freeipa

#6066 Creation of new DNS zone without A records fails with "zone example.com/IN: not loaded due to errors"
Closed: wontfix by rcritten. Opened by pvoborni.

Closed: wontfix
Reopen Issue

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 7): Bug 1353940

Description of problem:
As posted on idm-tech 2016-07-08:
Brand new RHEL 7.2 IdM install for the domain ipa.example.com.  I just added a
new DNS zone for "example.com" via the Web UI, which automatically creates the
"@" NS record and the "_kerberos" TXT record., but neither is resolvable via
'dig' from the command line.  Running 'rndc reload' and watching the logs, I
see the following:
"""
zone example.com/IN: not loaded due to errors
...
zone example.com/IN: NS 'idm-1.ipa.example.com' has no address records (A or
AAAA)
"""
Once I manually create an A record (glue record) for "idm-1.ipa" in the
"example.com" zone, everything works as expected.  But there was no indication
that this is a necessary step.
Version-Release number of selected component (if applicable):
RHEL 7.2
How reproducible:
100% Repeatable
Steps to Reproduce:
1. Install new IPA environment ipa.example.com
2. Create new DNS zone example.com
3. dig -tNS example.com
Actual results:
dig cannot resolve the NS record for example.com, for two reasons:  there is no
glue record to direct to the child domain where the ns server lives, and the
zone will not load until an A record is included.
Expected results:
Server should be able to properly return address of NS server for example.com
Additional info:

Proper integration with external DNS will require proper name->zone mapping.

Metadata Update from @pvoborni:
- Issue assigned to someone
- Issue set to the milestone: FreeIPA 4.5 backlog

From the BZ:

The issue is that when A records doesn't exist. IPA automatically adds A records for masters, clients, replicas when a zone has it enabled.

The problem here is that the A record is in zone not controlled by IPA and then it depends which NS updates are enabled.

IdM documentation says that this is one of the things to configure in outside DNS systems when configuring IPA.

https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/linux_domain_identity_authentication_and_policy_guide/installing-ipa#dns-reqs

Metadata Update from @rcritten:
- Custom field blocking reset (from 4424)
- Issue close_status updated to: wontfix
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
Normal
defect
DNS
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.