Tag Archives: dnsonly

cPanel DNSonly bind recursion

In case you may be running into issues with named/bind domain service on cPanel DNSonly not responding to DNS queries recursively, I have a fix for you.

In older versions of named/bind9 used by cPanel if you wanted to allow anyone (or if you wanted security you could have setup an ACL, let’s assume you want to allow all) you could simply edit the configuration file and change “recursion no;” to “recursion yes;” to allow anyone to make queries to your DNS server for those domains or records that are not kept in your local server (ie: resolve yahoo.com)
Newer versions of BIND9/named changed their past behavior and now require a more specific configuration, just add these under “options” section

options {
...
allow-recursion { any; };
allow-query { any; };
allow-query-cache { any; };
...
};

I found a detailed explanation on why bind/named dns server changed its behavior, on the next page  a copy of the support bulletin from July 2007:

How to setup Mailjet on exim for cPanel dnsonly on Google Cloud

I have been experimenting with Google Compute Engine (GCE) for the past few days. I wanted to migrate a slave DNS server to Google as an experiment and this blog post will talk about the shortcomings, my workarounds, configuration and tips to achieve the goal of having cPanel DNSonly installed and setup using Google’s infrastructure.

What is Google Compute Engine?

Google Compute Engine (or “GCE”) is Google’s answer to Amazon’s AWS, it basically offers you the ability to deploy Virtual Machines (VMs) at Google’s datacenters. In the most simplistics of setups you would use a single VM or “compute instance” and if you wanted to have a more complex setup you could deploy multiple instances in different geographic locations spread across different datacenters in the United States to achieve a more redundant setup or to provide you with better capacity for large traffic workflows.

It all depends on what your goals are, myself I am just starting out with a simple requirement. I would like to use a single compute instance running CentOS linux that runs cPanel DNSonly (proprietary control panel/dns clustering solution for cPanel servers).

The goal is not to host websites or any critical services on this instance, but rather only keep a copy of my DNS zones. If my experiment fails or my instance goes down or gets destroyed there won’t be any losses or damages for this experiment as my primary server is still running on Proxmox PVE.

The limitations of GCE… What I learned so far

GCE instances run behind Google’s firewalls and depending on the datacenter you decide to host your instance your VM will have an internal IP within that datacenters network scope/range (for example: us-central1 datacenter zone has a 10.128.0.0/20 range for all VMs).

This means that assigning a IPv4 public static IP, which is needed to allow anyone to query the DNS server we’ll be hosting inside this instance will actually have to forward packets to the instances internal network. Not really a big deal unless your application can’t be behind a NAT firewall like it is the case here.

For our intensive use and purposes it is fine. One important issue that I found is that doing any kind of e-mail server related activities on GCE is prohibited (source). You won’t be able to use SMTP (Simple Mail Transfer Protocol) port 25, 465 or 587 to send or receive email.

Now for a DNS server that will not be a mailserver this is not a blocker, but it is really a pain in the ass. Why? because monitoring scripts running on the server need to email the administrator to notify me of issues or errors so they can be investigated.

Continued on the next page.