# DNS Fix — BIND Localhost Only (Spamhaus Blacklist Problem)

**Datum:** 14. April 2026, 22:44 CEST  
**Server:** server.konoba.hr (91.98.172.231)  
**Problem:** IP na Spamhaus ZEN blacklist zbog "open resolver"

---

## Problem

BIND (named) je slušao na javnom IP-u (91.98.172.231:53), što Spamhaus detektira kao sigurnosni rizik → IP blacklistan.

```
Spamhaus reason: "Error: open resolver"
Listed on: SBL, XBL, PBL
```

---

## Rješenje

Ograničiti BIND da sluša **samo na localhost** (127.0.0.1).

### Backup

```bash
sudo cp /etc/named.conf /etc/named.conf.backup-20260414-224421
```

✅ Backup: `/etc/named.conf.backup-20260414-224421`

### Promjena Konfiguracije

**File:** `/etc/named.conf`

**Promijenjeno:**
```
listen-on port 53 { any; };       →  listen-on port 53 { 127.0.0.1; };
allow-query { any; };             →  allow-query { localhost; };
```

**Команда:**
```bash
sudo sed -i 's/listen-on port 53 { any; };/listen-on port 53 { 127.0.0.1; };/' /etc/named.conf
sudo sed -i 's/allow-query     { any; };/allow-query     { localhost; };/' /etc/named.conf
```

### Restart

```bash
sudo named-checkconf           # Syntax check
sudo systemctl restart named
sudo systemctl status named
```

✅ Status: **active (running)**

---

## Verifikacija

### Test localhost
```bash
dig @127.0.0.1 konoba.hr
```
✅ **Radi**

### Test javni IP
```bash
dig @91.98.172.231 konoba.hr
```
✅ **Timeout** (očekivano - zatvoren)

### Port Binding
```bash
sudo netstat -tulpn | grep ":53 "
```
```
tcp  127.0.0.1:53   LISTEN   named
tcp6 ::1:53         LISTEN   named
udp  127.0.0.1:53            named
udp6 ::1:53                  named
```

✅ **Samo localhost** — javni IP (91.98.172.231) nije na popisu

---

## Rezultat

- ✅ BIND sluša samo na localhost
- ✅ CWP Pro DNS radi (koristi localhost)
- ✅ Javni DNS zatvoren → Spamhaus razlog nestaje
- ✅ Cloudflare i dalje autoritativni NS za konoba.hr

---

## Spamhaus Delisting

**Automatski:** Za 24-48h Spamhaus bi trebao maknuti IP s liste (periodic rescan).

**Ručno:** 
1. https://www.spamhaus.org/lookup/
2. Unesi IP: `91.98.172.231`
3. Ako još listed → klikni delisting request link

---

## Rollback (ako nešto ne radi)

```bash
sudo cp /etc/named.conf.backup-20260414-224421 /etc/named.conf
sudo systemctl restart named
```

---

**Status:** ✅ **RIJEŠENO** (14.04.2026 22:44)  
**Impact:** CWP radi, Spamhaus razlog eliminiran