RTFM · Healthchecks
lb.saphira.dns: does it actually answer for this name?
A DNS server that accepts packets but answers garbage is worse than one that is down. This check asks a real question, "where is this name?", and verifies the answer is genuinely yours: correct transaction ID, correct response flag, and the RCODE you asked for.
What it proves
A full DNS transaction: query built, response received, and three things verified; the transaction ID matches (no spoofed or stray answer), the QR bit says this really is a response, and the RCODE equals the one you demanded (NOERROR by default). Optional regex over the raw response bytes can assert a specific record is present.
How it works
The probe engine builds the query packet itself (name compression-free encoding, random transaction ID); no resolver library, no system cache: exactly one clean transaction against the target. Default transport is UDP; LB_SAPHIRA_DNS_TCP=1 switches to TCP with proper length-prefix framing.
Configuration
| Variable | Default | Meaning |
|---|---|---|
| LB_SAPHIRA_DNS_NAME | (required) | The name to ask for: without it the check exits 2 |
| LB_SAPHIRA_DNS_TYPE | 1 | Query type: 1 = A, 28 = AAAA (any IANA number) |
| LB_SAPHIRA_DNS_RCODE | 0 | Expected RCODE: 0 NOERROR, 3 NXDOMAIN is a legitimate answer for existence tests |
| LB_SAPHIRA_DNS_TCP | 0 | 1 = query over TCP |
| LB_SAPHIRA_DNS_EXPECT | - | Regex over the raw response (e.g. a specific address or record data) |
| LB_SAPHIRA_TIMEOUT | 3 | Transaction deadline |
Wiring it up
# ldirectord.cf
virtual = 203.0.113.53:53
protocol = udp
scheduler = wlc
real = 192.168.20.53:53 gate 1
real = 192.168.20.54:53 gate 1
checktype = external
checkcommand = "/var/lib/lb/saphira/lb.saphira.dns"# /etc/saphira/lb-healthchecks.d/dns.conf
LB_SAPHIRA_DNS_NAME=pacs.internal.example
LB_SAPHIRA_DNS_TYPE=28Run it by hand
LB_SAPHIRA_DNS_NAME=example.org /var/lib/lb/saphira/lb.saphira.dns dns-pool 53 192.168.20.53 53
echo $?
# 0 = matched ID/QR/RCODE answer came back
# 1 = timeout, wrong ID/QR, or unexpected RCODE
# 2 = no query name configuredFailure modes
- Timeout: the resolver is wedged, dropping packets, or an ACL is blocking the director
- Wrong RCODE: SERVFAIL under load is the classic overloading symptom; this check sees it before users do
- ID/QR mismatch: something between you and the server is answering with someone else's traffic
Did we miss something?
If this page left something unanswered, found an error, or there is another subject you would like documented, tell us. Saphira’s documentation grows from real problems people need to solve.
Send feedback or request a new section →
Prefer not to do it yourself?
Everything needed to do the work yourself is documented here and remains free; we charge for human time, not for withholding knowledge. Sometimes the missing resource is simply time. The same people who build Saphira can provide paid professional help with implementation, migration, troubleshooting and administration.