DNS and BIND, 5th Edition

Table of Contents......Page 7
Preface......Page 13
 What’s New in the Fifth Edition?......Page 15
 Organization......Page 16
 Audience......Page 18
 Obtaining the Example Programs......Page 19
 Conventions Used in This Book......Page 20
 Safari® Enabled......Page 21
 Acknowledgments......Page 22
 A (Very) Brief History of the Internet......Page 25
 On the Internet and Internets......Page 26
  The History of the Domain Name System......Page 27
 The Domain Name System, in a Nutshell......Page 28
 Must I Use DNS?......Page 33
 The Domain Namespace......Page 35
  Domain Names......Page 36
  Domains......Page 37
  Resource Records......Page 40
  Top-Level Domains......Page 41
   Country-code top-level domains......Page 42
  Further Down......Page 43
  Reading Domain Names......Page 44
 Delegation......Page 45
 Nameservers and Zones......Page 46
  Types of Nameservers......Page 49
 Resolvers......Page 50
  Root Nameservers......Page 51
  Recursion......Page 53
  Choosing Between Authoritative Nameservers......Page 54
  The Whole Enchilada......Page 55
  Mapping Addresses to Names......Page 56
 Caching......Page 58
  Time to Live......Page 59
 Getting BIND......Page 61
  Handy Mailing Lists and Usenet Newsgroups......Page 63
  Finding IP Addresses......Page 64
  On Registrars and Registries......Page 65
  Where in the World Do I Fit?......Page 66
   whois......Page 67
  Back in the U.S.A.......Page 68
   The generic top-level domains......Page 70
   Choosing a registrar......Page 71
  Checking That Your Network Is Registered......Page 72
  Registering Your Zones......Page 74
 Our Zone......Page 77
 Setting Up Zone Data......Page 78
  The Zone Datafiles......Page 79
  Setting the Zone’s Default TTL......Page 80
  SOA Records......Page 81
  Address and Alias Records......Page 82
  PTR Records......Page 84
  The Completed Zone Datafiles......Page 85
  The Loopback Address......Page 86
  The Root Hints Data......Page 87
 Setting Up a BIND Configuration File......Page 89
  The @ Notation......Page 92
  The Shortened Zone Datafiles......Page 93
 Hostname Checking......Page 95
 Tools......Page 97
 Running a Primary Nameserver......Page 98
  Check for Syslog Errors......Page 99
  Testing Your Setup with nslookup......Page 100
   Look up a local domain name......Page 101
   One more test......Page 102
  Editing the Startup Files......Page 104
 Running a Slave Nameserver......Page 105
  Setup......Page 106
  Backup Files......Page 108
  SOA Values......Page 109
  Multiple Master Servers......Page 111
 What’s Next?......Page 112
DNS and Electronic Mail......Page 113
 MX Records......Page 114
 What’s a Mail Exchanger, Again?......Page 116
 The MX Algorithm......Page 118
 DNS and Email Authentication......Page 120
  The Sender Policy Framework......Page 121
 The Resolver......Page 124
  The Local Domain Name......Page 125
  The Search List......Page 126
   The BIND 4.9 and later search list......Page 127
  The search Directive......Page 128
  The nameserver Directive......Page 129
   More than one nameserver configured......Page 131
  The sortlist Directive......Page 133
  The options Directive......Page 134
  Comments......Page 135
  Resolver Only......Page 136
  Local Nameserver......Page 137
 Minimizing Pain and Suffering......Page 138
  Differences in Service Behavior......Page 139
  Electronic Mail......Page 140
  Updating .rhosts, hosts.equiv, etc.......Page 141
  Providing Aliases......Page 142
  nsswitch.conf......Page 143
 The Windows XP Resolver......Page 144
  Caching......Page 148
  Subnet Prioritization......Page 149
 Controlling the Nameserver......Page 151
  ndc and controls (BIND 8)......Page 152
  rndc and controls (BIND 9)......Page 155
   Using rndc to control multiple servers......Page 157
   New rndc commands......Page 158
  Using Signals......Page 159
 Updating Zone Datafiles......Page 160
  SOA Serial Numbers......Page 161
  Starting Over with a New Serial Number......Page 162
   Responsible Person......Page 164
  Generating Zone Datafiles from the Host Table......Page 165
 Organizing Your Files......Page 167
  Using Several Directories......Page 168
  Changing the Origin in a Zone Datafile......Page 170
 Changing System File Locations......Page 171
 Logging......Page 172
  The logging Statement......Page 175
  Channel Details......Page 176
   syslog channels......Page 177
   BIND 8 categories......Page 178
   BIND 9 categories......Page 180
   Viewing all category messages......Page 181
 Keeping Everything Running Smoothly......Page 182
  Common Syslog Messages......Page 183
  Understanding the BIND Statistics......Page 190
   BIND 8 statistics......Page 192
   BIND 9 statistics......Page 199
   Using the BIND statistics......Page 200
 How Many Nameservers?......Page 201
  Where Do I Put My Nameservers?......Page 202
  Capacity Planning......Page 204
  Primary Master and Slave Servers......Page 209
  Caching-Only Servers......Page 211
  Partial-Slave Servers......Page 212
 Registering Nameservers......Page 213
 Changing TTLs......Page 216
  Changing Other SOA Values......Page 218
  Outages......Page 219
  Recommendations......Page 221
  Long Outages (Days)......Page 222
  Really Long Outages (Weeks)......Page 223
Parenting......Page 225
 How Many Children?......Page 226
 What to Name Your Children......Page 227
 How to Become a Parent: Creating Subdomains......Page 228
  Creating a Subdomain in the Parent’s Zone......Page 229
  Creating and Delegating a Subdomain......Page 230
  An fx.movie.edu Slave......Page 234
  On the movie.edu Primary Nameserver......Page 235
  Delegating an in-addr.arpa Zone......Page 236
  Adding a movie.edu Slave......Page 237
 Subdomains of in-addr.arpa Domains......Page 238
  Subnetting on a Nonoctet Boundary......Page 239
   /24 (Class C–sized) networks......Page 240
  Using host......Page 244
  Managing Delegation......Page 245
   Managing delegation with stubs......Page 246
 Managing the Transition to Subdomains......Page 247
  Removing Parent Aliases......Page 248
 The Life of a Parent......Page 249
 Address Match Lists and ACLs......Page 250
 DNS Dynamic Update......Page 252
  Dynamic Update and Zone Datafiles......Page 254
  Update Access Control Lists......Page 255
  TSIG-Signed Updates......Page 256
 DNS NOTIFY (Zone Change Notification)......Page 259
 Incremental Zone Transfer (IXFR)......Page 264
  IXFR from Differences......Page 265
  BIND 8 IXFR Configuration......Page 266
  BIND 9 IXFR Configuration......Page 267
 Forwarding......Page 268
  A More Restricted Nameserver......Page 269
  Forward Zones......Page 270
 Views......Page 271
 Round-Robin Load Distribution......Page 274
  Multiple CNAMEs......Page 275
  The rrset-order Substatement......Page 276
 Nameserver Address Sorting......Page 277
 Preferring Nameservers on Certain Networks......Page 279
 A Nonrecursive Nameserver......Page 280
 Avoiding a Bogus Nameserver......Page 281
   Limiting transfers requested per nameserver......Page 282
   Limiting the total number of zone transfers requested......Page 283
   Limiting the duration of a zone transfer......Page 284
   More efficient zone transfers......Page 285
   Changing the data segment size limit......Page 286
   Changing the core size limit......Page 287
   Limiting the number of clients......Page 288
   Cleaning interval......Page 289
  TTLs......Page 290
 Compatibility......Page 291
 The ABCs of IPv6 Addressing......Page 292
  Configuring the IPv4 Transport......Page 294
  Configuring the IPv6 Transport......Page 297
  IPv6 Forward and Reverse Mapping......Page 298
  AAAA and ip6.arpa......Page 299
   A6 records and forward mapping......Page 300
   DNAME records and reverse mapping......Page 302
Security......Page 306
  One-Way Hash Functions......Page 307
  Configuring TSIG......Page 308
  Using TSIG......Page 310
  BIND Version......Page 311
   Restricting all queries......Page 313
  Preventing Unauthorized Zone Transfers......Page 314
  Running BIND with Least Privilege......Page 316
   “Advertising” nameserver configuration......Page 318
   “Resolving” nameserver configuration......Page 319
  Two Nameservers in One......Page 320
 DNS and Internet Firewalls......Page 324
   Packet filters......Page 325
   Proxies......Page 326
  A Bad Example......Page 327
  Internet Forwarders......Page 328
   The trouble with forwarding......Page 330
   Using forward zones......Page 332
   Where to put internal root nameservers......Page 333
   in-addr.arpa delegation......Page 334
   The db.root file......Page 335
   Configuring other internal nameservers......Page 336
   Mail from internal hosts to the Internet......Page 337
   Mail to specific Internet domain names......Page 338
  A Split Namespace......Page 339
   Configuring the bastion host......Page 341
   The final configuration......Page 343
   Using views on the bastion host......Page 345
 The DNS Security Extensions......Page 346
  Public-Key Cryptography and Digital Signatures......Page 347
  The DNSKEY Record......Page 348
  The RRSIG Record......Page 350
  The NSEC Record......Page 352
  The DS Record and the Chain of Trust......Page 354
   Delegating to unsigned zones......Page 356
  DO, AD, and CD......Page 357
  How the Records Are Used......Page 358
  Zone-Signing Keys and Key-Signing Keys......Page 359
   Generating your key pairs......Page 360
   Signing your zone......Page 361
   Sending your keys to be signed......Page 364
   Signing a parent zone......Page 365
  DNSSEC and Dynamic Update......Page 366
  Changing Keys......Page 370
  What Was That All About?......Page 372
 Is nslookup a Good Tool?......Page 373
  The Search List......Page 374
 Interactive Versus Noninteractive......Page 375
 Option Settings......Page 376
  The .nslookuprc File......Page 378
  Looking Up Different Record Types......Page 379
  Authoritative Versus Nonauthoritative Answers......Page 380
  Switching Nameservers......Page 381
 Less Common Tasks......Page 382
  Showing the Query and Response Messages......Page 383
  Querying Like a BIND Nameserver......Page 385
  Zone Transfers......Page 388
  Looking Up the Right Data......Page 390
  No Response from Server......Page 391
  Query Refused......Page 392
  Finding Out What Is Being Looked Up......Page 393
 Best of the Net......Page 394
 Using dig......Page 395
  dig’s Output Format......Page 396
  Zone Transfers with dig......Page 398
  dig Options......Page 399
 Debugging Levels......Page 400
   BIND 8 debugging levels......Page 401
   BIND 9 debugging levels......Page 402
 Turning On Debugging......Page 403
  Nameserver Startup (BIND 8, Debug Level 1)......Page 404
  Nameserver Startup (BIND 9, Debug Level 1)......Page 407
  A Successful Lookup (BIND 8, Debug Level 1)......Page 409
  A Successful Lookup with Retransmissions (BIND 8, Debug Level 1)......Page 412
  A Slave Nameserver Checking Its Zone (BIND 8, Debug Level 1)......Page 413
  A Slave Nameserver Checking Its Zone (BIND 9 Debug Level 1)......Page 416
 The Resolver Search Algorithm and Negative Caching (BIND 8)......Page 417
 The Resolver Search Algorithm and Negative Caching (BIND 9)......Page 418
 Tools......Page 419
 Is NIS Really Your Problem?......Page 420
  How to Use named-xfer......Page 421
  What if I Don’t Have named-xfer?......Page 423
  How to Read a BIND 8 Database Dump......Page 424
  How to Read a BIND 9 Database Dump......Page 428
  Logging Queries......Page 432
  1. Forgot to Increment Serial Number......Page 433
  3. Slave Nameserver Can’t Load Zone Data......Page 435
  4. Added Name to Zone Datafile but Forgot to Add PTR Record......Page 437
  5. Syntax Error in Configuration File or Zone Datafile......Page 438
  6. Missing Dot at the End of a Domain Name in a Zone Datafile......Page 440
  8. Loss of Network Connectivity......Page 441
  9. Missing Subdomain Delegation......Page 443
  10. Incorrect Subdomain Delegation......Page 444
  11. Syntax Error in resolv.conf......Page 447
  12. Local Domain Name Not Set......Page 448
  Resolver Behavior......Page 450
  Zone Transfer Fails Because of Proprietary WINS Record......Page 451
  Nameserver Reports “no NS RR for SOA MNAME”......Page 452
  Resolver Reports “asked for PTR, got CNAME”......Page 453
  Other Nameservers Don’t Cache Your Negative Answers......Page 454
 TSIG Errors......Page 455
  Local Name Can’t Be Looked Up......Page 456
  Remote Names Can’t Be Looked Up......Page 457
  Wrong or Inconsistent Answer......Page 458
  rlogin and rsh to Host Fails Access Check......Page 459
   Old delegation information......Page 460
   What have I got?......Page 461
 Shell Script Programming with nslookup......Page 462
  Solving This Problem with a Script......Page 463
  DNS Message Format......Page 469
  Domain Name Compression......Page 470
   herror and h_errno......Page 471
   res_mkquery......Page 472
   res_search......Page 473
   res_send......Page 474
  The _res Structure......Page 475
  The Nameserver Library Routines......Page 477
   ns_initparse......Page 478
   ns_msg_get_flag......Page 479
   ns_name_compress......Page 480
   ns_name_uncompress......Page 481
  Parsing DNS Responses......Page 482
  A Sample Program: check_soa......Page 483
  Packet Objects......Page 494
  Resource Record Objects......Page 495
  A Perl Version of check_soa......Page 496
 External, Authoritative DNS Infrastructure......Page 498
 Forwarder Infrastructure......Page 502
 Internal DNS Infrastructure......Page 504
 Operations......Page 505
 Keeping Up with DNS and BIND......Page 506
  CNAMEs Attached to Interior Nodes......Page 507
  CNAMEs Pointing to CNAMEs......Page 508
  Multiple CNAME Records......Page 509
  Finding Out a Host’s Aliases......Page 510
 Wildcards......Page 512
 Dial-up Connections......Page 513
  Avoiding Dialouts......Page 514
  Manual Dial-up with One Host......Page 515
  Dial-on-Demand with Multiple Hosts......Page 516
  Running Authoritative Nameservers over Dial-on-Demand......Page 517
 Network Names and Numbers......Page 518
  AFSDB......Page 520
  LOC......Page 521
  SRV......Page 522
  Translating E.164 Numbers into Domain Names......Page 525
  The NAPTR Record......Page 526
 Internationalized Domain Names......Page 528
 DNS and WINS......Page 530
  How Windows Uses Dynamic Update......Page 532
  Secure Dynamic Update......Page 535
   Handling Windows clients......Page 536
   Handling Windows servers......Page 537
 Master File Format......Page 541
   A address......Page 543
   MX mail exchanger......Page 544
   PTR pointer......Page 545
   SOA start of authority......Page 546
   WKS well-known services......Page 547
   AFSDB Andrew File System Data Base (experimental)......Page 548
   RP Responsible Person (experimental)......Page 549
   X25 X.25 address (experimental)......Page 550
   PX pointer to X.400/RFC 822 mapping information......Page 551
   SRV Locate Services......Page 552
   NAPTR Naming Authority Pointer......Page 553
  Message Format......Page 554
  Header Section Format......Page 555
  Question Section Format......Page 556
   QTYPE values......Page 557
  Answer, Authority, and Additional Section Format......Page 558
   Character string......Page 559
   Message compression......Page 560
BIND Compatibility Matrix......Page 561
  Get the Source Code......Page 562
  Use the Proper Compiler Settings......Page 563
  Get the Source Code......Page 564
  Run configure, and Build Everything......Page 565
Top-Level Domains......Page 567
  acl......Page 572
  logging......Page 573
  options......Page 574
  zone......Page 576
  Comments......Page 577
   key......Page 578
   lwres......Page 579
   options......Page 580
   trusted-keys......Page 583
   view......Page 584
   zone......Page 586
 BIND Resolver Statements......Page 587
  nameserver......Page 588
  options ndots......Page 589
  options rotate (8.2+)......Page 590
 BIND 9 Options Statement......Page 591
  Definition and Usage......Page 592
  Boolean Options......Page 594
  Access Control......Page 599
  Query Address......Page 601
  Zone Transfers......Page 602
  Operating System Resource Limits......Page 604
  Server Resource Limits......Page 605
  Periodic Task Intervals......Page 606
  The sortlist Statement......Page 607
  Tuning......Page 609
  Built-in Server Information Zones......Page 610
Index......Page 613