DSM 7.1 Hints Issues for b.root-servers.net

[SnazzyJim]

How do I make these messages stop showing in my DNS logs?

 

[fredbert]

What are your settings? How did you filter the DNS Server logs to find these events?

 

[fredbert]

Resolution | DNS Server - Synology Knowledge Center

Synology Knowledge Center offers comprehensive support, providing answers to frequently asked questions, troubleshooting steps, software tutorials, and all the technical documentation you may need.

kb.synology.com

Try Forward only?

• Forward policy: Select a policy for forwarding queries. If you select Forward first, your Synology NAS queries root servers when forwarders do not respond. If you select Forward only, your Synology NAS will not attempt to query its root servers even if forwarders do not respond.

 

[SnazzyJim]

I've set to forward only and will check logs to see results. The default settings show these alerts.

 

[info_dan]

For those stumbling on this old post, here's some additional details. I have opened a ticket with Synology with the following content (I'm running on DSM 7.1.1-42962 Update 8, DNS Server 9.16.23-6174).

[Symptoms]
Warnings messages in DNS Server Log:

checkhints: b.root-servers.net/AAAA (2001:500:200::b) extra record in hints
checkhints: b.root-servers.net/AAAA (2801:1b8:10::b) missing from hints
checkhints: b.root-servers.net/A (199.9.14.201) extra record in hints
checkhints: b.root-servers.net/A (170.247.170.2) missing from hints

[Time of Occurrence]
On DNS Server package restart, as an example

[Actions Before Occurrence or Steps to Reproduce the Problem]

• Restart DNS Server package
• Consult DNS Server Log

[Error Message and Screenshot]

[Explanation]

The cause of these warning messages is a change of the IP address for the the "b.root-servers.net" root DNS server, It was changed to 170.247.170.2 (IPv4) and 2801:1b8:10::b (IPv6) in November 2023. See the following references:

• New addresses for b.root-servers.net (2023-5-16)
• Future update to IPv4 address for DNS root server - www.iana.org (2023-5-25)
• LACNIC Assigns Number Resources to the USC/ISI DNS Root Server (2023-5-30)

[Question]

How can we update the list of root servers used by DNS server?

Such a question was asked in the Synology Community way back in 2015, but never got a reply (How to change the Root Hints in DNSServer? | Synology Community - community.synology.com)

Digging a little, the root servers seems to be "hard-coded" in the following DNSServer/bin binaries: named, dig, named-checkzone, named-checkconf and nsupdate.

I guess a recompile and a new maintenance release of the DNS Server package is required... The strong of heart hackers could hex-edit those files, but that's risky business!

 

[info_dan]

Ok, got the reply from Synology:

It will be fixed after upgrading the BIND binary next time since the root DNS list is hard coded in the BIND binary.

Currently, please ignore these logs since it will not affect the DNS server running.[/INDENT]

Since there is no timeframe, and with the information that they are using Bind, I developed my own fix, which I will describe below. But first, the standard disclaimers:

• This is for information only. USE AT YOUR OWN RISK
• These commands are run as root. Make sure you understand the commands and are comfortable with diagnosing unexpected behavior should your configuration be different or have to deal with the unexpected result of a mistyped command!
• You MUST be familiar and comfortable editing text file under an SSH session (e.g. using vi editor). If you are not, you probably should not attempt the modifications described below.

• I am running DNS Server 9.16.23-6174 under DSM 7.1.1-42962 Update 8. If your versions are different, I have no way to know if the fix below will work on your system, require adjustments or not work at all.

With that out of the way, what I have done is obtain from the current root servers hints file from the iana site, and configured bind's named resolver to use this file for root zone hints. Here are the commands:

Log in as root, go to named configuration folder

sudo su -
cd /var/packages/DNSServer/target/named/etc/default
ls -l

Get the named.root file from iana's web site, adjust permissions

wget https://www.internic.net/domain/named.root
chown DNSServer:DNSServer named.root
chmod 755 named.root
ls -l

Go back up one directory level, copy the original named.conf under a new name for editing, rename the original and create a symbolic link to allow easy switching between the two versions

cd ..
cp -p named.conf named.conf.use_named_root
mv named.conf named.conf.original; ln -s named.conf.use_named_root named.conf
ls -l

Edit named.conf to add the following lines towards the beginning of the file as shown below (highlighted in yellow manually in screenshot)

// zone file for the root servers
// Added to handle the change of IP for the b.root-servers.net in November 2023.
zone "." {
  type hint;
  file "/var/packages/DNSServer/target/named/etc/default/named.root";
};

vi named.conf
cat named.conf

You can now:

• go to the Package Center,
• Select DNS Server package and Stop it,
• Restart it( [ Run ] ),
• [ Open ] it,
• and go to the Logs and confirm the warnings are no longer generated

If the package fails to restart because your configuration is different, or there was a mistake in executing the commands above, undo your changes (see below) and select [ Repair ]. In my experiments, repairing did not affect my DNS configuration.


If you wish to revert this change you can execute the following commands. WARNING: rm commands while running as root are involved. Be sure you understand the commands and type them without errors.

sudo su -
cd /var/packages/DNSServer/target/named/etc
ls -l . default
rm named.conf; mv named.conf.original named.conf
rm named.conf.use_named_root default/named.root
ls -l . default

I hope this will be of a little use to some of you in cleaning up your logs by removing useless noise warnings!

Dan.

 

[info_dan]

For the record, further clarification from Synology.

Thank you for your response, and I appreciate your suggestion regarding the resolution of this issue.

To clarify, our development team is already aware of this issue and plans to address it in a future release. However, I currently do not have a specific timeline for when this update will be implemented.

 

[SnazzyJim]

I've finally decided to implement your root hints fix. Based on the length of time this has persisted, it's possible Synology will never implement a fix. It took me two goes to get it right as I had to look up the correct Vi commands to properly save my changes. One of these days I'll get my Linux down pat. Thanks again.

 

[SnazzyJim]

For the record, further clarification from Synology.

Installed the latest update, "DSM 7.1.1-42962 Update 9", so I'm watching my dns logs to see if anything has changed. This update doesn't mention any dns updates, so hopefully it hasn't overwritten this fix.

 

[Droppie391]

I simply replaced the db.root file with the downloaded named.root and restarted. No Need to edit any file this way.