I think most Plesk users are not aware their SOA-record does not represent their authoritative server. I never was.
This until I wrote a script to check if the DNS config of the Plesk server represented the real world....
Orphans on the server can be confusing when troubleshooting and it's good to check if the slave server is responding and also has the same serial in the SOA-record as the authorative server.
In this script I'm resolving the NS-records and check them with the IP's the server is having to determine which NS-record is authoritative.
Last year I was using this script regularly and it enabled me to keep a clean config.
This script was not written for this bug, but it made me discover it.
After I upgraded to Plesk 12 many, but not all domains had their SOA-record changed to the slave server.
It still is changing the SOA-records of old domains for no apparent reason from time to time!
I corrected this, but what I was never able to fix was the creation of new domains.
They always had the slave server as SOA-record.
In the end I just removed the NS-record of this slave server from the DNS-template and now I have to manually add that NS-record after creating a new domain.
Having this random behaviour in Plesk is quite a nuisance and it's beyond me why "my approach" is not used for creating the SOA-record.
Having your Plesk server as a "Master server" implies that the server is authoritative.
Why not use thát as the best guess for the SOA-record
Here's the quick-and-dirty script I wrote. It was intended for internal use and it helped me get the job done:
# cat /usr/local/sbin/dnsconfigcheck
Code:
#!/bin/bash
# Author: JP van Melis
ZONEFILE="$1"
NAMED_CONF=/etc/named.conf
CACHING_DNS=8.8.8.8
ZONES=`mktemp`
THIS_SERVER_A=`mktemp`
THIS_SERVER_IP=`mktemp`
IP_SOA=`mktemp`
IP_AUTH=`mktemp`
# get this server's IP's
ifconfig | egrep -o 'inet( | addr:)[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | tr -cd '0-9.\n' >${THIS_SERVER_IP}
# extract domain names from named.conf or given file
if [ -z "${ZONEFILE}" ] || [ ! -f "${ZONEFILE}" ] ; then
egrep -o '^zone \"[a-z0-9-]+\.[a-z]+\"' ${NAMED_CONF} | awk '{print $2}' | tr -d '"' >${ZONES}
else
egrep -o '[a-z0-9-]+\.[a-z]+' ${ZONEFILE} >${ZONES}
fi
sed -i '/^domain.com$/d' ${ZONES}
# Parse all the domains
while read ZONE ; do
echo -en "${ZONE} \r"
# Get SOA-record
SOA=`host -t SOA ${ZONE} ${CACHING_DNS} 2>/dev/null | egrep -o 'has SOA record [A-Za-z0-9.-]+' | awk '{print $4}'`
if [ -z ${SOA} ] ; then
echo "${ZONE}:" | awk '{ printf("%-35s",$0)}'
echo "has no SOA-record (according to ${CACHING_DNS})"
else
IT_IS_ME=
if ! grep -q ${ZONE} ${THIS_SERVER_A} ; then
# Collect all the IP's of that SOA-record
host -t A ${SOA} ${CACHING_DNS} 2>/dev/null | egrep -o 'has address [0-9.]+'| awk '{print $3}' >${IP_SOA}
while read IP ; do
# Check if the SOA-record points to one of my IP-addresses
if grep -q "^${IP}$" ${THIS_SERVER_IP} ; then
IT_IS_ME=${IP}
echo "${ZONE}" >>${THIS_SERVER_A}
break
fi
done <${IP_SOA}
# If the domain is foreign then warn me
if [ ! ${IT_IS_ME} ] ; then
echo "${ZONE}:" | awk '{ printf("%-35s",$0)}'
echo "has ${SOA} as SOA-record (not me)"
fi
fi
if [ ${IT_IS_ME} ] ; then
egrep -A15 "zone.+\"${ZONE}" ${NAMED_CONF} | grep -B20 '^};' | grep -A8 'allow-transfer {' | grep -B8 'common-allow-transfer;' | egrep -o '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' >${IP_AUTH}
if [ -s ${IP_AUTH} ] ; then
SOA_THIS_SERIAL=`host -t SOA ${ZONE} ${IT_IS_ME} 2>/dev/null | egrep -o 'has SOA record [A-Za-z0-9.-]+ .*' | awk '{print $6}'`
while read IP ; do
SOA_AUTH_COMPLETE=`host -t SOA ${ZONE} ${IP} 2>/dev/null | egrep -o 'has SOA record [A-Za-z0-9.-]+ .*'`
SOA_AUTH=`echo "${SOA_AUTH_COMPLETE}" | awk '{print $4}'`
SOA_AUTH_SERIAL=`echo "${SOA_AUTH_COMPLETE}" | awk '{print $6}'`
if [ -z "${SOA_AUTH}" ] ; then
echo "${ZONE}:" | awk '{ printf("%-35s",$0)}'
echo "Unable to resolve the SOA-record at the IP ${IP}"
elif [ ! "${SOA_AUTH}" = "${SOA}" ] ; then
echo "${ZONE}:" | awk '{ printf("%-35s",$0)}'
echo "The SOA-record I resolved at the IP ${IP} (${SOA_AUTH}) is different than the one I resolved using ${CACHING_DNS} (${SOA})"
elif [ ! "${SOA_AUTH_SERIAL}" = "${SOA_THIS_SERIAL}" ] ; then
echo "The serial of the SOA-record I resolved at the IP ${IP} (${SOA_AUTH_SERIAL}) is different than the one I resolved using ${IT_IS_ME} (${SOA_THIS_SERIAL})"
fi
done<${IP_AUTH}
else
echo "${ZONE}:" | awk '{ printf("%-35s",$0)}'
echo "No IP's for Authorative Namerserver found in ${NAMED_CONF}"
fi
fi
fi
done<${ZONES}
echo " "
rm ${ZONES}
rm ${THIS_SERVER_A}
rm ${THIS_SERVER_IP}
rm ${IP_SOA}
rm ${IP_AUTH}
Just ran the script...
Again the SOA-record has been changed for several domains. It was fine a month ago.
Facebook
Twitter
