infractlby prmctl
⌕
labs › dns › bind9
Open executable lab

BIND9 Primary / Secondary

Deploy a small authoritative DNS environment, verify replication, inject controlled failures, troubleshoot from evidence, and recover the service.

DNSBIND9HIGH AVAILABILITYTROUBLESHOOTING
Primary172.28.0.10Authoritative source of truth
Zone TransferAXFR / IXFRNOTIFY + TSIG
Secondary172.28.0.11Replicated zone data

Architecture

Client172.28.0.20
Primary BIND9172.28.0.10
AXFR / IXFRNOTIFY + TSIG
Secondary BIND9172.28.0.11

Quick start

cd labs/dns/bind9

make up
make verify
Healthy baseline

Both servers should answer for infractl.test and report the same SOA serial.

Failure scenarios

01

Primary down

Stop the primary and verify the secondary continues answering.

make break-primary
02

Network partition

Keep the process alive but disconnect it from the lab network.

make break-network
03

Stale secondary

Change the primary SOA serial while synchronization is unavailable, then compare answers.

dig @172.28.0.10 infractl.test SOA +short
dig @172.28.0.11 infractl.test SOA +short

Troubleshooting flow

01

Scope

Which clients and names are failing?

02

Process

Are the BIND processes alive?

03

Socket

Is TCP/UDP port 53 listening?

04

Network

Can clients reach both servers?

05

SOA

Do the serials match?

06

Logs

What changed at the failure timestamp?

Useful commands

make status
make logs
make shell

dig @172.28.0.10 infractl.test SOA +short
dig @172.28.0.11 infractl.test SOA +short

named-checkconf
named-checkzone infractl.test /etc/bind/zones/db.infractl.test

ss -lntup | grep ':53'
tcpdump -ni any port 53

Recovery

make recover
make verify
Do not recover too early.

Capture enough evidence to explain the failure before restoring the healthy state.