End and https://wiki.samba.org/index.php/Changing_the_DNS_Back_End_of_a_Samba_AD_DC https://wiki.samba.org/index.php/Changing_the_DNS_Back_End_o...
- amaccuish 8y agoYe, I find the inbuilt one more reliable, and i've seen a ppt which says bind_dlz is a horrible hack and they'll stop it at some point. Also that doesn't affect what record types can be stored and manipulated in AD.
- gerdesj 8y agoI've seen a similar thing ("and they'll stop it at some point"). If you need DNS functionality beyond the Samba implementation then I would suggest having a separate BIND or PDNS server that all clients point at and that collates the DNS view that you wish them to have. A GPO will get them to update records on your Samba DNS and your PDNS or BIND or whatever can do the rest.
- amaccuish 8y agoNice thinking. I'll give that a think, thanks!
- marcosdumay 8y ago
- gerdesj 8y agoWell I never: https://lists.samba.org/archive/samba/2016-July/201314.html https://lists.samba.org/archive/samba/2016-July/201314.html Mind you, that was July 2016.