Stikked
Nicolai Langfeldt (dns-howto(at)langfeldt.net), Jamie
HOWTO become a totally small time DNS
______________________________________________________________________
______________________________________________________________________
Table of
1.
1.1 Legal
1.2 Credits and request for
1.3
1.4 Updated
2.
2.1 Other nameserver
3. A resolving, caching name
3.1 Starting
3.2
3.3
4.
5.
5.1 But first some dry
5.2 Our own
5.3 The reverse
5.4 Words of
5.5 Why reverse lookups don't
5.5.1 The reverse zone isn't
5.5.2 You've got a classless
5.6 Slave
6. Basic security
6.1 Restricting zone
6.2 Protecting against
6.3 Running named as
7. A real domain
7.1 /etc/named.conf (or /var/named/named.
7.2 /var/named/root.
7.3 /var/named/zone/127.0.
7.4 /var/named/zone/land-5.
7.5 /var/named/zone/206.6.
8.
9. Migrating to BIND
10. Questions and
11. How to become a bigger time DNS
______________________________________________________________________
______________________________________________________________________
1.
Keywords: DNS, BIND, BIND 4, BIND 8, BIND 9, named, dialup, PPP,
ISDN, Internet, domain, name, resolution, hosts,
This document is part of the Linux Documentation
1.1. Legal
(C)opyright 1995-2001 Nicolai Langfeldt, Jamie Norrish
modify without amending copyright, distribute freely but
copyright
1.2. Credits and request for
I want to thank all the people that I have bothered with reading
HOWTO (you know who you are) and all the readers that have
suggestions and
This will never be a finished document; please send me mail about
problems and successes. You can help make this a better HOWTO.
please send comments and/or questions or money
janl(at)langfeldt.net. Or buy my DNS book (it's titled
Guide to DNS and BIND, the bibliography has ISBNs). If you send
mail and want an answer please show the simple courtesy of making
that the return address is correct and working. Also, please read
``qanda'' section before mailing me. Another thing, I can
understand Norwegian and
This is a HOWTO. I have maintained it as part of the LDP since
I have, during 2000, written a book on the same subject. I want
say that, though this HOWTO is in many ways much like the book it
not a watered down version concocted to market the book. The
of this HOWTO have helped me understand what is difficult
understand about DNS. This has helped the book, but the book has
helped me to think more about what this HOWTO needs. The HOWTO
the book. The book begot version 3 of this HOWTO. My thanks to
book publisher, Que, that took a chance on me
1.3.
This HOWTO is dedicated to Anne Line Norheim Langfeldt. Though
will probably never read it since she's not that kind of
1.4. Updated
You should be able to find updated versions of this HOWTO both
<http://langfeldt.net/DNS-HOWTO/>
<http://langfeldt.net/DNS-HOWTO/> and on
Go there if this document is dated more than 9 months
2.
What this is and
DNS is the Domain Name System. DNS converts machine names to the
addresses that all machines on the net have. It translates (or
as the jargon would have it) from name to address and from address
name, and some other things. This HOWTO documents how to define
mappings using Unix system, with a few things specific to
A mapping is simply an association between two things, in this case
machine name, like ftp.linux.org, and the machine's IP number
address) 199.249.150.4. DNS also contains mappings the other
from the IP number to the machine name; this is called a
mapping".
mapping".
DNS is, to the uninitiated (you ;-), one of the more opaque areas
network administration. Fortunately DNS isn't really that hard.
HOWTO will try to make a few things clearer. It describes how to
up a simple DNS name server, starting with a caching only server
going on to setting up a primary DNS server for a domain. For
complex setups you can check the ``qanda'' section of this
If it's not described there you will need to read the
Documentation. I'll get back to what this Real Documentation
of in ``the last
Before you start on this you should configure your machine so that
can telnet in and out of it, and successfully make all kinds
connections to the net, and you should especially be able to do
127.0.0.1 and get your own machine (test it now!). You also need
/etc/nsswitch.conf, /etc/resolv.conf and /etc/hosts files as
starting point, since I will not explain their function here. If
don't already have all this set up and working the
and/or the Networking-Overview-HOWTO explains how to set it up.
them.
them.
When I say `your machine' I mean the machine you are trying to set
DNS on, not any other machine you might have that's involved in
networking
I assume you're not behind any kind of firewall that blocks
queries. If you are you will need a special configuration --- see
section on
Name serving on Unix is done by a program called named. This is
part of the ``BIND'' package which is coordinated by The
Software Consortium. Named is included in most Linux
and is usually installed as /usr/sbin/named, usually from a
called BIND, in upper or lower case depending on the whim of
packager.
packager.
If you have a named you can probably use it; if you don't have one
can get a binary off a Linux ftp site, or get the latest and
source from
version 9. The old versions of the HOWTO, about BIND 4 and 8,
still available at
BIND 4 or 8 (incidentally, you will find this HOWTO there too).
the named man page talks about (at the very end, in the FILES
named.conf you have BIND 8; if it talks about named.boot you have
4. If you have 4 and are security conscious you really ought
upgrade to the latest version of BIND 8.
DNS is a net-wide database. Take care about what you put into it.
you put junk into it, you, and others, will get junk out of it.
your DNS tidy and consistent and you will get good service from
Learn to use it, admin it, debug it and you will be another good
keeping the net from falling to its knees by
Tip: Make backup copies of all the files I instruct you to change
you already have them, so that if after going through this
works you can get it back to your old, working
2.1. Other nameserver
This section was written by Joost van
Various packages exist for getting a DNS server on your box. There
the BIND package (
implementation this HOWTO is about. It's the most popular
around and it's used on the vast majority of name serving machines
the Internet, around and being deployed since the 1980's.
available under a BSD license. Since it's the most popular
loads of documentation and knowledge about BIND is around.
there have been security problems with
Then there is djbdns (
package written by Daniel J. Bernstein, who also wrote qmail. It's
very modular suite: various small programs take care of the
jobs a nameserver is supposed to handle. It's designed with
in mind. It uses a simpler zone-file format, and is generally
to configure. However, since it's less well known, your local
might not be able to help you with this. Unfortunately, this
is not Open Source. The author's advertisement is
<http://cr.
<http://cr.yp.to/djbdns/ad.
Whether DJBs software is really an improvement over the
alternatives is a subject of much debate. A discussion (or is it
flame-war?) of BIND vs djbdns, joined by ISC people, is
<http://www.
<http://www.isc.org/ml-archives/bind-users/2000/08/msg01075.
3. A resolving, caching name
A first stab at DNS config, very useful for dialup, cable-modem,
and similar
On Red Hat and Red Hat related distributions you can achieve the
practical result as this HOWTO's first section by installing
packages bind, bind-utils and caching-nameserver. If you use
simply install bind (or bind9, as of this writing, BIND 9 is
supported by Debian Stable (potato)) and bind-doc. Of course
installing those packages won't teach you as much as reading
HOWTO. So install the packages, and then read along verifying
files they
A caching only name server will find the answer to name queries
remember the answer the next time you need it. This will shorten
waiting time the next time significantly, especially if you're on
slow
First you need a file called /etc/named.conf
/etc/bind/named.conf). This is read when named starts. For now
should simply
______________________________________________________________________
______________________________________________________________________
// Config file for caching only name
//
//
// The version of the HOWTO you read may contain leading
// (spaces in front of the characters on these lines ) in this
// other files. You must remove them for things to
//
//
// Note that the filenames and directory names may differ,
// ultimate contents of should be quite similar
options
directory
// Uncommenting this might help if you have to go through
// firewall and things are not working out. But you
// need to talk to your firewall
// query-source port
};
};
controls
inet 127.0.0.1 allow { localhost; } keys { rndc_key;
};
};
key
algorithm
secret
};
};
zone
type
file
};
};
zone
type
file
};
______________________________________________________________________
};
______________________________________________________________________
The Linux distribution packages may use different file names for
kind of file mentioned here; they will still contain about the
things.
things.
The `directory' line tells named where to look for files. All
named subsequently will be relative to this. Thus pz is a
under /var/named, i.e., /var/named/pz. /var/named is the
directory according to the Linux File system
The file named /var/named/root.hints is named in
/var/named/root.hints should contain
______________________________________________________________________
;
______________________________________________________________________
;
; There might be opening comments here if you already have this
; If not don't
;
;
; About any leading spaces in front of the lines here: remove
; Lines should start in a ;, . or character, not
;
;
. 6D IN NS A.ROOT-SERVERS.
. 6D IN NS B.ROOT-SERVERS.
. 6D IN NS C.ROOT-SERVERS.
. 6D IN NS D.ROOT-SERVERS.
. 6D IN NS E.ROOT-SERVERS.
. 6D IN NS F.ROOT-SERVERS.
. 6D IN NS G.ROOT-SERVERS.
. 6D IN NS H.ROOT-SERVERS.
. 6D IN NS I.ROOT-SERVERS.
. 6D IN NS J.ROOT-SERVERS.
. 6D IN NS K.ROOT-SERVERS.
. 6D IN NS L.ROOT-SERVERS.
. 6D IN NS M.ROOT-SERVERS.
A.ROOT-SERVERS.NET. 6D IN A 198.41.0.
B.ROOT-SERVERS.NET. 6D IN A 128.9.0.
C.ROOT-SERVERS.NET. 6D IN A 192.33.4.
D.ROOT-SERVERS.NET. 6D IN A 128.8.10.
E.ROOT-SERVERS.NET. 6D IN A 192.203.230.
F.ROOT-SERVERS.NET. 6D IN A 192.5.5.
G.ROOT-SERVERS.NET. 6D IN A 192.112.36.
H.ROOT-SERVERS.NET. 6D IN A 128.63.2.
I.ROOT-SERVERS.NET. 6D IN A 192.36.148.
J.ROOT-SERVERS.NET. 6D IN A 198.41.0.
K.ROOT-SERVERS.NET. 6D IN A 193.0.14.
L.ROOT-SERVERS.NET. 6D IN A 198.32.64.
M.ROOT-SERVERS.NET. 6D IN A 202.12.27.
______________________________________________________________________
______________________________________________________________________
The file describes the root name servers in the world. The
change over time and must be maintained now and then. See
``maintenance section'' for how to keep it up to
The next section in named.conf is the last zone. I will explain
use in a later chapter; for now just make this a file named 127.0.0
the subdirectory pz: (Again, please remove leading spaces if you
and paste
______________________________________________________________________
______________________________________________________________________
$TTL
@ IN SOA ns.linux.bogus. hostmaster.linux.bogus.
1 ;
8H ;
2H ;
4W ;
1D) ; Minimum
NS ns.linux.
1 PTR
______________________________________________________________________
______________________________________________________________________
The sections called key and controls together specify that your
can be remotely controlled by a program called rndc if it
from the local host, and identifis itself with the encoded secret
This key is like a password. For rndc to work you need /etc/rndc.
to match
______________________________________________________________________
______________________________________________________________________
key rndc_key
algorithm
secret
};
};
options
default-server
default-key
};
______________________________________________________________________
};
______________________________________________________________________
As you see the secret is identical. If you want to use rndc
other machines their times need to be within 5 minutes of
I recommend using the ntp (xntpd and ntpdate) software to do
Next, you need a /etc/resolv.conf looking something like this:
Remove
______________________________________________________________________
______________________________________________________________________
search subdomain.your-domain.edu your-domain.
nameserver 127.0.0.
______________________________________________________________________
______________________________________________________________________
The `search' line specifies what domains should be searched for
host names you want to connect to. The `nameserver' line
the address of your nameserver, in this case your own machine
that is where your named runs (127.0.0.1 is right, no matter if
machine has another address too). If you want to list several
servers put in one `nameserver' line for each. (Note: Named
reads this file, the resolver that uses named does. Note 2: In
resolv.conf files you find a line saying
don't use both
To illustrate what this file does: If a client tries to look up
then foo.subdomain.your-domain.edu is tried first, then foo.
domain.edu, and finally foo. You may not want to put in too
domains in the search line, as it takes time to search them
The example assumes you belong in the domain subdomain.
domain.edu; your machine, then, is probably called
machine.subdomain.your-domain.edu. The search line should not
your TLD (Top Level Domain, `edu' in this case). If you
need to connect to hosts in another domain you can add that domain
the search line like this: (Remember to remove the leading spaces,
any)
______________________________________________________________________
any)
______________________________________________________________________
search subdomain.your-domain.edu your-domain.edu other-domain.
______________________________________________________________________
______________________________________________________________________
and so on. Obviously you need to put real domain names in
Please note the lack of periods at the end of the domain names.
is important; please note the lack of periods at the end of the
names.
names.
3.1. Starting
After all this it's time to start named. If you're using a
connection connect first. Now run named, either by running the
script: /etc/init.d/named start or named directly:
If you have tried previous versions of BIND you're probably used
ndc. I BIND 9 it has been replaced with rndc, which can controll
named remotely, but it can't start named anymore. If you view
syslog message file (usually called /var/log/messages, Debian calls
/var/log/daemon, another directory to look is the other
/var/log) while starting named (do tail -f /var/log/messages)
should see something
(the lines ending in \ continues on the next
Dec 23 02:21:12 lookfar named[11031]: starting BIND 9.1.
Dec 23 02:21:12 lookfar named[11031]: using 1
Dec 23 02:21:12 lookfar named[11034]: loading configuration from
'/etc/named.
Dec 23 02:21:12 lookfar named[11034]: the default for the
'auth-nxdomain' option is now
Dec 23 02:21:12 lookfar named[11034]: no IPv6 interfaces
Dec 23 02:21:12 lookfar named[11034]: listening on IPv4 interface lo,
127.0.0.
Dec 23 02:21:12 lookfar named[11034]: listening on IPv4 interface eth0,
10.0.0.
Dec 23 02:21:12 lookfar named[11034]: command channel listening on
127.0.0.
Dec 23 02:21:13 lookfar named[11034]:
If there are any messages about errors then there is a mistake.
will name the file it is reading. Go back and check the file.
named over when it is
Now you can test your setup. Traditionally a program called
is used for this. These days dig is
$ dig -x 127.0.0.
;; Got
;;
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL:
;; QUESTION
;1.0.0.127.in-addr.arpa. IN
;; ANSWER
1.0.0.127.in-addr.arpa. 259200 IN PTR
;; AUTHORITY
0.0.127.in-addr.arpa. 259200 IN NS ns.linux.
;; Query time: 3
;; SERVER: 127.0.0.1#53(127.0.0.
;; WHEN: Sun Dec 23 02:26:17
;; MSG SIZE rcvd:
If that's what you get it's working. We hope. Anything
different, go back and check everything. Each time you change a
you need to run rndc
Now you can enter a query. Try looking up some machine close to
pat.uio.no is close to me, at the University of
$ dig pat.uio.
;
;; global options:
;; Got
;;
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL:
;; QUESTION
;pat.uio.no. IN
;; ANSWER
pat.uio.no. 86400 IN A 129.240.130.
;; AUTHORITY
uio.no. 86400 IN NS nissen.uio.
uio.no. 86400 IN NS nn.uninett.
uio.no. 86400 IN NS ifi.uio.
;; Query time: 651
;; SERVER: 127.0.0.1#53(127.0.0.
;; WHEN: Sun Dec 23 02:28:35
;; MSG SIZE rcvd:
This time dig asked your named to look for the machine pat.uio.no.
then contacted one of the name server machines named in
root.hints file, and asked its way from there. It might take
while before you get the result as it may need to search all
domains you named in /etc/resolv.
If you ask the same again you get
$ dig pat.uio.
;
;; res options: init recurs defnam
;; got
;;
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL:
;; QUERY
;; pat.uio.no, type = A, class =
;; ANSWER
pat.uio.no. 23h59m58s IN A 129.240.130.
;; AUTHORITY
UIO.NO. 23h59m58s IN NS nissen.UIO.
UIO.NO. 23h59m58s IN NS ifi.UIO.
UIO.NO. 23h59m58s IN NS nn.uninett.
;; ADDITIONAL
nissen.UIO.NO. 23h59m58s IN A 129.240.2.
ifi.UIO.NO. 1d23h59m58s IN A 129.240.64.
nn.uninett.NO. 1d23h59m58s IN A 158.38.0.
;; Total query time: 4
;; FROM: lookfar to SERVER: default -- 127.0.0.
;; WHEN: Sat Dec 16 00:23:09
;; MSG SIZE sent: 28 rcvd:
As you can plainly see this time it was much faster, 4ms versus
than half a second earlier. The answer was cached. With
answers there is the possibility that the answer is out of date,
the origin servers can control the time cached answers should
considered valid, so there is a high probability that the answer
get is
3.2.
All OSes implementing the standard C API has the calls
and gethostbyaddr. These can get information from several
sources. Which sources it gets it from is configured
/etc/nsswitch.conf on Linux (and some other Unixes). This is a
file specifying from which file or database to get different kinds
data types. It usually contains helpful comments at the top,
you should consider reading. After that find the line starting
`hosts:'; it should
______________________________________________________________________
______________________________________________________________________
hosts: files
______________________________________________________________________
______________________________________________________________________
(You remembered about the leading spaces, right? I won't mention
again.
If there is no line starting with `hosts:' then put in the one
It says that programs should first look in the /etc/hosts file,
check DNS according to resolv.
3.3.
Now you know how to set up a caching named. Take a beer, milk,
whatever you prefer to celebrate
4.
In large, well organized, academic or ISP (Internet Service
networks you will sometimes find that the network people have set up
forwarder hierarchy of DNS servers which helps lighten the
network load and the load on the outside servers as well. It's
easy to know if you're inside such a network or not. But by using
DNS server of your network provider as a ``forwarder'' you can
the responses to queries faster and less of a load on your
This works by your nameserver forwarding queries to your
nameserver. Each time this happens you will dip into the big cache
your ISPs nameserver, thus speeding your queries up, your
does not have to do all the work itself. If you use a modem this
be quite a win. For the sake of this example we assume that
network provider has two name servers they want you to use, with
numbers 10.0.0.1 and 10.1.0.1. Then, in your named.conf file,
the opening section called ``options'', insert these
______________________________________________________________________
______________________________________________________________________
forward
forwarders
10.0.0.
10.1.0.
};
______________________________________________________________________
};
______________________________________________________________________
There is also a nice trick for dialup machines using forwarders, it
described in the ``qanda''
Restart your nameserver and test it with dig. Should still work
5. A simple
How to set up your own
5.1. But first some dry
First of all: you read all the stuff before here right? You have
Before we really start this section I'm going to serve you some
on and an example of how DNS works. And you're going to read
because it's good for you. If you don't want to you should at
skim it very quickly. Stop skimming when you get to what should go
your named.conf
DNS is a hierarchical, tree structured system. The top is written `.
and pronounced `root', as is usual for tree data-structures.
there are a number of Top Level Domains (TLDs); the best known
are ORG, COM, EDU and NET, but there are many more. Just like a
it has a root and it branches out. If you have any computer
background you will recognize DNS as a search tree, and you will
able to find nodes, leaf nodes and edges. The dots are nodes,
edges are on the
When looking for a machine the query proceeds recursively into
hierarchy starting at the root. If you want to find the address
prep.ai.mit.edu., your nameserver has to start asking somewhere.
starts by looking it its cache. If it knows the answer, having
it before, it will answer right away as we saw in the last
If it does not know it will see how closely it can match the
name and use whatever information it has cached. In the worst
there is no match but the `.' (root) of the name, and the root
have to be consulted. It will remove the leftmost parts one at
time, checking if it knows anything about ai.mit.edu., then mit.edu.
then edu., and if not that it does know about . because that was
the hints file. It will then ask a . server about prep.ai.mit.
This . server will not know the answer, but it will help your
on its way by giving a referral, telling it where to look
These referrals will eventually lead your server to a nameserver
knows the answer. I will illustrate that now. +norec means that
is asking non-recursive questions so that we get to do the
ourselves. The other options are to reduce the amount of dig
so this won't go on for too many
$ ;; Got
;;
;; flags: qr ra; QUERY: 1, ANSWER: 0, AUTHORITY: 13, ADDITIONAL:
;; AUTHORITY
. 518400 IN NS J.ROOT-SERVERS.
. 518400 IN NS K.ROOT-SERVERS.
. 518400 IN NS L.ROOT-SERVERS.
. 518400 IN NS M.ROOT-SERVERS.
. 518400 IN NS A.ROOT-SERVERS.
. 518400 IN NS B.ROOT-SERVERS.
. 518400 IN NS C.ROOT-SERVERS.
. 518400 IN NS D.ROOT-SERVERS.
. 518400 IN NS E.ROOT-SERVERS.
. 518400 IN NS F.ROOT-SERVERS.
. 518400 IN NS G.ROOT-SERVERS.
. 518400 IN NS H.ROOT-SERVERS.
. 518400 IN NS I.ROOT-SERVERS.
This is a referral. It is giving us an
"Answer section".
"Answer section". Our own nameserver refers us to a nameserver.
one at
$ dig +norec +noques +nostats +nocmd prep.ai.mit.edu. @D.ROOT-SERVERS.
;; Got
;;
;; flags: qr; QUERY: 1, ANSWER: 0, AUTHORITY: 3, ADDITIONAL:
;; AUTHORITY
mit.edu. 172800 IN NS BITSY.mit.
mit.edu. 172800 IN NS STRAWB.mit.
mit.edu. 172800 IN NS W20NS.mit.
;; ADDITIONAL
BITSY.mit.edu. 172800 IN A 18.72.0.
STRAWB.mit.edu. 172800 IN A 18.71.0.
W20NS.mit.edu. 172800 IN A 18.70.0.
It refers us to MIT.EDU servers at once. Again pick one at
$ dig +norec +noques +nostats +nocmd prep.ai.mit.edu. @BITSY.mit.
;; Got
;;
;; flags: qr ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL:
;; ANSWER
prep.ai.mit.edu. 10562 IN A 198.186.203.
;; AUTHORITY
ai.mit.edu. 21600 IN NS FEDEX.ai.mit.
ai.mit.edu. 21600 IN NS LIFE.ai.mit.
ai.mit.edu. 21600 IN NS ALPHA-BITS.ai.mit.
ai.mit.edu. 21600 IN NS BEET-CHEX.ai.mit.
;; ADDITIONAL
FEDEX.ai.mit.edu. 21600 IN A 192.148.252.
LIFE.ai.mit.edu. 21600 IN A 128.52.32.
ALPHA-BITS.ai.mit.edu. 21600 IN A 128.52.32.
BEET-CHEX.ai.mit.edu. 21600 IN A 128.52.32.
This time we got a
The
ask about ai.mit.edu the next time. So you can ask them directly
next time you wonder about ai.mit.edu names. Named also
information about mit.edu, so of www.mit.edu is requested it is
closer to being able to answer the
So starting at . we found the successive name servers for each
in the domain name by referral. If you had used your own DNS
instead of using all those other servers, your named would
cache all the information it found while digging this out for you,
it would not have to ask again for a
In the tree analogue each ``.'' in the name is a branching point.
each part between the ``.''s are the names of individual branches
the tree. One climbs the tree by taking the name we
(prep.ai.mit.edu) asking the root (.) or whatever servers father
the root toward prep.ai.mit.edu we have information about in
cache. Once the cache limits are reached the recursive resolver
out asking servers, pursuing referrals (edges) further into the
A much less talked about, but just as important domain is
addr.arpa. It too is nested like the `normal' domains. in-addr.
allows us to get the host's name when we have its address.
important thing to note here is that the IP addresses are written
reverse order in the in-addr.arpa domain. If you have the address
a machine: 198.186.203.77 named proceeds to find the
77.203.168.198.in-addr.arpa/ just like it did for prep.ai.mit.
Example: Finding no cache entry for any match but `.', ask a
server, m.root-servers.net refers you to some other root
b.root-servers.net refers you directly to bitsy.mit.edu/. You
be able to take it from
5.2. Our own
Now to define our own domain. We're going to make the
linux.bogus and define machines in it. I use a totally bogus
name to make sure we disturb no-one Out
One more thing before we start: Not all characters are allowed in
names. We're restricted to the characters of the English alphabet:
z, and numbers 0-9 and the character '-' (dash). Keep to
characters (BIND 9 will not bug you if you break this rule, BIND
will). Upper and lower-case characters are the same for DNS,
pat.uio.no is identical to Pat.UiO.
We've already started this part with this line in named.
______________________________________________________________________
______________________________________________________________________
zone
type
file
};
______________________________________________________________________
};
______________________________________________________________________
Please note the lack of `.' at the end of the domain names in
file. This says that now we will define the zone 0.0.127.
addr.arpa, that we're the master server for it and that it is
in a file called pz/127.0.0. We've already set up this file,
reads:
______________________________________________________________________
reads:
______________________________________________________________________
$TTL
@ IN SOA ns.linux.bogus. hostmaster.linux.bogus.
1 ;
8H ;
2H ;
4W ;
1D) ; Minimum
NS ns.linux.
1 PTR
______________________________________________________________________
______________________________________________________________________
Please note the `.' at the end of all the full domain names in
file, in contrast to the named.conf file above. Some people like
start each zone file with a $ORIGIN directive, but this
superfluous. The origin (where in the DNS hierarchy it belongs) of
zone file is specified in the zone section of the named.conf file;
this case it's 0.0.127.in-addr.
This `zone file' contains 3 `resource records' (RRs): A SOA RR. A
RR and a PTR RR. SOA is short for Start Of Authority. The `@' is
special notation meaning the origin, and since the `domain' column
this file says 0.0.127.in-addr.arpa the first line really
0.0.127.in-addr.arpa. IN
NS is the Name Server RR. There is no '@' at the start of this
it is implicit since the previous line started with a '@'. Saves
typing that. So the NS line could also be
0.0.127.in-addr.arpa. IN NS ns.linux.
It tells DNS what machine is the name server of the domain 0.0.127.
addr.arpa, it is ns.linux.bogus. 'ns' is a customary name for
servers, but as with web servers who are customarily
www.something. The name may be
And finally the PTR (Domain Name Pointer) record says that the host
address 1 in the subnet 0.0.127.in-addr.arpa, i.e., 127.0.0.1 is
localhost.
localhost.
The SOA record is the preamble to all zone files, and there should
exactly one in each zone file, at the top (but after the
directive). It describes the zone, where it comes from (a
called ns.linux.bogus), who is responsible for its
(hostmaster@linux.bogus; you should insert your e-mail address
what version of the zone file this is (serial: 1), and other
having to do with caching and secondary DNS servers. For the rest
the fields (refresh, retry, expire and minimum) use the numbers
in this HOWTO and you should be safe. Before the SOA comes
mandatory line, the $TTL 3D line. Put it in all your zone
Now restart your named (rndc stop; named) and use dig to examine
handy work. -x asks for the inverse
$ dig -x 127.0.0.
;; Got
;;
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL:
;; QUESTION
;1.0.0.127.in-addr.arpa. IN
;; ANSWER
1.0.0.127.in-addr.arpa. 259200 IN PTR
;; AUTHORITY
0.0.127.in-addr.arpa. 259200 IN NS ns.linux.
;; Query time: 3
;; SERVER: 127.0.0.1#53(127.0.0.
;; WHEN: Sun Dec 23 03:02:39
;; MSG SIZE rcvd:
So it manages to get localhost from 127.0.0.1, good. Now for our
task, the linux.bogus domain, insert a new 'zone' section
named.
______________________________________________________________________
______________________________________________________________________
zone
type
notify
file
};
______________________________________________________________________
};
______________________________________________________________________
Note again the lack of ending `.' on the domain name in the named.
file.
file.
In the linux.bogus zone file we'll put some totally bogus
______________________________________________________________________
;
______________________________________________________________________
;
; Zone file for linux.
;
;
; The full zone
;
;
$TTL
@ IN SOA ns.linux.bogus. hostmaster.linux.bogus.
199802151 ; serial, todays date + todays serial
8H ; refresh,
2H ; retry,
4W ; expire,
1D ) ; minimum,
;
;
NS ns ; Inet Address of name
MX 10 mail.linux.bogus ; Primary Mail
MX 20 mail.friend.bogus. ; Secondary Mail
;
;
localhost A 127.0.0.
ns A 192.168.196.
mail A 192.168.196.
______________________________________________________________________
______________________________________________________________________
Two things must be noted about the SOA record. ns.linux.bogus must
a actual machine with a A record. It is not legal to have a
record for the machine mentioned in the SOA record. Its name need
be `ns', it could be any legal host name.
hostmaster.linux.bogus should be read as hostmaster@linux.bogus.
should be a mail alias, or a mailbox, where the person(s)
DNS should read mail frequently. Any mail regarding the domain
be sent to the address listed here. The name need not
`hostmaster', it can be your normal e-mail address, but the
address `hostmaster' is often expected to work as
There is one new RR type in this file, the MX, or Mail eXchanger
It tells mail systems where to send mail that is addressed
someone@linux.bogus, namely to mail.linux.bogus or mail.friend.
The number before each machine name is that MX RR's priority. The
with the lowest number (10) is the one mail should be sent to
possible. If that fails the mail can be sent to one with a
number, a secondary mail handler, i.e., mail.friend.bogus which
priority 20
Reload named by running rndc reload. Examine the results with
$ dig any linux.
;
;; global options:
;; Got
;;
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 1, ADDITIONAL:
;; QUESTION
;linux.bogus. IN
;; ANSWER
linux.bogus. 259200 IN SOA ns.linux.bogus.
hostmaster.linux.bogus. 199802151 28800 7200 2419200
linux.bogus. 259200 IN NS ns.linux.
linux.bogus. 259200 IN MX 20 mail.friend.
linux.bogus. 259200 IN MX 10 mail.linux.bogus.linux.
;; AUTHORITY
linux.bogus. 259200 IN NS ns.linux.
;; ADDITIONAL
ns.linux.bogus. 259200 IN A 192.168.196.
;; Query time: 4
;; SERVER: 127.0.0.1#53(127.0.0.
;; WHEN: Sun Dec 23 03:06:45
;; MSG SIZE rcvd:
Upon careful examination you will discover a bug. The
linux.bogus. 259200 IN MX 10 mail.linux.bogus.linux.
is all wrong. It should
linux.bogus. 259200 IN MX 10 mail.linux.
I deliberately made a mistake so you could learn from it :-)
in the zone file we find this
MX 10 mail.linux.bogus ; Primary Mail
It is missing a period. Or has a 'linux.bogus' too many. If
machine name does not end in a period in a zone file the origin
added to its end causing the double linux.bogus.linux.bogus.
either
______________________________________________________________________
either
______________________________________________________________________
MX 10 mail.linux.bogus. ; Primary Mail
______________________________________________________________________
or
______________________________________________________________________
______________________________________________________________________
or
______________________________________________________________________
MX 10 mail ; Primary Mail
______________________________________________________________________
______________________________________________________________________
is correct. I prefer the latter form, it's less to type. There
some BIND experts that disagree, and some that agree with this. In
zone file the domain should either be written out and ended with a `.
or it should not be included at all, in which case it defaults to
origin.
origin.
I must stress that in the named.conf file there should not be `.
after the domain names. You have no idea how many times a `.'
many or few have fouled up things and confused the h*ll out of
So having made my point here is the new zone file, with some
information in it as
______________________________________________________________________
;
______________________________________________________________________
;
; Zone file for linux.
;
;
; The full zone
;
;
$TTL
@ IN SOA ns.linux.bogus. hostmaster.linux.bogus.
199802151 ; serial, todays date + todays serial
8H ; refresh,
2H ; retry,
4W ; expire,
1D ) ; minimum,
;
;
TXT
NS ns ; Inet Address of name
NS ns.friend.
MX 10 mail ; Primary Mail
MX 20 mail.friend.bogus. ; Secondary Mail
localhost A 127.0.0.
gw A 192.168.196.
TXT
ns A 192.168.196.
MX 10
MX 20 mail.friend.
www CNAME
donald A 192.168.196.
MX 10
MX 20 mail.friend.
TXT
mail A 192.168.196.
MX 10
MX 20 mail.friend.
ftp A 192.168.196.
MX 10
MX 20 mail.friend.
______________________________________________________________________
______________________________________________________________________
CNAME (Canonical NAME) is a way to give each machine several
So www is an alias for ns. CNAME record usage is a bit
But it's safe to follow the rule that a MX, CNAME or SOA record
never refer to a CNAME record, they should only refer to
with an A record, so it is inadvisable to
______________________________________________________________________
______________________________________________________________________
foobar CNAME www ;
______________________________________________________________________
______________________________________________________________________
but correct to
______________________________________________________________________
______________________________________________________________________
foobar CNAME ns ;
______________________________________________________________________
______________________________________________________________________
Load the new database by running rndc reload, which causes named
read its files
$ dig linux.bogus
;
;; global options:
linux.bogus. 259200 IN SOA ns.linux.bogus. hostmaster.linux.bogus. 199802151 28800 7200 2419200
linux.bogus. 259200 IN NS ns.linux.
linux.bogus. 259200 IN MX 10 mail.linux.
linux.bogus. 259200 IN MX 20 mail.friend.
donald.linux.bogus. 259200 IN A 192.168.196.
donald.linux.bogus. 259200 IN MX 10 mail.linux.
donald.linux.bogus. 259200 IN MX 20 mail.friend.
donald.linux.bogus. 259200 IN TXT
ftp.linux.bogus. 259200 IN A 192.168.196.
ftp.linux.bogus. 259200 IN MX 10 mail.linux.
ftp.linux.bogus. 259200 IN MX 20 mail.friend.
gw.linux.bogus. 259200 IN A 192.168.196.
gw.linux.bogus. 259200 IN TXT
localhost.linux.bogus. 259200 IN A 127.0.0.
mail.linux.bogus. 259200 IN A 192.168.196.
mail.linux.bogus. 259200 IN MX 10 mail.linux.
mail.linux.bogus. 259200 IN MX 20 mail.friend.
ns.linux.bogus. 259200 IN MX 10 mail.linux.
ns.linux.bogus. 259200 IN MX 20 mail.friend.
ns.linux.bogus. 259200 IN A 192.168.196.
www.linux.bogus. 259200 IN CNAME ns.linux.
linux.bogus. 259200 IN SOA ns.linux.bogus. hostmaster.linux.bogus. 199802151 28800 7200 2419200
;; Query time: 41
;; SERVER: 127.0.0.1#53(127.0.0.
;; WHEN: Sun Dec 23 03:12:31
;; XFR size: 23
That's good. As you see it looks a bit like the zone file
Let's check what it says for www
$ dig www.linux.
;
;; global options:
;; Got
;;
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL:
;; QUESTION
;www.linux.bogus. IN
;; ANSWER
www.linux.bogus. 259200 IN CNAME ns.linux.
ns.linux.bogus. 259200 IN A 192.168.196.
;; AUTHORITY
linux.bogus. 259200 IN NS ns.linux.
;; Query time: 5
;; SERVER: 127.0.0.1#53(127.0.0.
;; WHEN: Sun Dec 23 03:14:14
;; MSG SIZE rcvd:
In other words, the real name of www.linux.bogus is ns.linux.
and it gives you some of the information it has about ns as
enough to connect to it if you were a
Now we're
5.3. The reverse
Now programs can convert the names in linux.bogus to addresses
they can connect to. But also required is a reverse zone, one
DNS able to convert from an address to a name. This name is used by
lot of servers of different kinds (FTP, IRC, WWW and others) to
if they want to talk to you or not, and if so, maybe even how
priority you should be given. For full access to all services on
Internet a reverse zone is
Put this in named.
______________________________________________________________________
______________________________________________________________________
zone
type
notify
file
};
______________________________________________________________________
};
______________________________________________________________________
This is exactly as with the 0.0.127.in-addr.arpa, and the contents
similar:
______________________________________________________________________
similar:
______________________________________________________________________
$TTL
@ IN SOA ns.linux.bogus. hostmaster.linux.bogus.
199802151 ; Serial, todays date + todays
8H ;
2H ;
4W ;
1D) ; Minimum
NS ns.linux.
1 PTR gw.linux.
2 PTR ns.linux.
3 PTR donald.linux.
4 PTR mail.linux.
5 PTR ftp.linux.
______________________________________________________________________
______________________________________________________________________
Now you reload your named (rndc reload) and examine your work with
again:
______________________________________________________________________
again:
______________________________________________________________________
$ dig -x 192.168.196.
;; Got
;;
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL:
;; QUESTION
;4.196.168.192.in-addr.arpa. IN
;; ANSWER
4.196.168.192.in-addr.arpa. 259200 IN PTR mail.linux.
;; AUTHORITY
196.168.192.in-addr.arpa. 259200 IN NS ns.linux.
;; ADDITIONAL
ns.linux.bogus. 259200 IN A 192.168.196.
;; Query time: 4
;; SERVER: 127.0.0.1#53(127.0.0.
;; WHEN: Sun Dec 23 03:16:05
;; MSG SIZE rcvd:
______________________________________________________________________
______________________________________________________________________
so, it looks OK, dump the whole thing to examine that
______________________________________________________________________
______________________________________________________________________
$ dig 196.168.192.in-addr.arpa.
;
;; global options:
196.168.192.in-addr.arpa. 259200 IN SOA ns.linux.bogus.
hostmaster.linux.bogus. 199802151 28800 7200 2419200
196.168.192.in-addr.arpa. 259200 IN NS ns.linux.
1.196.168.192.in-addr.arpa. 259200 IN PTR gw.linux.
2.196.168.192.in-addr.arpa. 259200 IN PTR ns.linux.
3.196.168.192.in-addr.arpa. 259200 IN PTR donald.linux.
4.196.168.192.in-addr.arpa. 259200 IN PTR mail.linux.
5.196.168.192.in-addr.arpa. 259200 IN PTR ftp.linux.
196.168.192.in-addr.arpa. 259200 IN SOA ns.linux.bogus.
hostmaster.linux.bogus. 199802151 28800 7200 2419200
;; Query time: 6
;; SERVER: 127.0.0.1#53(127.0.0.
;; WHEN: Sun Dec 23 03:16:58
;; XFR size: 9
______________________________________________________________________
______________________________________________________________________
Looks good! If your output didn't look like that look for
messages in your syslog, I explained how to do that in the
section under the heading ``Starting
5.4. Words of
There are some things I should add here. The IP numbers used in
examples above are taken from one of the blocks of 'private
i.e., they are not allowed to be used publicly on the Internet.
they are safe to use in an example in a HOWTO. The second thing
the notify no; line. It tells named not to notify its
(slave) servers when it has gotten a update to one of its zone
In BIND 8 and later the named can notify the other servers listed
NS records in the zone file when a zone is updated. This is handy
ordinary use. But for private experiments with zones this
should be off --- we don't want the experiment to pollute the
do
And, of course, this domain is highly bogus, and so are all
addresses in it. For a real example of a real-life domain see
next
5.5. Why reverse lookups don't
There are a couple of ``gotchas'' that normally are avoided with
lookups that are often seen when setting up reverse zones. Before
go on you need reverse lookups of your machines working on your
nameserver. If it isn't go back and fix it before
I will discuss two failures of reverse lookups as seen from
your
5.5.1. The reverse zone isn't
When you ask a service provider for a network-address range and
domain name the domain name is normally delegated as a matter
course. A delegation is the glue NS record that helps you get
one nameserver to another as explained in the dry theory
above. You read that, right? If your reverse zone doesn't work
back and read it.
The reverse zone also needs to be delegated. If you got
192.168.196 net with the linux.bogus domain from your provider
need to put NS records in for your reverse zone as well as for
forward zone. If you follow the chain from in-addr.arpa and up
your net you will probably find a break in the chain, most probably
your service provider. Having found the break in the chain
your service-provider and ask them to correct the
5.5.2. You've got a classless
This is a somewhat advanced topic, but classless subnets are
common these days and you probably have one if you're a small
A classless subnet is what keeps the Internet going these days.
years ago there was much ado about the shortage of IP numbers.
smart people in IETF (the Internet Engineering Task Force, they
the Internet working) stuck their heads together and solved
problem. At a price. The price is in part that you'll get less
a ``C'' subnet and some things may break. Please see Ask Mr.
<http://www.
<http://www.acmebw.com/askmrdns/00007.
this and how to handle
Did you read it? I'm not going to explain it so please read
The first part of the problem is that your ISP must understand
technique described by Mr. DNS. Not all small ISPs have a
understanding of this. If so you might have to explain to them and
persistent. But be sure you understand it first ;-). They will
set up a nice reverse zone at their server which you can examine
correctness with
The second and last part of the problem is that you must
the technique. If you're unsure go back and read about it
Then you can set up your own classless reverse zone as described
Mr.
There is another trap lurking here. (Very) Old resolvers will not
able to follow the CNAME trick in the resolving chain and will fail
reverse-resolve your machine. This can result in the
assigning it an incorrect access class, deny access or something
those lines. If you stumble into such a service the only
(that I know of) is for your ISP to insert your PTR record
into their trick classless zone file instead of the trick
record.
record.
Some ISPs will offer other ways to handle this, like Web based
for you to input your reverse-mappings in or other
systems.
systems.
5.6. Slave
Once you have set up your zones correctly on the master servers
need to set up at least one slave server. Slave servers are
for robustness. If your master goes down the people out there on
net will still be able to get information about your domain from
slave. A slave should be as long away from you as possible.
master and slave should share as few as possible of these:
supply, LAN, ISP, city and country. If all of these things
different for your master and slave you've found a really good
A slave is simply a nameserver that copies zone files from a
You set it up like
______________________________________________________________________
______________________________________________________________________
zone
type
file
masters { 192.168.196.2;
};
______________________________________________________________________
};
______________________________________________________________________
A mechanism called zone-transfer is used to copy the data. The
transfer is controlled by your SOA
______________________________________________________________________
______________________________________________________________________
@ IN SOA ns.linux.bogus. hostmaster.linux.bogus.
199802151 ; serial, todays date + todays serial
8H ; refresh,
2H ; retry,
4W ; expire,
1D ) ; minimum,
______________________________________________________________________
______________________________________________________________________
A zone is only transferred if the serial number on the master
larger than on the slave. Every refresh interval the slave will
if the master has been updated. If the check fails (because
master is unavailable) it will retry the check every retry
If it continues to fail as long as the expire interval the slave
remove the zone from it's filesystem and no longer be a server for
6. Basic security
By Jamie
Setting configuration options to reduce the possibility of
There are a few simple steps that you can take which will both
your server more secure and potentially reduce its load. The
presented here is nothing more than a starting point; if you
concerned about security (and you should be), please consult
resources on the net (see ``the last
The following configuration directives occur in named.conf. If
directive occurs in the options section of the file, it applies to
zones listed in that file. If it occurs within a zone entry,
applies only to that zone. A zone entry overrides an options
6.1. Restricting zone
In order for your slave server(s) to be able to answer queries
your domain, they must be able to transfer the zone information
your primary server. Very few others have a need to do so.
restrict zone transfers using the allow-transfer option,
192.168.1.4 is the IP address of ns.friend.bogus and adding
for debugging
______________________________________________________________________
______________________________________________________________________
zone
allow-transfer { 192.168.1.4; localhost;
};
______________________________________________________________________
};
______________________________________________________________________
By restricting zone transfers you ensure that the only
available to people is that which they ask for directly - no one
just ask for all the details about your
6.2. Protecting against
Firstly, disable any queries for domains you don't own, except
your internal/local machines. This not only helps prevent
use of your DNS server, but also reduces unnecessary use of
server.
______________________________________________________________________
server.
______________________________________________________________________
options
allow-query { 192.168.196.0/24; localhost;
};
};
zone
allow-query { any;
};
};
zone
allow-query { any;
};
______________________________________________________________________
};
______________________________________________________________________
Further, disable recursive queries except from internal/local
This reduces the risk of cache poisoning attacks (where false data
fed to your
______________________________________________________________________
______________________________________________________________________
options
allow-recursion { 192.168.196.0/24; localhost;
};
______________________________________________________________________
};
______________________________________________________________________
6.3. Running named as
It is a good idea to run named as a user other than root, so that
it is compromised the privileges gained by the cracker are as
as possible. You first have to create a user for named to run
and then modify whatever init script you use that starts named.
the new user name and group to named using the -u and -g
For example, in Debian GNU/Linux 2.2 you might modify
/etc/init.d/bind script to have the following line (where user
have been
______________________________________________________________________
______________________________________________________________________
start-stop-daemon --start --quiet --exec /usr/sbin/named -- -u
______________________________________________________________________
______________________________________________________________________
The same can be done with Red Hat and the other
Dave Lugo has described a secure dual chroot
<http://www.
<http://www.etherboy.com/dns/chrootdns.
interesting to read, it makes the host your run your named on
more
7. A real domain
Where we list some real zone
Users have suggested that I include a real example of a working
as well as the tutorial
I use this example with permission from David Bullock of
These files were current 24th of September 1996, and were then
to fit BIND 8 restrictions and use extensions by me. So, what you
here differs a bit from what you find if you query LAND-5's
servers
7.1. /etc/named.conf (or /var/named/named.
Here we find master zone sections for the two reverse zones
the 127.0.0 net, as well as LAND-5's 206.6.177 subnet, and a
line for land-5's forward zone land-5.com. Also note that instead
stuffing the files in a directory called pz, as I do in this HOWTO,
puts them in a directory called
______________________________________________________________________
______________________________________________________________________
// Boot file for LAND-5 name
options
directory
};
};
controls
inet 127.0.0.1 allow { localhost; } keys { rndc_key;
};
};
key
algorithm
secret
};
};
zone
type
file
};
};
zone
type
file
};
};
zone
type
file
};
};
zone
type
file
};
______________________________________________________________________
};
______________________________________________________________________
If you put this in your named.conf file to play with PLEASE
``notify no;'' in the zone sections for the two land-5 zones so as
avoid
7.2. /var/named/root.
Keep in mind that this file is dynamic, and the one listed here
old. You're better off using a new one as explained
______________________________________________________________________
______________________________________________________________________
;
; (1 server
;; res options: init recurs defnam
;; got
;;
;; flags: qr aa rd; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL:
;; QUERY
;; ., type = NS, class =
;; ANSWER
. 6D IN NS G.ROOT-SERVERS.
. 6D IN NS J.ROOT-SERVERS.
. 6D IN NS K.ROOT-SERVERS.
. 6D IN NS L.ROOT-SERVERS.
. 6D IN NS M.ROOT-SERVERS.
. 6D IN NS A.ROOT-SERVERS.
. 6D IN NS H.ROOT-SERVERS.
. 6D IN NS B.ROOT-SERVERS.
. 6D IN NS C.ROOT-SERVERS.
. 6D IN NS D.ROOT-SERVERS.
. 6D IN NS E.ROOT-SERVERS.
. 6D IN NS I.ROOT-SERVERS.
. 6D IN NS F.ROOT-SERVERS.
;; ADDITIONAL
G.ROOT-SERVERS.NET. 5w6d16h IN A 192.112.36.
J.ROOT-SERVERS.NET. 5w6d16h IN A 198.41.0.
K.ROOT-SERVERS.NET. 5w6d16h IN A 193.0.14.
L.ROOT-SERVERS.NET. 5w6d16h IN A 198.32.64.
M.ROOT-SERVERS.NET. 5w6d16h IN A 202.12.27.
A.ROOT-SERVERS.NET. 5w6d16h IN A 198.41.0.
H.ROOT-SERVERS.NET. 5w6d16h IN A 128.63.2.
B.ROOT-SERVERS.NET. 5w6d16h IN A 128.9.0.
C.ROOT-SERVERS.NET. 5w6d16h IN A 192.33.4.
D.ROOT-SERVERS.NET. 5w6d16h IN A 128.8.10.
E.ROOT-SERVERS.NET. 5w6d16h IN A 192.203.230.
I.ROOT-SERVERS.NET. 5w6d16h IN A 192.36.148.
F.ROOT-SERVERS.NET. 5w6d16h IN A 192.5.5.
;; Total query time: 215
;; FROM: roke.uio.no to SERVER: A.ROOT-SERVERS.NET. 198.41.0.
;; WHEN: Sun Feb 15 01:22:51
;; MSG SIZE sent: 17 rcvd:
______________________________________________________________________
______________________________________________________________________
7.3. /var/named/zone/127.0.
Just the basics, the obligatory SOA record, and a record that
127.0.0.1 to localhost. Both are required. No more should be in
file. It will probably never need to be updated, unless
nameserver or hostmaster address
______________________________________________________________________
______________________________________________________________________
$TTL
@ IN SOA land-5.com. root.land-5.com.
199609203 ;
28800 ;
7200 ;
604800 ;
86400) ; Minimum
NS land-5.
1 PTR
______________________________________________________________________
______________________________________________________________________
If you look at a random BIND installation you will probably find
the $TTL line is missing as it is here. It was not used before,
only version 8.2 of BIND has started to warn about its absence.
9 requires the
7.4. /var/named/zone/land-5.
Here we see the mandatory SOA record, the needed NS records. We
see that he has a secondary name server at ns2.psi.net. This is as
should be, always have a off site secondary server as backup. We
also see that he has a master host called land-5 which takes care
many of the different Internet services, and that he's done it
CNAMEs (a alternative is using A
As you see from the SOA record, the zone file originates
land-5.com, the contact person is root@land-5.com. hostmaster
another oft used address for the contact person. The serial number
in the customary yyyymmdd format with todays serial number
this is probably the sixth version of zone file on the 20th
September 1996. Remember that the serial number must
monotonically, here there is only one digit for todays serial#,
after 9 edits he has to wait until tomorrow before he can edit
file again. Consider using two
______________________________________________________________________
______________________________________________________________________
$TTL
@ IN SOA land-5.com. root.land-5.com.
199609206 ; serial, todays date + todays serial
8H ; refresh,
2H ; retry,
4W ; expire,
1D ) ; minimum,
NS land-5.
NS ns2.psi.
MX 10 land-5.com. ; Primary Mail
TXT
localhost A 127.0.0.
router A 206.6.177.
land-5.com. A 206.6.177.
ns A 206.6.177.
www A 207.159.141.
ftp CNAME land-5.
mail CNAME land-5.
news CNAME land-5.
funn A 206.6.177.
;
;
;
;
;
ws-177200 A 206.6.177.
MX 10 land-5.com. ; Primary Mail
ws-177201 A 206.6.177.
MX 10 land-5.com. ; Primary Mail
ws-177202 A 206.6.177.
MX 10 land-5.com. ; Primary Mail
ws-177203 A 206.6.177.
MX 10 land-5.com. ; Primary Mail
ws-177204 A 206.6.177.
MX 10 land-5.com. ; Primary Mail
ws-177205 A 206.6.177.
MX 10 land-5.com. ; Primary Mail
; {Many repetitive definitions deleted -
ws-177250 A 206.6.177.
MX 10 land-5.com. ; Primary Mail
ws-177251 A 206.6.177.
MX 10 land-5.com. ; Primary Mail
ws-177252 A 206.6.177.
MX 10 land-5.com. ; Primary Mail
ws-177253 A 206.6.177.
MX 10 land-5.com. ; Primary Mail
ws-177254 A 206.6.177.
MX 10 land-5.com. ; Primary Mail
______________________________________________________________________
______________________________________________________________________
If you examine land-5s nameserver you will find that the host
are of the form ws_number. As of late BIND 4 versions named
enforcing the restrictions on what characters may be used in
names. So that does not work with BIND 8 at all, and I
'-' (dash) for '_' (underline) for use in this HOWTO. But,
mentioned earlier, BIND 9 no longer enforces this
Another thing to note is that the workstations don't have
names, but rather a prefix followed by the two last parts of the
numbers. Using such a convention can simplify
significantly, but can be a bit impersonal, and, in fact, be a
of irritation among your
We also see that funn.land-5.com is an alias for land-5.com, but
an A record, not a CNAME
7.5. /var/named/zone/206.6.
I'll comment on this file
______________________________________________________________________
______________________________________________________________________
$TTL
@ IN SOA land-5.com. root.land-5.com.
199609206 ;
28800 ;
7200 ;
604800 ;
86400) ; Minimum
NS land-5.
NS ns2.psi.
;
;
;
;
;
1 PTR router.land-5.
2 PTR land-5.
2 PTR funn.land-5.
;
;
;
;
;
200 PTR ws-177200.land-5.
201 PTR ws-177201.land-5.
202 PTR ws-177202.land-5.
203 PTR ws-177203.land-5.
204 PTR ws-177204.land-5.
205 PTR ws-177205.land-5.
; {Many repetitive definitions deleted -
250 PTR ws-177250.land-5.
251 PTR ws-177251.land-5.
252 PTR ws-177252.land-5.
253 PTR ws-177253.land-5.
254 PTR ws-177254.land-5.
______________________________________________________________________
______________________________________________________________________
The reverse zone is the bit of the setup that seems to cause the
grief. It is used to find the host name if you have the IP number
a machine. Example: you are an FTP server and accept connections
FTP clients. As you are a Norwegian FTP server you want to
more connections from clients in Norway and other
countries and less from the rest of the world. When you get
connection from a client the C library is able to tell you the
number of the connecting machine because the IP number of the
is contained in all the packets that are passed over the network.
you can call a function called gethostbyaddr that looks up the name
a host given the IP number. Gethostbyaddr will ask a DNS
which will then traverse the DNS looking for the machine.
the client connection is from ws-177200.land-5.com. The IP number
C library provides to the FTP server is 206.6.177.200. To find
the name of that machine we need to find 200.177.6.206.in-addr.
The DNS server will first find the arpa. servers, then find
addr.arpa. servers, following the reverse trail through 206, then
and at last finding the server for the 177.6.206.in-addr.arpa zone
LAND-5. From which it will finally get the answer that
200.177.6.206.in-addr.arpa we have a ``PTR ws-177200.land-5.
record, meaning that the name that goes with 206.6.177.200
ws-177200.land-5.
The FTP server prioritizes connections from the
countries, i.e., *.no, *.se, *.dk, the name ws-177200.land-5.
clearly does not match any of those, and the server will put
connection in a connection class with less bandwidth and fewer
allowed. If there was no reverse mapping of 206.2.177.200 through
in-addr.arpa zone the server would have been unable to find the
at all and would have to settle to comparing 206.2.177.200 with *.
*.se and *.dk, none of which will match at all, it may even deny
connection for lack of
Some people will tell you that reverse lookup mappings are
important for servers, or not important at all. Not so: Many
news, IRC and even some http (WWW) servers will not accept
from machines of which they are not able to find the name. So
mappings for machines are in fact
8.
Keeping it
There is one maintenance task you have to do on nameds, other
keeping them running. That's keeping the root.hints file
The easiest way is using dig. First run dig with no arguments you
get the root.hints according to your own server. Then ask one of
listed root servers with dig @rootserver. You will note that
output looks terribly like a root.hints file. Save it to a file
@e.root-servers.net . ns
root.hints with
Remember to reload named after replacing the cache
Al Longyear sent me this script that can be run automatically
update root.hints. Install a crontab entry to run it once a month
forget it. The script assumes you have mail working and that
mail-alias `hostmaster' is defined. You must hack it to suit
setup.
______________________________________________________________________
#!/bin/sh
#
setup.
______________________________________________________________________
#!/bin/sh
#
# Update the nameserver cache information file once per
# This is run automatically by a cron
#
#
# Original by Al
# Updated for BIND 8 by Nicolai
# Miscelanious error-conditions reported by David A.
# Ping test suggested by Martin
# named up-test suggested by Erik
#
(
#
(
echo
echo
# Is named up? Check the status of
case `rndc status
*refused*)
*refused*)
echo
echo
echo
exit
;;
esac
PATH=/sbin:/usr/sbin:/bin:/usr/bin:
;;
esac
PATH=/sbin:/usr/sbin:/bin:/usr/bin:
export
# NOTE: /var/named must be writable only by trusted users or this
# will cause root compromise/denial of service
cd /var/named
echo
echo
echo
echo
exit
}
}
# Are we online? Ping a server at your
case `ping -qnc 1 some.machine.net
*'100% packet
echo
echo
echo
echo
exit
;;
esac
;;
esac
dig @e.root-servers.net . ns
case `cat root.hints.new`
*NOERROR*)
*NOERROR*)
# It
:;;
*)
:;;
*)
echo
echo
echo
echo
echo
echo
echo
cat root.hints.new
exit
;;
esac
;;
esac
echo
echo
echo
echo
information:"
echo
information:"
echo
cat root.hints.
chown root.root root.hints.
chmod 444 root.hints.
rm -f root.hints.old
mv root.hints root.hints.
mv root.hints.new root.
rndc
echo
echo
echo
echo
/var/named/root.hints.old.
)
exit
______________________________________________________________________
______________________________________________________________________
Some of you might have picked up that the root.hints file is
available by ftp from Internic. Please don't use ftp to
root.hints, the above method is much more friendly to the net,
Internic.
Internic.
9. Migrating to BIND
The BIND 9 distribution, and the prepackaged versions too, contains
document called migration that contains notes about how to
from BIND 8 to BIND 9. The document is very straight forward. If
installed binary packages it's likely stored in
or /usr/doc/bind*
If you're running BIND 4, you may find a document
migration-4to9 in the same
10. Questions and
Please read this section before mailing
1. My named wants a named.boot
You are reading the wrong HOWTO. Please see the old version
this HOWTO, which covers BIND 4, at
HOWTO/>
HOWTO/>
2. How do use DNS from inside a
A hint: forward only;. You might also
___________________________________________________________________
___________________________________________________________________
query-source port
___________________________________________________________________
___________________________________________________________________
inside the ``options'' part of the named.conf file as suggested in
example ``caching''
3. How do I make DNS rotate through the available addresses for
service, say www.busy.site to obtain a load balancing effect,
similar?
similar?
Make several A records for www.busy.site and use BIND 4.9.3
later. Then BIND will round-robin the answers. It will not
with earlier versions of
4. I want to set up DNS on a (closed) intranet. What do I
You drop the root.hints file and just do zone files. That
means you don't have to get new hint files all the
5. How do I set up a secondary (slave) name
If the primary/master server has address 127.0.0.1 you put a
like this in the named.conf file of your
___________________________________________________________________
___________________________________________________________________
zone
type
file
masters { 127.0.0.1;
};
___________________________________________________________________
};
___________________________________________________________________
You may list several alternate master servers the zone can be
from inside the masters list, separated by ';'
6. I want BIND running when I'm disconnected from the
There are four items regarding
how to run DNS painlessly on a dialup
I have discovered with newer versions of BIND that
[<em/shuffeling
[<em/shuffeling files, -ed/] is no longer necessary. There is
"forward"
"forward" directive in addition to the
controls how they are used. The default setting is
which first asks each of the forwarders, and then tries the
approach of doing the legwork itself if that fails. This gives
familiar behaviour of gethostbyname() taking an inordinately long
when the link is not up. But if
gives up when it doesn't get a response from the forwarders,
gethostbyname() returns immediately. Hence there is no need
perform sleight-of-hand with files in /etc and restart the
In my case, I just added the
forward
forwarders { 193.133.58.5;
to the options { } section of my named.conf file. It works
nicely. The only disadvantage of this is that it reduces an
sophisticated piece of DNS software to the status of a dumb cache.
some extent, I would just like to run a dumb cache for DNS
but there doesn't seem to be such a piece of software available
Linux.
Linux.
he explains his way of doing
I run named on my 'Masquerading' machine here. I
two root.hints files, one called root.hints.real which
the real root server names and the other called root.hints.
which
----
----
; root.hints.
; this file contains no
----
----
When I go off line I copy the root.hints.fake file to root.hints
restart
When I go online I copy root.hints.real to root.hints and
named.
named.
This is done from ip-down
The first time I do a query off line on a domain name named
have details for it puts an entry like this in
Jan 28 20:10:11 hazchem named[10147]: No root nameserver for class
which I can live
It certainly seems to work for me. I can use the nameserver
local machines while off the 'net without the timeout delay
external domain names and I while on the 'net queries for
domains work
Peter Denison thought that Ian does not go far enough though.
writes:
writes:
When connected) serve all cached (and local network) entries
for non-cached entries, forward to my ISPs
When off-line) serve local network queries
fail all other queries
The combination of changing the root cache file and forwarding
doesn't
So, I've set up (with some discussion of this on the local LUG) two
as
named-online: forwards to ISPs
master for localnet
master for localnet reverse zone (1.168.192.in-addr.
master for 0.0.127.in-addr.
listens on port
named-offline: no
"fake"
"fake" root cache
slave for 3 local zones (master is 127.0.0.
listens on port
And combined this with port forwarding, to send port 53 to 61053
off-line, and to port 60053 when online. (I'm using the new
package under 2.3.18, but the old (ipchains) mechanism should work.
Note that this won't quite work out-of-the-box, as there's a slight bug
BIND 8.2, which I have logged wth the developers, preventing a
having a master on the same IP address (even if a different port). It's
trivial patch, and should go in soon I
and the portmapper on a mostly offline machine from
Wanger:
Wanger:
I use to run my own named on all my machines which are
occasionally connected to the Internet by modem. The nameserver
acts as a cache, it has no area of authority and asks back
everything at the name servers in the root.cache file. As is
with Slackware, it is started before nfsd and
With one of my machines (a Libretto 30 notebook) I had the
that sometimes I could mount it from another system connected to
local LAN, but most of the time it didn't work. I had the same
regardless of using PLIP, a PCMCIA ethernet card or PPP over a
interface.
interface.
After some time of guessing and experimenting I found out
apparently named messed with the process of registration nfsd
mountd have to carry out with the portmapper upon startup (I
these daemons at boot time as usual). Starting named after nfsd
mountd eliminated this problem
As there are no disadvantages to expect from such a modified
sequence I'd advise everybody to do it that way to prevent
trouble.
trouble.
7. Where does the caching name server store its cache? Is there
way I can control the size of the
The cache is completely stored in memory, it is not written to
at any time. Every time you kill named the cache is lost.
cache is not controllable in any way. named manages it
to some simple rules and that is it. You cannot control the
or the cache size in any way for any reason. If you want to you
``fix'' this by hacking named. This is however not
8. Does named save the cache between restarts? Can I make it save
No, named does not save the cache when it dies. That means
the cache must be built anew each time you kill and restart
There is no way to make named save the cache in a file. If
want you can ``fix'' this by hacking named. This is however
recommended.
recommended.
9. How can I get a domain? I want to set up my own domain called
example) linux-rules.net. How can I get the domain I want
to
Please contact your network service provider. They will be able
help you with this. Please note that in most parts of the
you need to pay money to get a
10.
10.
How can I secure my DNS server? How do I set up split
Both of these are advanced topics. They are both covered
<http://www.
<http://www.etherboy.com/dns/chrootdns.
the topics further
11. How to become a bigger time DNS
Documentation and
Real Documentation exists. Online and in print. The reading
several of these is required to make the step from small time
admin to a big time
I have written The Concise Guide to DNS and BIND (by
Langfeldt, me), published by Que (ISBN 0-7897-2273-9). The book
much like this HOWTO, just more details, and a lot more of
It has also been translated to Polish and published as DNS i BIND
Helion (
Now in 4th edition is DNS and BIND by Cricket Liu and P. Albitz
O'Reilly
Cricket book). Another book is Linux DNS Server Administration,
Craig Hunt, published by Sybex (ISBN 0782127363), I have not read
yet. Another must for good DNS administration (or good anything
that matter) is Zen and the Art of Motorcycle Maintenance by Robert
Pirsig.
Pirsig.
Online you will find my book, along with tons of other
available electronically as a subscription service
<http://safari.
<http://safari.informit.
<http://www.
<http://www.dns.
<http://www.
<http://www.isc.org/bind.
should be enclosed in the BIND distribution as well) as well as
and protocol definitions and DNS hacks (these, and most, if not
of the RFCs mentioned below, are also contained in the
distribution). I have not read most of these. The
<news:comp.
<news:comp.protocols.tcp-ip.
are a number of RFCs about DNS, the most important are probably
ones listed here. Those that have BCP (Best Current Practice)
are highly
RFC
P. Vixie, Extension Mechanisms for DNS (EDNS0) August
RFC
BCP 20, H. Eidnes et. al. Classless IN-ADDR.ARPA
March 1998. This is about CIDR, or classless subnet
lookups.
lookups.
RFC
M. Andrews, Negative Caching of DNS Queries, March 1998.
negative caching and the $TTL zone file
RFC
BCP 17, M. Hamilton and R. Wright, Use of DNS Aliases
Network Services, October 1997. About CNAME
RFC
BCP 16, R. Elz et. al., Selection and Operation of Secondary
Servers, July
RFC
A. Gulbrandsen, P. Vixie, A DNS RR for specifying the
of services (DNS SRV), October
RFC
Y. Rekhter, R. Moskowitz, D. Karrenberg, G. de Groot, E.
Address Allocation for Private Internets,
RFC
D. Barr, Common DNS Operational and Configuration
02/28/1996.
02/28/1996.
RFC 1912
B. Barr Errors in RFC 1912. Only available
<http://www.
<http://www.cis.ohio-state.edu/~barr/rfc1912-errors.
RFC
A. Romao, Tools for DNS debugging,
RFC
C. Farrell, M. Schulze, S. Pleitner, D. Baldoni, DNS Encoding
Geographical Location,
RFC
R. Ullmann, P. Mockapetris, L. Mamakos, C. Everhart, New DNS
Definitions,
RFC
P. Mockapetris, Domain names - implementation and
11/01/1987.
11/01/1987.
RFC
P. Mockapetris, Domain names - concepts and
11/01/1987.
11/01/1987.
RFC
M. Lottor, Domain administrators operations guide,
RFC
M. Stahl, Domain administrators guide,
RFC
C. Partridge, Mail routing and the domain system,