[Samba] IPv6 DNS Confusion

[Christopher Roberts]

I am using Samba 4.2.2 with Internal DNS.

I haven't deliberately set up IPv6, but I know our ISP allocates us a 64 block and auto-configuration seems to be doing the rest. Generally machines seem to be able to ping using IPv6 and Windows seems to be using that by default.

But looking in DNS there seem to be around 100 IPv6 addresses showing for the domain controller server, which surely cannot be healthy? And hundreds more with the hostname "(same as parent folder)".

Is this normal or is there something I should be doing to correct this?

Thanks,

Chris.

[David Holder]

Hi Chris,

This sounds like a bug and a configuration issue ;-) .

You are correct your domain controller IPv6 address should not change.

Is your /64 a static prefix that does not change with time? If it is,
then this probably means that you have temporary addresses configured on
your DC. Either scenarios are likely to cause a DNS update and add new
records. The old records should be deleted first. However, there are
issues with DDNS in the Samba Internal DNS server. This could be the
reason that they are not being deleted and old records remain in in DNS.
This is a bad thing. It is likely that this will not be a problem if you
were using BIND.

There are some IPv6/DNS related patches coming up but I suspect that
they might not fix this problem.

In the first instance, I would make sure that you have static addresses
on your DC and manually remove the old addresses.

Be aware then when deleting IPv6 addresses in DNS using the samba-tool
you cannot use the canonical form of the IPv6 address, you must write it
out in full. See my presentation from Samba XP 2015 at
http://www.ipv6consultancy.com/ipv6blog/?p=100.

I am out of the office for a while but when I get back I will take a
look at this.

Best Regards,
David
------------------------------------------------------------------------
Dr David Holder CEng FIET MIEEE

Erion Ltd, An Cala, Inverkirkaig, Lochinver, Sutherland, IV27 4LR, UK

Reception: [phone]

Direct Dial: [phone]

http://www.erion.co.uk


Registered in England and Wales. Registered Number 3521142
Registered Office: Newtons, 49 Coniscliffe Road, Darlington, County
Durham, DL3 7EH, UK
VAT Number: GB 698 3633 78

Post by Christopher Roberts
I am using Samba 4.2.2 with Internal DNS.
I haven't deliberately set up IPv6, but I know our ISP allocates us a 64 block and auto-configuration seems to be doing the rest. Generally machines seem to be able to ping using IPv6 and Windows seems to be using that by default.
But looking in DNS there seem to be around 100 IPv6 addresses showing for the domain controller server, which surely cannot be healthy? And hundreds more with the hostname "(same as parent folder)".
Is this normal or is there something I should be doing to correct this?
Thanks,
Chris.

[Christopher Roberts]

David

Thank you so much for your reply and my apologies for the lack of an
acknowledgment, whilst I made the necessary changes.

Post by David Holder
Is your /64 a static prefix that does not change with time?

Yes.

Post by David Holder
If it is,
then this probably means that you have temporary addresses configured
on your DC. Either scenarios are likely to cause a DNS update and add
new records. The old records should be deleted first. However, there
are issues with DDNS in the Samba Internal DNS server. This could be
the reason that they are not being deleted and old records remain in in

DNS.

Post by David Holder
This is a bad thing. It is likely that this will not be a problem if
you were using BIND.

So would you recommend moving over to BIND?

Post by David Holder
In the first instance, I would make sure that you have static
addresses on your DC and manually remove the old addresses.

Okay, that's done.

Post by David Holder
Be aware then when deleting IPv6 addresses in DNS using the samba-tool
you cannot use the canonical form of the IPv6 address, you must write
it out in full. See my presentation from Samba XP 2015 at
http://www.ipv6consultancy.com/ipv6blog/?p=100.

I used the Windows MMC DNS snap in, and deleted all the relevant records in
one hit. Seems to have worked, at least no obvious issues so far and I seem
to be pinging happily via ipv6 now.

Thank you so much for your help.

Kind regards,

Chris.