FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Intermediate

How do I health check DNS servers? ​

Short answer

A Health Checks profile is created with Check Type set to DNS: a name that the server must answer is written in the Query field and DNS Record Type is selected (default A). With Answer Check Mode, a specific text (Text Match (Contains)) or a regular expression (Regex Match) can be searched for in the answer; with the default None, receiving an answer is sufficient. For the Backend Service whose address is the DNS server's IP and port 53, the profile is selected in the Health Check field. The same settings are made in WEB-CLI with the lb hc add command by writing checkType dns.

Problem: The DNS Server Is Up but Does Not Respond Correctly ​

Port 53 of a DNS server being open does not mean that it responds correctly: the zone may not be loaded, recursive resolution may be broken, or a wrong record may be returned. If only a port check is performed, the server that responds incorrectly continues to receive traffic. The health check needs to send a real query and verify the answer.

Solution: 2 Methods ​

The two methods create the same profile from different interfaces.

Your situationSuitable method
I create the profile from the interfaceMethod 1: DNS profile
I create the profile from WEB-CLIMethod 2: WEB-CLI
  • How it works The specified query is sent to the address and port of the Backend Service; if no answer can be received, if the name cannot be found (NXDOMAIN), or if the expected text or pattern is not in the answer, the check fails.
  • Where it is openedLoad Balancer → Profiles → Health Checks → Add → Check Type: DNS
  • Requirement The queried name must be resolvable on this server; a Backend Service whose address is the DNS server's IP and port 53
  • vService type All; if DNS traffic is to be balanced over UDP, a Network vService (UDP - L4) is used, and the health status is reflected in distribution while Port Range is off

Step-by-Step Configuration ​

1
Adım 1 Open the Health Checks screen

The Configuration Menu is opened with the TR7 logo at the bottom left; the Load Balancer → Profiles → Health Checks path is followed and Add is clicked (How to add?).

2
Adım 2 Enter the name and type

The profile name is written in the Name field; in the Check Type field, DNS is selected. The type cannot be changed after saving.

3
Adım 3 Define the query

The name to be queried is written in the Query field (e.g. portal.example.com); the record type is selected from the DNS Record Type list: A (default), AAAA, CAA, CNAME, MX, NAPTR, NS, PTR, SOA, SRV, TXT. For a reverse query, Reverse DNS (PTR) is turned on and an IP is written in the Query field; in this case, the record type field is hidden.

4
Adım 4 Select the answer check

In the Answer Check Mode field, Text Match (Contains) is selected and the expected value (e.g. 192.0.2.21) is written in the Expected Answer Text field; if an exact match is required, Regex Match is selected and the pattern (e.g. "192\.0\.2\.21") is written in the Expected Answer Regex field. With the default None, receiving an answer is sufficient.

5
Adım 5 Save the profile

The Add button is clicked.

6
Adım 6 Open the Backend Service form

The Load Balancer → Backend Services path is followed; the Backend Service whose address is the DNS server's IP and port 53 is right-clicked and Edit is selected.

7
Adım 7 Select the profile

The DNS profile is selected in the Health Check field.

8
Adım 8 Save

The Edit button is clicked. In a cluster, the change is transferred to the peer device automatically by default; if Manual Sync Mode is on, it is sent with Synchronize.

Verification ​

1DNS answerBackend Service preview

The DNS Answers row in the Details tab of the preview shows the answer received in the last check (Details rows).

ExpectedDNS Answers: 192.0.2.21 · OK (green)
2Result historyHealth Checks tab

In the Health Checks tab in the preview, the record summary contains the check type, the duration and the DNS answers; a new record is written when the answer changes.

ExpectedOK · DNS / 2ms / 192.0.2.21

Method 2: WEB-CLI ​

  • How it works The DNS profile is created with the lb hc add command by writing checkType dns and is assigned to the Backend Service with lb backend update; query is required in the dns type, dnsTextToExpect becomes required when --dnsExpectType text is written, and both are written without a prefix.
  • Where it is opened WEB-CLI → lb hc add · lb backend update (lb hc · The DNS Fields)
  • Requirement WEB-CLI access; the Backend Service ID (lb backend list)
  • vService type All

Step-by-Step Configuration ​

1
Adım 1 Create the profile
text
lb hc add checkType dns name dns-denetimi query portal.example.com --rrType A --dnsExpectType text dnsTextToExpect 192.0.2.21
2
Adım 2 Assign the profile

The profile ID is taken from the lb hc list output:

text
lb backend update id <backend-id> --hc <profile-id>

Verification ​

1Health statusBackend Services list

The indicator in the Health column of the Backend Services list is checked (Health status indicator).

ExpectedOK (green)

Common Mistakes ​

  • Overlooking partial matches. Text Match (Contains) searches within the answer; a search for 192.0.2.2 also matches the answer 192.0.2.21. For an exact match, the value is written with its quotes in Regex Match ("192\.0\.2\.21"); answers are compared in the ["192.0.2.21"] form, and Regex Match is case-insensitive.
  • Querying a name the server cannot resolve. The name must be in a zone for which the server is authoritative, or the server must perform recursive resolution for TR7's source address.
  • Leaving the Backend Service port other than 53. The query goes to the port of the Backend Service.
  • Settling for a port check only. A UDP or TCP port check does not show that the DNS service responds correctly.

How it is done in the documentation

Related questions