Did you select mDNS’s TLD .local on purpose? Or was this an inheritance.

In that case I don’t know how to help (but someone else might). As per https://tools.ietf.org/html/rfc6762 .local isn’t supposed to be used the way you are using it at this time, and it will conflict with pretty much any standard system. I don’t know how to patch/override that without breaking a whole lot of other systems.

Your specific issue might not be because the .local TLD, but .local is a special ‘reserved’ name for multicast DNS. You can use any other (including fake) TLD that is not registered. There are some other TLDs that are ’special’, like the one used for reverse-IP records in APIPA. Best to avoid such things as not all network software takes care of those special names the way they should. Some hosts might treat .local special and ignore DNS servers or DNS query responses that are not from mDNS. Some hosts might first query DNS and then mDNS, some might do it the other way around. Some systems disable mDNS or .local mDNS if a static .local zone is detected which breaks Bonjour and ZeroConf in most configurations. In my experience, mixing mDNS and DNS by introducing a .local is just going to create more problems. I would suggest registering a DNS name but not using it externally, just internally. For example, you could take something like my-internal-domain.net <http://my-internal-domain.net/> but simply not host anything externally and remove all records, maybe even disable name servers. There probably are better conventions for this, but using a ‘real’ (but dead to the outside) has served me well. Multiple subdomains shouldn’t be a problem, but there probably are limits to the depth of subzones. For my setups, I usually don’t go deeper than 2 levels, i.e. sub1.sub0.ipa.net <http://sub1.sub0.ipa.net/>;. I do tend to make dedicated subzones with NS delegations when I go deeper than 1 level, but in theory, if you only have 1 sublevel, you can leave it as-is and IPA will register your hosts with a dot in the name in the record effectively creating a virtual subzone. There is nothing bad about that, but depending on the management functionaliteit you are trying to create your needs may call for a different setup. One of the important parts of domain naming isn’t as much about IPA’s idea on domains, but very much depends on how kerberos likes names. So if you can’t provide a strong enough guideline in the IPA community or documentation, try the ones for Kerberos (which IPA uses): https://web.mit.edu/kerberos/krb5-1.12/doc/admin/realm_config.html <https://web.mit.edu/kerberos/krb5-1.12/doc/admin/realm_config.html> The same can be (partially) said about Microsof’s AD naming suggestions, as their system also depends on correct naming, uses Kerberos and uses SRV records to find the correct servers for services: https://social.technet.microsoft.com/wiki/contents/articles/34981.active-... <https://social.technet.microsoft.com/wiki/contents/articles/34981.active-... One of the quotes from the above sources: Other sources condense the suggestions into: John

btw, i've created a new machine with following settings , by abandoning the ".local" TLD Hostname : testing-infra-01-dal1.testing.stg.avtar.test realm_name: avtar.test domain_name: avtar.test But still getting the same error as below +++++++++++++++++++++++++++++++ ipapython.dnsutil: ERROR DNS query for testing-infra-01-dal13.testing.stg.avtar.test.1 failed: All nameservers failed to answer the query testing-infra-01-dal13.testing.stg.avtar.test. IN A: Server 127.0.0.1 UDP port 53 answered SERVFAIL ipaserver.dns_data_management: ERROR unable to resolve host name testing-infra-01-dal13.testing.stg.avtar.test. to IP address, ipa-ca DNS record will be incomplete ++++++++++++++++++++++++++++++++++++ And The entry in resolv.conf is as below search avtar.test nameserver 127.0.0.1 +++++++++++++++++++++++++++++++ But if i give "testing.stg.avtar.test" as my domain & realm name then things just work fine without any errors. Any comments on this behaviour , why is it working in this case??

Thanks Alexander for such a nice explanation. I've a follow-up thing to ask , i understood your point that if i'm using primary domain and realm as "avtar.test" then .stg.avtar.test and .testing.stg.avtar.test are two DNS zones nested within avtar.test. and the integrated DNS in IPA master doesnt know anything about the sub-domains hence it is unable to resolve hostname "testing-infra-01-dal13.testing.stg.avtar.test" But if i install Bind DNS server separately and configure "zone" as below well in this case BIND server is able to provide resolution for server "testing-infra-01-dal13.testing.stg.avtar.test" as its configured as "A record" in "/etc/bind/avtar.test" file. Please help in understand this variation in behaviour of Bind Server VS IDM integrated DNS. I mean is it something that BIND server can do resolution of its child domains implicitly whereas that is something not supported by IDM integrated DNS . Why there is not need in BIND server to configure sub domains of "avtar.test" domain. Kindly help. +++++++++++++++++++++++++++++ zone "avtar.test" IN { type master; file "/etc/bind/avtar.test"; }; +++++++++++++++++++++++++++++

Thanks you Alexander. Since you represent Redhat team , i couldnt resist myself from asking below two questions as well . it would be great if you can provide guidance/suggestion on these too 1) We've a cloud environment , where updating resolv.conf file for accommodating our IDM DNS server entry is not recommended , though i've come across forums where people talk about applying the "chattr" command which will make resolv.conf as readonly but i refrain from doing that ,as its not a wise thing to do in cloud env. Hence as per your experience please share what should be our approach for configuring Redhat IDM DNS without changing the cloud provided resolv.conf . 2) I've gone through the docs for integrated Vault as part of IDM solution but didnt find enough detail like how under the hood data is getting stored securely in vault , how the security of secrets/data handled within vault provided by IDM . And is it recommended to use the integrated IDM vault for production grade env , i mean is it safe to do that ? please suggest

ok thanks but we're kind of new to DNS zone deployment . Though i will search on google but thought of getting any direct pointers from your end that how to configure/setup Many thanks for responding & helping us...it means a lot.