Penguin
Recent Changes
Annotated edit history of DNSHowto version 4, including all changes. View license author blame.
Rev Author # Line
1 AristotlePagaltzis 1 !!!Client-side notes
2
3 !Checking a remote server's software version
4 Want to find out what version of Named that a server runs? Here is a couple of handy commands that can tell you what version of bind a server is running.
5
3 AlastairPorter 6 <pre>
1 AristotlePagaltzis 7 nslookup -q=txt -class=CHAOS version.bind.
8
9 dig @nameservers.name version.bind ch txt
3 AlastairPorter 10 </pre>
1 AristotlePagaltzis 11
12 !Updating cached errors
13 Normally, your local [DNS] server will cache queries, whether they are successful or fail. However, sometimes you want to re-perform the query again because you think it should work this time (eg you are modifying a DNS server, or you know that at least one server for a remote site is returning different results than the other name servers). Rather than restarting your local DNS server to forget about all the cached information, you could first try sending certain queries:
14
3 AlastairPorter 15 <pre>
1 AristotlePagaltzis 16 host -t ANY remote.host.name.
3 AlastairPorter 17 </pre>
1 AristotlePagaltzis 18
19 This asks for "any available" information about the hostname, so hopefully if it isn't all cached your server will contain their server(s) again, and hopefully update the cached error. (This works for the dnsutils-derived host(1) command, the bind-derived host(1) command may behave differently.)
20
21 !!!Configuring DNS with [BIND] Made Easy.
22
23 Setting up DNS with [BIND], no matter what people say, is pretty trivial. We're going to step through setting up some name servers for "example.com".
24
25 The first thing you will need is bind installed on your server. For RedHat it's on your install CD's as "bind", For [Debian] it's "bind9".
26
27 The next step is to configure named.conf, in Red Hat this is /etc/named.conf, in Debian it's /etc/bind/named.conf.
28
29 This file is made up of "blocks": we'll start with the "options" block which configure the server itself.
3 AlastairPorter 30 <pre>
1 AristotlePagaltzis 31 options {
3 AlastairPorter 32 </pre>
1 AristotlePagaltzis 33 This starts the options block
3 AlastairPorter 34 <pre>
1 AristotlePagaltzis 35 directory "/var/cache/bind";
3 AlastairPorter 36 </pre>
1 AristotlePagaltzis 37 This configures where bind will write it's files, and the relative paths elsewhere in this file
3 AlastairPorter 38 <pre>
1 AristotlePagaltzis 39 auth-nxdomain no;
3 AlastairPorter 40 </pre>
1 AristotlePagaltzis 41 This means that the server will not answer authoratively for "no such domain", which older versions of bind used to do. Newer versions default this off but complain about it in syslog if you don't have the option. Either way, just stick the option in there, it makes named happy :)
3 AlastairPorter 42 <pre>
1 AristotlePagaltzis 43 allow-transfer { ''slave name servers go here'' };
3 AlastairPorter 44 </pre>
1 AristotlePagaltzis 45 named allows you to do zone transfers where one name server can download the entire zone file from another name server. You usually only want to allow name servers you control to do this, so you list these here. You can leave this line out, in which case anyone can download your entire zone files. an example of this line might be allow-transfer { 1.2.3.4; 2.3.4.5; };
3 AlastairPorter 46 <pre>
1 AristotlePagaltzis 47 allow-recursion { ''netranges go here'' };
3 AlastairPorter 48 </pre>
1 AristotlePagaltzis 49 This lets you restrict the number of people that can use your nameserver for forwarding. If your name server isn't on the internet this line can be ommitted. If your name server is on the internet you probably only want to list IP's that you control here. Allowing people to forward through your name server can let them exploit any bugs your name server might have. an example might be allow-recursion { 10.0.0.0/8; 192.168.0.0/16; 127.0.0.0/8; }; See ClasslessInterDomainRouting for information about / prefixes.
3 AlastairPorter 50 <pre>
1 AristotlePagaltzis 51 };
3 AlastairPorter 52 </pre>
1 AristotlePagaltzis 53 This ends the options block.
54
55 Now we need to tell the name server where to look for the root name servers.
3 AlastairPorter 56 <pre>
1 AristotlePagaltzis 57 zone "." {
3 AlastairPorter 58 </pre>
1 AristotlePagaltzis 59 This says we're declaring a zone for the domain ".". You mustn't change this.
3 AlastairPorter 60 <pre>
1 AristotlePagaltzis 61 type hint;
3 AlastairPorter 62 </pre>
1 AristotlePagaltzis 63 This means that this is a hint to get the daemon started finding other name servers. It's free to sort itself out and do it's own thing later.
3 AlastairPorter 64 <pre>
1 AristotlePagaltzis 65 file "/etc/bind/db.root";
3 AlastairPorter 66 </pre>
1 AristotlePagaltzis 67 This is where it will read the hints from. We'll discuss later about how to create this file.
68 };
69
3 AlastairPorter 70 <pre>
1 AristotlePagaltzis 71 zone "127.in-addr.arpa" {
3 AlastairPorter 72 </pre>
1 AristotlePagaltzis 73 This starts declaring a zone for reverse lookups on 127.*. Now, the way [ReverseLookup]s are handled is by looking up the IP reversed followed by ".in-addr.arpa". For instance, if you want to look up what name the IP "1.2.3.4" has, you look up "4.3.2.1.in-addr.arpa". If you think this is messy, don't even ask what they do for [IPv6] :)
3 AlastairPorter 74 <pre>
4 AlastairPorter 75 type master;
3 AlastairPorter 76 </pre>
1 AristotlePagaltzis 77 We are the master for this zone. ie: we provide the information to slave zones, and we know all about it.
3 AlastairPorter 78 <pre>
1 AristotlePagaltzis 79 file "/etc/bind/db.127.x";
3 AlastairPorter 80 </pre>
1 AristotlePagaltzis 81 This is where we read the information from for this zone. You may optionally have "allow-transfer" blocks in here for this zone.
3 AlastairPorter 82 <pre>
1 AristotlePagaltzis 83 };
3 AlastairPorter 84 </pre>
1 AristotlePagaltzis 85
86 Now we'll add out example zone "example.com".
87
88 Now, on the primary name server __ONLY__ we add:
89
3 AlastairPorter 90 <pre>
1 AristotlePagaltzis 91 zone "example.com" {
3 AlastairPorter 92 </pre>
1 AristotlePagaltzis 93
94 First we declare a block for it.
95
3 AlastairPorter 96 <pre>
4 AlastairPorter 97 type master;
3 AlastairPorter 98 </pre>
1 AristotlePagaltzis 99
100 This name server is going to be the master for this domain.
101
3 AlastairPorter 102 <pre>
1 AristotlePagaltzis 103 file "/etc/bind/db.example.com";
3 AlastairPorter 104 </pre>
1 AristotlePagaltzis 105
106 Where the information for this zone is stored. Fairly trivial.
107
3 AlastairPorter 108 <pre>
1 AristotlePagaltzis 109 };
3 AlastairPorter 110 </pre>
1 AristotlePagaltzis 111
112 On the secondary name server __ONLY__ we add:
113
3 AlastairPorter 114 <pre>
1 AristotlePagaltzis 115 zone "example.com" {
3 AlastairPorter 116 </pre>
1 AristotlePagaltzis 117
118 The block again
119
3 AlastairPorter 120 <pre>
4 AlastairPorter 121 type slave;
3 AlastairPorter 122 </pre>
1 AristotlePagaltzis 123
124 Ok, this is new. This means that the zone will be downloaded using a ZoneTransfer from a primary name server.
125
3 AlastairPorter 126 <pre>
1 AristotlePagaltzis 127 masters { ''ip of the primary name server''; };
3 AlastairPorter 128 </pre>
1 AristotlePagaltzis 129
130 This is where to download this zone from. An example of this line might be masters { 1.2.3.4; }; if you were going to d/l it from the IP address "1.2.3.4".
131
3 AlastairPorter 132 <pre>
1 AristotlePagaltzis 133 file "db.example.com";
3 AlastairPorter 134 </pre>
1 AristotlePagaltzis 135
136 Here's where we want bind to store the file. Note that we don't specify a FullPath here, so that it will be put in the default directory (/var).
137
138 };
139
140 And heres the end.
141
142 You can add as many of these two blocks as you need for each zone. remember, [ReverseLookup]s are done by reversing the network and adding ".in-addr.arpa" on the end.
143
144 Now we are finished with /etc/bind/named.conf, and we want to start creating the [ZoneFile]s.
145
146 Now we'll move onto the zone files themselves. We'll start with /etc/bind/db.example.com
147
148 at the top of the zone file we specify the default TTL of all the records in the zone. This specifies how frequently information will be checked to see if it's been updated, a good value is 24 hours. If you are expecting to change the zone file sometime in the future you might want to turn this number down lower, alternatively, if you are expecting it to change, you can increase it.
149
3 AlastairPorter 150 <pre>
1 AristotlePagaltzis 151 $TTL 24h
3 AlastairPorter 152 </pre>
1 AristotlePagaltzis 153
3 AlastairPorter 154 Then we put a "~StartOfAuthority" record which explains a bit about who owns the zone, and how often the secondaries should check for updates etc.
1 AristotlePagaltzis 155
3 AlastairPorter 156 <pre>
1 AristotlePagaltzis 157 @ IN SOA ''primary.name.server.'' ''email.address.for.contact.information'' (
158 ''Serial Number'' ; Serial Number
159 ''Refresh Time'' ; Refresh Time
160 ''Retry Time'' ; Retry Time
161 ''Expire Time'' ; Expire Time
162 ''Negative Cache TTL'' ; Negative Cache TTL
163 )
3 AlastairPorter 164 </pre>
1 AristotlePagaltzis 165
166 This will take some explaination. The "@" in the first column means that it refers to the current zone (example.com.) You could replace this with "example.com.", but most people just use "@" instead. It's easier to remember and much easier to type :) The "IN" means that this is for the InterNet. There are other values that can go here, noone ever uses them. The "SOA" means this is a StartOfAuthority record.
167
168 The next one is the "primary name server". So, for instance you might use "ns1.example.com." here. Note that you must have a "." at the end of the domain name. If you don't, the named will add the domain on again, giving you "ns1.example.com.example.com" which is definately not what you want. The #1 problem with zone files is that someone forgot to put the "." on the end of a domain name. Don't let this happen to you, check it all twice.
169
170 The email address for contact information is an email address of someone to contact if you have problems with this zone, except the usual "@" is replaced with a "." for some bizarre reason. Don't ask me why. So "domains@example.com." becomes "domains.example.com." as you would expect.
171
172 The serial number is which "version" of the zone file this is. This only requirement for this is that every time you change the zone you increment this number by 1. Almost everyone uses the format "YYYYMMDD00" for the serial number, eg, for today (2002-10-09) I would use 2002100900, and if I made a change later today I would use 2002100901 etc...
173
174 The Refresh time is how often secondary name servers check the primary to see if it has updated information. 8h is an often used value.
175
176 The Retry time is how often secondary's should retry if they couldn't fetch it when they tried to do a refresh. 30m is an often used value.
177
178 The Expire time is when they give up. If after this time the name server couldn't reach the primary name server it will give up and become a "LameServer". 1 month is an often used value.
179
180 The Negative Cache TTL is how long entries that don't exist should be cached for on other name servers around the Internet. 30 minutes is an often used value.
181
3 AlastairPorter 182 <pre>
1 AristotlePagaltzis 183 @ IN NS ns1.example.com.
3 AlastairPorter 184 </pre>
1 AristotlePagaltzis 185
186 Now we list the name servers for example.com. ns1.example.com __must not__ be a CNAME. A general policy that works well is to have one "aurhorative name" for a name server and use that for all zones. eg: if example.com and example.org are both hosted on the site, then they both use "ns1.example.com." as their primary NS, thus changing the IP of "ns1.example.com" when the name server moves, it moves all the domains, and you don't have to move them all.
187
3 AlastairPorter 188 <pre>
1 AristotlePagaltzis 189 @ IN NS ns2.example.com.
3 AlastairPorter 190 </pre>
1 AristotlePagaltzis 191
192 And a secondary nameserver, remember to add the "." at the end, and remember that ns2.example.com can't be a CNAME.
193
3 AlastairPorter 194 <pre>
1 AristotlePagaltzis 195 @ IN MX 10 smtp.example.com.
3 AlastairPorter 196 </pre>
1 AristotlePagaltzis 197
198 This lists a "mail exchange" record for "example.com." You can list multiple MX records. It will use the records with the lowest number in preference to ones with higher numbers. Note, you can't have a MX to a CNAME, and you can't have a MX to an IP address.
199
3 AlastairPorter 200 <pre>
1 AristotlePagaltzis 201 @ IN MX 20 smtp2.example.com.
3 AlastairPorter 202 </pre>
1 AristotlePagaltzis 203
204 This would be an example of a backup mail server. It won't ever get used unless the primary one (above) is down. It's a secondary since this preference number is greater.
205
3 AlastairPorter 206 <pre>
1 AristotlePagaltzis 207 ns1.example.com. IN A 1.2.3.4
3 AlastairPorter 208 </pre>
1 AristotlePagaltzis 209
210 This lists a name (ns1.example.com) and gives it an address (1.2.3.4). Remember you can't have a CNAME for a nameserver.
211
3 AlastairPorter 212 <pre>
1 AristotlePagaltzis 213 ns2.example.com. IN A 2.3.4.5
3 AlastairPorter 214 </pre>
1 AristotlePagaltzis 215
216 This lists the secondary name server, as above. :)
217
3 AlastairPorter 218 <pre>
1 AristotlePagaltzis 219 smtp.example.com. IN A 1.2.3.4
3 AlastairPorter 220 </pre>
1 AristotlePagaltzis 221
222 Mail server for example.com, like before :)
223
3 AlastairPorter 224 <pre>
1 AristotlePagaltzis 225 smtp2.example.com. IN A 2.3.4.5
3 AlastairPorter 226 </pre>
1 AristotlePagaltzis 227
228 Mail server for example.com, as above :) Note that these have the same address as ns1.example.com and ns2.example.com, they don't have to, but they can.
229
3 AlastairPorter 230 <pre>
1 AristotlePagaltzis 231 snargle.example.com. IN A 1.2.3.4
3 AlastairPorter 232 </pre>
1 AristotlePagaltzis 233
234 This is a host called snargle.example.com.
235
3 AlastairPorter 236 <pre>
1 AristotlePagaltzis 237 www.example.com. IN CNAME snargle.example.com.
3 AlastairPorter 238 </pre>
1 AristotlePagaltzis 239
240 This is an alias for snargle.example.com. people looking up www.example.com will get snargle.example.com. Note, you can't send mail to a CNAME, nor can you use it as a namserver. You cannot have one name have a CNAME and any other records (including other CNAMEs). In general (and as you may have guessed by now), CNAME's are pretty limited, and infact should probably be ignored.
241
3 AlastairPorter 242 <pre>
1 AristotlePagaltzis 243 narf.example.com. IN A 2.3.4.5
3 AlastairPorter 244 </pre>
1 AristotlePagaltzis 245
246 This is a hostname for narf.example.com.
247
248 You can have multiple records for one name, for example:
249
3 AlastairPorter 250 <pre>
1 AristotlePagaltzis 251 blargh.example.com IN A 3.4.5.6
252 blargh.example.com IN MX 10 narf.example.com.
3 AlastairPorter 253 </pre>
1 AristotlePagaltzis 254
255 This lists a host "blargh.example.com" that doesn't accept mail, instead it's sent to narf.example.com.
256
257 You can also have multiple of the same record:
3 AlastairPorter 258 <pre>
1 AristotlePagaltzis 259 secure.example.com. IN A 1.2.3.4
260 secure.example.com. IN A 2.3.4.5
261 secure.example.com IN A 3.4.5.6
3 AlastairPorter 262 </pre>
1 AristotlePagaltzis 263 This will be round-robined, thus giving you simplistic load balancing between these servers.
264
265 ----
2 AristotlePagaltzis 266 CategoryDns, CategoryHowto