Extend DNS monitoring with DNS status

[Don]

Please, consider extending DNS monitoring with

• request of particular domain and request type (A, PTR, SOA, etc);

• also check reply flags, such as aa (authoritative answer) an ra (recursion available).

Rationale:

• aa flag will allow monitoring of correctness of authoritative DNSes for particular domains. For example, sometimes zone is deleted, but, because, server allows recursion it still returns dns reply for requested zone, taking it from secondary until it's suddenly expired (after several weeks). But, it will be without aa flag in such case.

• ra flag will allow testing if recursion is still working in setups where servers both authoritative and recursive from intranet, and absence of ra with requests from Internet.

[Don]

Also, for completeness, it would be also useful for someone to be able to

• verify request status (NOERROR, REFUSED, NXDOMAIN, and SERVFAIL). For example, NXDOMAIN is useful to check that nobody is added wildcard record * into zone.

• To above mentioned reply flags, also flags ad (authenticated data) and cd (checking disabled) could be added, to allow particular checks for DNSSEC setups.

• And finally, to allow and disallow additional request parameters, like [no]recursion, [no]cdflags, [no]dnssec (from man dig).

But, these are probably much less useful in general than options mentioned in the first post.

[Andreas]

I can't wait this feature to get implemented.

[Andreas]

just for reference to anyone desiring granular dns checking: i’ve configured dns response check by generic protocol checker:

if failed host 127.0.0.1 port 53 type udp
  send "\0x00\0x01\0x01\0x00\0x00\0x01\0x00\0x00\0x00\0x00\0x00\0x00\0x09localhost\0x00\0x00\0x01\0x00\0x01"
  expect "^[\\]0^A[\0x80-\0xFF].[\\]0^A[\\]0^A.*^Ilocalhost[\\]0[\\]0^A[\\]0^A.*[\\]0^A[\\]0^A([\\]0|.){4}[\\]0^D^?[\\]0[\\]0^A"

^A denoting char 0x01 (a 0x01 byte literally written in the config file), ^B is 0x02, ..., ^? is 0x7F, and the [\\]0 sequence is a trick to match to NUL byte in the read buffer.

explanation

send

• \0x00 \0x01 – XID (arbitrary)
• \0x01 \0x00 – flags (recursion desired)
• \0x00 \0x01 – num of queries
• \0x00 \0x00 – num of answers
• \0x00 \0x00 – num of authority answers
• \0x00 \0x00 – num of additional answers
• \0x09 “localhost” \0x00 – (query section) query “localhost.” domain name
• \0x00 \0x01 – query record type A
• \0x00 \0x01 – query in class IN

expect

• 0x00 0x01 – XID (should be the same as in query)
• [0x80-0xFF]. – flag: first byte most significant bit must 1 (denoting response message), second byte anything
• 0x00 0x01 – num of queries
• 0x00 0x01 – num of answers
• .* – here can be anything (num of records in other sections, section data)
• 0x09 “localhost” 0x00 – (probably in the answer section) “localhost.” was queried
• 0x00 0x01 – record type A was queried
• 0x00 0x01 – class IN was queried
• .* – any data (maybe other sections)
• 0x00 0x01 – answer record has type A
• 0x00 0x01 – answer record is in class IN
• (0x00|.){4} – 4 bytes for any TTL
• 0x00 0x04 – following address is 4 bytes long
• 0x7E 0x00 0x00 0x01 – “127.0.0.1”