Resolve DNS issues on cpanel 11.x

There is an issue with DNS in cPanel 11.x, where named.conf is badly configured by cPanel. Here is how a DNS report from dnsstuff.com would look because of this:

FAILS for SOA record Fails for lame nameservers.

Here's how to fix it:

SSH to server

Back up your named.conf file by

cp /etc/named.conf named.conf.back

then pico /etc/named.conf

Replace

Code:

include "/etc/rndc.key";

controls {

       inet 127.0.0.1 allow { localhost; } keys { "rndc-key"; };

};

options {

   /* make named use port 53 for the source of all queries, to allow
        * firewalls to block all ports except 53:
        */
   query-source    port 53;    
   
   // Put files that named is allowed to write in the data/ directory:
   directory "/var/named"; // the default
   dump-file             "data/cache_dump.db";
   statistics-file     "data/named_stats.txt";
   memstatistics-file     "data/named_mem_stats.txt";

};

logging { /* If you want to enable debugging, e.g. using the 'rndc trace' command,

*      named will try to write the 'named.run' file in the $directory (/var/named).
*      By default, SELinux policy does not allow named to modify the /var/named directory,
*      so put the default debug log file in data/ :
*/
   channel default_debug {
           file "data/named.run";
           severity dynamic;
   };    

};

// All BIND 9 zones are in a "view," which allows different zones to be served // to different types of client addresses, and for options to be set for groups // of zones. // // By default, if named.conf contains no "view" clauses, all zones are in the // "default" view, which matches all clients. // // If named.conf contains any "view" clause, then all zones MUST be in a view, // so it is recommended to start off using views to avoid having to restructure // your configuration files in the future.

view "localhost_resolver" { /* This view sets up named to be a localhost resolver ( caching only nameserver ).

* If all you want is a caching-only nameserver, then you need only define this view:
*/
   match-clients         { localhost; };
   match-destinations    { localhost; };
   recursion yes;

   zone "." IN {
       type hint;
       file "/var/named/named.ca";
   };

   /* these are zones that contain definitions for all the localhost
    * names and addresses, as recommended in RFC1912 - these names should
    * ONLY be served to localhost clients:
    */
   include "/var/named/named.rfc1912.zones";

};

view "internal" { /* This view will contain zones you want to serve only to "internal" clients

  that connect via your directly attached LAN interfaces - "localnets."
*/
   match-clients        { localnets; };
   match-destinations    { localnets; };
   recursion yes;

   zone "." IN {
       type hint;
       file "/var/named/named.ca";
   };

   // include "/var/named/named.rfc1912.zones";
   // you should not serve your rfc1912 names to non-localhost clients.

   // These are your "authoritative" internal zones, and would probably
   // also be included in the "localhost_resolver" view above:

};

view "external" { /* This view will contain zones you want to serve only to "external" clients

* that have addresses that are not on your directly attached LAN interface subnets:
*/
   match-clients        { !localnets; !localhost; };
   match-destinations    { !localnets; !localhost; };

   recursion no;
   // you'd probably want to deny recursion to external clients so you don't
   // end up providing free DNS service to all takers

   // all views must contain the root hints zone:
   zone "." IN {
       type hint;
       file "/var/named/named.ca";
   };

   // These are your "authoritative" external zones and would probably
   // contain entries for just your web and mail servers:

   // BEGIN external zone entries

With

Code:

include "/etc/rndc.key";

controls {

       inet 127.0.0.1 allow { localhost; } keys { "rndc-key"; };

};

And then go to the bottom of the file and remove

}; at the bottom.

Save file and exit

then test config service named configtest if you have done this correctly, it should display something like this:

zone blue.xxx.com/IN: loaded serial 2007070901 zone xxx.com/IN: loaded serial 2007070906 zone ns1.xxx.com/IN: loaded serial 2007070901 zone server.xxx.com/IN: loaded serial 2007071001 zone xxx.net/IN: loaded serial 2007071001

Then restart named by

service named restart

That's it! Your DNS should be working now.