🚀 go-pugleaf

> Dlaczego tylko podejrzewasz, sprawdzałeś reguły firewalla?
Porty TCP i UDP 53 otwarte, tak na docelowym (XXX.XXX.XXX.XXX), jak i 
pytających (AAA.AAA.AAA.AAA; YYY.YYY.YYY.YYY; ZZZ.ZZZ.ZZZ.ZZZ).
Dla testu:
[root@AAA.AAA.AAA.AAA ~]# iptables -I INPUT -p tcp --dport 53 -j ACCEPT
[root@AAA.AAA.AAA.AAA ~]# iptables -I INPUT -p udp --dport 53 -j ACCEPT
[root@AAA.AAA.AAA.AAA ~]# iptables -I OUTPUT -j ACCEPT
[root@YYY.YYY.YYY.YYY ~]# iptables -I INPUT -p tcp --dport 53 -j ACCEPT
[root@YYY.YYY.YYY.YYY ~]# iptables -I INPUT -p udp --dport 53 -j ACCEPT
[root@YYY.YYY.YYY.YYY ~]# iptables -I OUTPUT -j ACCEPT
[root@ZZZ.ZZZ.ZZZ.ZZZ ~]# iptables -I INPUT -p tcp --dport 53 -j ACCEPT
[root@ZZZ.ZZZ.ZZZ.ZZZ ~]# iptables -I INPUT -p udp --dport 53 -j ACCEPT
[root@ZZZ.ZZZ.ZZZ.ZZZ ~]# iptables -I OUTPUT -j ACCEPT
[root@XXX.XXX.XXX.XXX ~]# iptables -I INPUT -p tcp --dport 53 -j ACCEPT
[root@XXX.XXX.XXX.XXX ~]# iptables -I INPUT -p udp --dport 53 -j ACCEPT
[root@XXX.XXX.XXX.XXX ~]# iptables -I OUTPUT -j ACCEPT

Fragment named.conf na docelowym XXX.XXX.XXX.XXX

view "external" {
match-clients { any; };
allow-query { any; };
allow-transfer { AAA.AAA.AAA.AAA; YYY.YYY.YYY.YYY; ZZZ.ZZZ.ZZZ.ZZZ; };
allow-notify { XXX.XXX.XXX.XXX; AAA.AAA.AAA.AAA; YYY.YYY.YYY.YYY; 
ZZZ.ZZZ.ZZZ.ZZZ; };
recursion no;

zone "domena.pl" IN { type master; file "master/external.domena.pl"; notify 
yes; also-notify { AAA.AAA.AAA.AAA; YYY.YYY.YYY.YYY; ZZZ.ZZZ.ZZZ.ZZZ; }; };

> A co zwraca proste zapytanie tego "filtrowanego" serwera o domenę przez
> niego obsługiwaną?

To już jest dla mnie zupełnym zaskoczeniem - na jednym "end of file", a na 
drugim "connection reset", trzeci natomiast zachowuje się prawidłowo.

[root@AAA.AAA.AAA.AAA ~]# host -T axfr domena.pl
;; communications error to XXX.XXX.XXX.XXX#53: end of file

[root@YYY.YYY.YYY.YYY ~]# host -T axfr domena.pl
;; communications error to XXX.XXX.XXX.XXX#53: connection reset

ten prawidłowo się zachowujący:
[root@ZZZ.ZZZ.ZZZ.ZZZ ~]# host -T axfr domena.pl
Using domain server:
Name: domena.pl
Address: XXX.XXX.XXX.XXX#53
Aliases:
Host axfr not found: 5(REFUSED)


[root@AAA.AAA.AAA.AAA ~]# dig @ns1.domena.pl domena.pl
; <<>> DiG 9.9.5-geoip-1.3 <<>> @ns1.domena.pl domena.pl
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

[root@YYY.YYY.YYY.YYY ~]# dig @ns1.domena.pl domena.pl
; <<>> DiG 9.9.5-geoip-1.3 <<>> @ns1.domena.pl domena.pl
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

[root@ZZZ.ZZZ.ZZZ.ZZZ ~]# dig @ns1.domena.pl domena.pl
; <<>> DiG 9.9.5-geoip-1.3 <<>> @ns1.domena.pl domena.pl
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46804
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 4
;; WARNING: recursion requested but not available
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;domena.pl.                      IN      A
;; ANSWER SECTION:
domena.pl.               86400   IN      A       XXX.XXX.XXX.XXX
;; AUTHORITY SECTION:
domena.pl.               86400   IN      NS      ns1.domena.pl.
domena.pl.               86400   IN      NS      ns2.domena.pl.
domena.pl.               86400   IN      NS      ns3.domena.pl.
;; ADDITIONAL SECTION:
ns1.domena.pl.           86400   IN      A       XXX.XXX.XXX.XXX
ns2.domena.pl.           86400   IN      A       YYY.YYY.YYY.YYY
ns3.domena.pl.           86400   IN      A       ZZZ.ZZZ.ZZZ.ZZZ
;; Query time: 62 msec
;; SERVER: XXX.XXX.XXX.XXX#53(XXX.XXX.XXX.XXX)
;; WHEN: śro maj 21 08:58:22 CEST 2014
;; MSG SIZE  rcvd: 155

[root@AAA.AAA.AAA.AAA ~]# nslookup -type=any domena.pl
Server:         127.0.0.1
Address:        127.0.0.1#53

domena.pl
        origin = ns1.domena.pl
        mail addr = root.domena.pl
        serial = 2014052001
        refresh = 28800
        retry = 7200
        expire = 2419200
        minimum = 86400
domena.pl        nameserver = ns1.domena.pl.
domena.pl        nameserver = ns3.domena.pl.
domena.pl        nameserver = ns2.domena.pl.
domena.pl        mail exchanger = 10 mail.domena.pl.
Name:   domena.pl
Address: XXX.XXX.XXX.XXX

[root@YYY.YYY.YYY.YYY~]# nslookup -type=any domena.pl
Server:         127.0.0.1
Address:        127.0.0.1#53

domena.pl
        origin = ns1.domena.pl
        mail addr = root.domena.pl
        serial = 2014051301
        refresh = 28800
        retry = 7200
        expire = 1209600
        minimum = 86400
domena.pl        nameserver = ns3.domena.pl.
domena.pl        nameserver = ns1.domena.pl.
domena.pl        nameserver = ns2.domena.pl.
domena.pl        mail exchanger = 10 mail.domena.pl.
Name:   domena.pl
Address: XXX.XXX.XXX.XXX
domena.pl        text = "v=spf1 a mx ptr ip4:XXX.XXX.XXX.XXX ~all"
domena.pl        rdata_99 = "v=spf1 a mx ptr ip4:XXX.XXX.XXX.XXX ~all"

[root@ZZZ.ZZZ.ZZZ.ZZZ ~]# nslookup -type=any domena.pl
Server:         194.204.159.1
Address:        194.204.159.1#53

Non-authoritative answer:
domena.pl        text = "v=spf1 a mx ptr ip4:XXX.XXX.XXX.XXX ~all"
Name:   domena.pl
Address: XXX.XXX.XXX.XXX
domena.pl
        origin = ns1.domena.pl
        mail addr = root.domena.pl
        serial = 2014040901
        refresh = 7200
        retry = 3600
        expire = 1209600
        minimum = 86400
domena.pl        nameserver = ns2.domena.pl.
domena.pl        nameserver = ns3.domena.pl.
domena.pl        nameserver = ns1.domena.pl.
domena.pl        rdata_99 = "v=spf1 a mx ptr ip4:XXX.XXX.XXX.XXX ~all"
domena.pl        mail exchanger = 10 mail.domena.pl.

Authoritative answers can be found from:

Pozdrawiam.
WOJO