https://lukehebert.com/tag/dns/Recent content in Dns on Luke HebertHugoen-usThu, 21 Aug 2025 00:00:00 +0000https://lukehebert.com/post/aws-default-dns-server-ec2/Thu, 21 Aug 2025 00:00:00 +0000https://lukehebert.com/post/aws-default-dns-server-ec2/Explains how the AWS default DNS server works for EC2 instances within a VPC, including the special 169.254.169.253 address and the CIDR-based resolver IP.https://lukehebert.com/post/coredns/Tue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/coredns/Set up a dedicated server as a DNS server using CoreDNS, covering binary installation, server startup, and IP-to-hostname mapping via the hosts plugin. CoreDNS also supports extensibility through plugins, including one for Kubernetes.https://lukehebert.com/post/understanding-how-pods-talk-in-kubernetes-networks-dns/Tue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/understanding-how-pods-talk-in-kubernetes-networks-dns/A deep dive into how Kubernetes DNS resolves service names to IP addresses, covering A records, SRV records, search domains, and the full lookup path from pod to CoreDNS. Understanding this lifecycle is essential for debugging connectivity issues and designing resilient microservice architectures.https://lukehebert.com/post/kubernetes-internal-dns-search-base/Tue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/kubernetes-internal-dns-search-base/Kubernetes provides a built-in DNS service that assigns predictable names to Services and Pods within a cluster. By default, pods use cluster.local as their search base for internal DNS resolution, enabling communication through human-readable names rather than ephemeral IP addresses.https://lukehebert.com/post/nginx-ingress-controller/Tue, 19 Aug 2025 00:00:00 +0000https://lukehebert.com/post/nginx-ingress-controller/A practical guide to installing and configuring the Ingress-Nginx Controller in Kubernetes, covering Helm and kubectl methods, cloud-provider annotations, and local testing workflows.https://lukehebert.com/post/understanding-docker-dns/Wed, 15 Nov 2023 00:00:00 +0000https://lukehebert.com/post/understanding-docker-dns/An overview of how Docker’s built-in DNS resolver enables container-to-container communication and service discovery. Covers default configurations, custom DNS setups, and practical use cases.https://lukehebert.com/post/dns/Tue, 02 May 2023 00:00:00 +0000https://lukehebert.com/post/dns/A practical guide to understanding DNS resolution tiers and troubleshooting name resolution issues in Linux environments. Covers /etc/nsswitch.conf, /etc/resolv.conf, and local caching services.https://lukehebert.com/post/a-parctical-guide-to-trace-route-tracecrt/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/a-parctical-guide-to-trace-route-tracecrt/Traceroute is one of the most misunderstood tools in a network engineer’s toolkit. This guide walks through how traceroute actually works, how to read the output correctly, and how to avoid the common pitfalls that lead to wrong conclusions.https://lukehebert.com/post/create-a-new-rndc-key-make-sure-the-key-name-is-rndc-key/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/create-a-new-rndc-key-make-sure-the-key-name-is-rndc-key/Generate a fresh rndc.key and wire it into rndc.conf so your BIND name server accepts authenticated remote control commands. Covers the rndc-confgen command and the full rndc.conf structure.https://lukehebert.com/post/dkim-verification-both-must-be-set-to-on/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/dkim-verification-both-must-be-set-to-on/Exim offers two DKIM-related toggles that work together to validate and enforce sender signatures. Setting both to On ensures your mail server actually checks incoming DKIM records and rejects messages that fail validation.https://lukehebert.com/post/dns-amplifcation-attack/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/dns-amplifcation-attack/A DNS amplification attack floods a victim with forged responses by exploiting open resolvers. This post walks through iptables rules and BIND hardening steps to block the attack vector.https://lukehebert.com/post/dns-resolution-and-zone-files/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/dns-resolution-and-zone-files/A practical walkthrough of how DNS resolution works, from the hierarchical name space down to the iterative query process. Includes common zone file syntax mistakes and how to avoid them.https://lukehebert.com/post/get-gateway-hostnamed-from-mail-log/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/get-gateway-hostnamed-from-mail-log/A quick bash one-liner to pull offending IP addresses from exim relay-denied entries and resolve them to hostnames, making it easier to identify which gateways are misconfigured.https://lukehebert.com/post/monitor-dns-zone-reload/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/monitor-dns-zone-reload/A quick workflow for triggering a DNS zone reload with rndc and confirming the result in the system log. Covers the two commands you need and what to look for in the output.https://lukehebert.com/post/multi-zone-views-for-bind9-internal-external-etc/Mon, 24 Jan 2022 00:00:00 +0000https://lukehebert.com/post/multi-zone-views-for-bind9-internal-external-etc/Learn how to configure BIND9 views to serve different DNS records to internal and external clients from a single server. This guide walks through zone files, ACLs, recursion control, and the $include directive to keep your setup clean and secure.https://lukehebert.com/post/ptr-records/Tue, 05 Sep 2017 00:00:00 +0000https://lukehebert.com/post/ptr-records/A valid PTR record must resolve to a name that resolves back to the original address. Multiple PTR records for a single address break name resolution and can cause Kerberos ticket verification to fail.https://lukehebert.com/post/server-not-found-kerberos/Wed, 16 Aug 2017 00:00:00 +0000https://lukehebert.com/post/server-not-found-kerberos/A quick troubleshooting guide for the ‘Server not found in Kerberos database’ error, covering the four most common root causes and how to verify each one.https://lukehebert.com/post/check-dns-hostname-resolution-forward-and-backward-python-java/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/check-dns-hostname-resolution-forward-and-backward-python-java/Inconsistent forward and reverse DNS lookups can cause a cascade of cluster and security issues. This guide walks through quick Python and Java one-liners to verify that your hostname, IP, and reverse record all line up.https://lukehebert.com/post/checking-host-resolution-using-getent/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/checking-host-resolution-using-getent/A quick reference for using getent to verify how your Linux system resolves hostnames, short names, and IP addresses through the full NSS chain.https://lukehebert.com/post/hostname-and-hostname-f-not-getting-fqdn/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/hostname-and-hostname-f-not-getting-fqdn/When hostname -f returns a short name instead of a fully qualified domain name, the issue usually traces back to the HOSTNAME variable in /etc/sysconfig/network or a misconfigured /etc/hosts entry. Understanding the difference between the gethostname and gethostbyname system calls makes the fix straightforward.https://lukehebert.com/post/ntp-errors/Tue, 27 Jun 2017 00:00:00 +0000https://lukehebert.com/post/ntp-errors/A host health test flags NTP clock drift when the system clock falls out of sync with its NTP servers. This guide walks through diagnosing and resolving common NTP synchronization failures.