After named-pkcs11.service being restarted, the PTR record is
resolvable via "nslookup" or "host".
On Tue, Dec 14, 2021 at 2:17 PM Kathy Zhu <kzhu(a)nuro.ai> wrote:
Thank you for your reply.
I looked it up using both "nslookup" and "host" commands.
Adding idnsname=90.91 filter did not get me wanted results:
# ldapsearch -Y GSSAPI -b
SASL/GSSAPI authentication started
SASL username: admin(a)EXAMPLE.COM
SASL SSF: 256
SASL data security layer installed.
# extended LDIF
# base <idnsname=0.10.inaddr.arpa.,cn=dns,dc=example,dc=com> with scope
# filter: idnsname=90.91
# requesting: ALL
# search result
result: 32 No such object
# numResponses: 1
I do not know the history of using xxx.xxx format reverse zones instead of discrete
zones, I will suggest the team use discrete zones instead.
For my learning, I wish someone could explain why xxx.xxx format reverse
zones do not work.
On Tue, Dec 14, 2021 at 12:20 PM Rob Crittenden <rcritten(a)redhat.com>
> Kathy Zhu via FreeIPA-users wrote:
> > Hi List,
> > I created a PTR record "90.91" in "0.10.inaddr.arpa." zone
via GUI, then
> > found:
> > 1, I can see the record via GUI
> > 2, When I looked it up on the command line, I got "not found:
> How did you look?
> > 3, Its dn is not in "ldapsearch -Y GSSAPI -b
> > idnsname=0.10.inaddr.arpa.,cn=dns,dc=example,dc=com" output.
> You can add the target idnsname=90.91, e.g.
> ldapsearch -Y GSSAPI -b
> idnsname=0.10.inaddr.arpa.,cn=dns,dc=example,dc=com idnsname=90.91
> > Above 3 explained why the record could not be resolved. However, why
> > does this happen? I can see the record in GUI, where is this record?
> I'm not a DNS expert by far, but this format looks a bit off. I tend to
> be simplistic and have actual zones for each reverse, so I'd have
> created 91.0.10.inaddr.arpa. and added 90 to it.
> I was able to duplicate what you see though using the ##.## format.
> So I don't know if what you're doing is wrong or if it's something in
> bind-dyndb-ldap, but having discrete zones is a workaround.
> > I created more PTR records for testing, they are all the same way - can
> > be seen in GUI, but not resolvable and not in ldapsearch output.
> > Any idea for me to troubleshoot this?
> > Many thanks.
> > Kathy
> > _______________________________________________
> > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> > To unsubscribe send an email to
> > Fedora Code of Conduct:
> > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> > Do not reply to spam on the list, report it: