Bv9ARM.ch01.html revision 0b89eee6167201843c9a46b7e7c63cb1e4e09ba3
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync - Copyright (C) 2000-2017 Internet Systems Consortium, Inc. ("ISC")
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync - This Source Code Form is subject to the terms of the Mozilla Public
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync - License, v. 2.0. If a copy of the MPL was not distributed with this
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync - file, You can obtain one at http://mozilla.org/MPL/2.0/.
452fd0f33b11dc60aad994e3001c74415179d401vboxsync<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
452fd0f33b11dc60aad994e3001c74415179d401vboxsync<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
452fd0f33b11dc60aad994e3001c74415179d401vboxsync<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
452fd0f33b11dc60aad994e3001c74415179d401vboxsync<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<link rel="prev" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<link rel="next" href="Bv9ARM.ch02.html" title="Chapter�2.�BIND Resource Requirements">
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<tr><th colspan="3" align="center">Chapter�1.�Introduction</th></tr>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch02.html">Next</a>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<a name="Bv9ARM.ch01"></a>Chapter�1.�Introduction</h1></div></div></div>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<dt><span class="section"><a href="Bv9ARM.ch01.html#doc_scope">Scope of Document</a></span></dt>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<dt><span class="section"><a href="Bv9ARM.ch01.html#organization">Organization of This Document</a></span></dt>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<dt><span class="section"><a href="Bv9ARM.ch01.html#conventions">Conventions Used in This Document</a></span></dt>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<dt><span class="section"><a href="Bv9ARM.ch01.html#dns_overview">The Domain Name System (<acronym class="acronym">DNS</acronym>)</a></span></dt>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<dt><span class="section"><a href="Bv9ARM.ch01.html#dns_fundamentals">DNS Fundamentals</a></span></dt>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<dt><span class="section"><a href="Bv9ARM.ch01.html#domain_names">Domains and Domain Names</a></span></dt>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<dt><span class="section"><a href="Bv9ARM.ch01.html#zones">Zones</a></span></dt>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<dt><span class="section"><a href="Bv9ARM.ch01.html#auth_servers">Authoritative Name Servers</a></span></dt>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<dt><span class="section"><a href="Bv9ARM.ch01.html#cache_servers">Caching Name Servers</a></span></dt>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<dt><span class="section"><a href="Bv9ARM.ch01.html#multi_role">Name Servers in Multiple Roles</a></span></dt>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync The Internet Domain Name System (<acronym class="acronym">DNS</acronym>)
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync consists of the syntax
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync to specify the names of entities in the Internet in a hierarchical
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync manner, the rules used for delegating authority over names, and the
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync system implementation that actually maps names to Internet
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync addresses. <acronym class="acronym">DNS</acronym> data is maintained in a
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync group of distributed
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync hierarchical databases.
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<div class="titlepage"><div><div><h2 class="title" style="clear: both">
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<a name="doc_scope"></a>Scope of Document</h2></div></div></div>
6378fc9dbcca8bb2bdd10916afbc30702193f178vboxsync The Berkeley Internet Name Domain
6378fc9dbcca8bb2bdd10916afbc30702193f178vboxsync (<acronym class="acronym">BIND</acronym>) implements a
6378fc9dbcca8bb2bdd10916afbc30702193f178vboxsync domain name server for a number of operating systems. This
6378fc9dbcca8bb2bdd10916afbc30702193f178vboxsync document provides basic information about the installation and
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync care of the Internet Systems Consortium (<acronym class="acronym">ISC</acronym>)
929372c3867cf188f069a440f4aed85837af022evboxsync <acronym class="acronym">BIND</acronym> version 9 software package for
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync system administrators.
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync <p>This version of the manual corresponds to BIND version 9.11.</p>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<div class="titlepage"><div><div><h2 class="title" style="clear: both">
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<a name="organization"></a>Organization of This Document</h2></div></div></div>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync In this document, <span class="emphasis"><em>Chapter 1</em></span> introduces
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync the basic <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym> concepts. <span class="emphasis"><em>Chapter 2</em></span>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync describes resource requirements for running <acronym class="acronym">BIND</acronym> in various
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync environments. Information in <span class="emphasis"><em>Chapter 3</em></span> is
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync <span class="emphasis"><em>task-oriented</em></span> in its presentation and is
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync organized functionally, to aid in the process of installing the
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync <acronym class="acronym">BIND</acronym> 9 software. The task-oriented
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync section is followed by
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync <span class="emphasis"><em>Chapter 4</em></span>, which contains more advanced
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync concepts that the system administrator may need for implementing
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync certain options. <span class="emphasis"><em>Chapter 5</em></span>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync describes the <acronym class="acronym">BIND</acronym> 9 lightweight
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync resolver. The contents of <span class="emphasis"><em>Chapter 6</em></span> are
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync organized as in a reference manual to aid in the ongoing
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync maintenance of the software. <span class="emphasis"><em>Chapter 7</em></span> addresses
6728a36898fd2be125a28e84d2115d19aa4923edvboxsync security considerations, and
6728a36898fd2be125a28e84d2115d19aa4923edvboxsync <span class="emphasis"><em>Chapter 8</em></span> contains troubleshooting help. The
6728a36898fd2be125a28e84d2115d19aa4923edvboxsync main body of the document is followed by several
6728a36898fd2be125a28e84d2115d19aa4923edvboxsync <span class="emphasis"><em>appendices</em></span> which contain useful reference
6728a36898fd2be125a28e84d2115d19aa4923edvboxsync information, such as a <span class="emphasis"><em>bibliography</em></span> and
6728a36898fd2be125a28e84d2115d19aa4923edvboxsync historic information related to <acronym class="acronym">BIND</acronym>
6728a36898fd2be125a28e84d2115d19aa4923edvboxsync and the Domain Name
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<div class="titlepage"><div><div><h2 class="title" style="clear: both">
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<a name="conventions"></a>Conventions Used in This Document</h2></div></div></div>
214ccb21af5d26cadb50ca7a9ecf9a85dfb2cf57vboxsync In this document, we use the following general typographic
214ccb21af5d26cadb50ca7a9ecf9a85dfb2cf57vboxsync conventions:
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync <span class="emphasis"><em>To describe:</em></span>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync <span class="emphasis"><em>We use the style:</em></span>
0b80b22020c2d2c55a20d2a73023f17214e5d6bavboxsync a pathname, filename, URL, hostname,
0b80b22020c2d2c55a20d2a73023f17214e5d6bavboxsync mailing list name, or new term or concept
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync literal user
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync <strong class="userinput"><code>Fixed Width Bold</code></strong>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync program output
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync The following conventions are used in descriptions of the
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync <acronym class="acronym">BIND</acronym> configuration file:</p>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync <span class="emphasis"><em>To describe:</em></span>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync <span class="emphasis"><em>We use the style:</em></span>
1cdc7c917dcbc94f134a0201917a325960bde133vboxsync Optional input
1cdc7c917dcbc94f134a0201917a325960bde133vboxsync [<span class="optional">Text is enclosed in square brackets</span>]
73dbc31308c7ab9165dcd4817a500673234e8d94vboxsync<div class="titlepage"><div><div><h2 class="title" style="clear: both">
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<a name="dns_overview"></a>The Domain Name System (<acronym class="acronym">DNS</acronym>)</h2></div></div></div>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync The purpose of this document is to explain the installation
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync and upkeep of the <acronym class="acronym">BIND</acronym> (Berkeley Internet
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync Name Domain) software package, and we
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync begin by reviewing the fundamentals of the Domain Name System
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync (<acronym class="acronym">DNS</acronym>) as they relate to <acronym class="acronym">BIND</acronym>.
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<a name="dns_fundamentals"></a>DNS Fundamentals</h3></div></div></div>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync The Domain Name System (DNS) is a hierarchical, distributed
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync database. It stores information for mapping Internet host names to
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync addresses and vice versa, mail routing information, and other data
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync used by Internet applications.
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync Clients look up information in the DNS by calling a
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync <span class="emphasis"><em>resolver</em></span> library, which sends queries to one or
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync more <span class="emphasis"><em>name servers</em></span> and interprets the responses.
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync The <acronym class="acronym">BIND</acronym> 9 software distribution
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync contains a name server, <span class="command"><strong>named</strong></span>, and a
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync resolver library, <span class="command"><strong>liblwres</strong></span>.
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<a name="domain_names"></a>Domains and Domain Names</h3></div></div></div>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync The data stored in the DNS is identified by <span class="emphasis"><em>domain names</em></span> that are organized as a tree according to
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync organizational or administrative boundaries. Each node of the tree,
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync called a <span class="emphasis"><em>domain</em></span>, is given a label. The domain
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync name of the
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync node is the concatenation of all the labels on the path from the
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync node to the <span class="emphasis"><em>root</em></span> node. This is represented
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync in written form as a string of labels listed from right to left and
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync separated by dots. A label need only be unique within its parent
0b80b22020c2d2c55a20d2a73023f17214e5d6bavboxsync For example, a domain name for a host at the
0b80b22020c2d2c55a20d2a73023f17214e5d6bavboxsync company <span class="emphasis"><em>Example, Inc.</em></span> could be
0b80b22020c2d2c55a20d2a73023f17214e5d6bavboxsync top level domain to which
0b80b22020c2d2c55a20d2a73023f17214e5d6bavboxsync <code class="literal">ourhost.example.com</code> belongs,
0b80b22020c2d2c55a20d2a73023f17214e5d6bavboxsync a subdomain of <code class="literal">com</code>, and
0b80b22020c2d2c55a20d2a73023f17214e5d6bavboxsync name of the host.
0b80b22020c2d2c55a20d2a73023f17214e5d6bavboxsync For administrative purposes, the name space is partitioned into
0b80b22020c2d2c55a20d2a73023f17214e5d6bavboxsync areas called <span class="emphasis"><em>zones</em></span>, each starting at a node and
0b80b22020c2d2c55a20d2a73023f17214e5d6bavboxsync extending down to the leaf nodes or to nodes where other zones
0b80b22020c2d2c55a20d2a73023f17214e5d6bavboxsync The data for each zone is stored in a <span class="emphasis"><em>name server</em></span>, which answers queries about the zone using the
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync <span class="emphasis"><em>DNS protocol</em></span>.
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync The data associated with each domain name is stored in the
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync form of <span class="emphasis"><em>resource records</em></span> (<acronym class="acronym">RR</acronym>s).
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync Some of the supported resource record types are described in
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync <a class="xref" href="Bv9ARM.ch06.html#types_of_resource_records_and_when_to_use_them" title="Types of Resource Records and When to Use Them">the section called “Types of Resource Records and When to Use Them”</a>.
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync For more detailed information about the design of the DNS and
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync the DNS protocol, please refer to the standards documents listed in
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync <a class="xref" href="Bv9ARM.ch11.html#rfcs" title="Request for Comments (RFCs)">the section called “Request for Comments (RFCs)”</a>.
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync To properly operate a name server, it is important to understand
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync the difference between a <span class="emphasis"><em>zone</em></span>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync and a <span class="emphasis"><em>domain</em></span>.
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync As stated previously, a zone is a point of delegation in
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync the <acronym class="acronym">DNS</acronym> tree. A zone consists of
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync those contiguous parts of the domain
929372c3867cf188f069a440f4aed85837af022evboxsync tree for which a name server has complete information and over which
929372c3867cf188f069a440f4aed85837af022evboxsync it has authority. It contains all domain names from a certain point
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync downward in the domain tree except those which are delegated to
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync other zones. A delegation point is marked by one or more
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync <span class="emphasis"><em>NS records</em></span> in the
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync parent zone, which should be matched by equivalent NS records at
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync the root of the delegated zone.
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync For instance, consider the <code class="literal">example.com</code>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync domain which includes names
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync such as <code class="literal">host.aaa.example.com</code> and
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync <code class="literal">host.bbb.example.com</code> even though
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync the <code class="literal">example.com</code> zone includes
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync only delegations for the <code class="literal">aaa.example.com</code> and
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync <code class="literal">bbb.example.com</code> zones. A zone can
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync exactly to a single domain, but could also include only part of a
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync domain, the rest of which could be delegated to other
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync name servers. Every name in the <acronym class="acronym">DNS</acronym>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync <span class="emphasis"><em>domain</em></span>, even if it is
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync <span class="emphasis"><em>terminal</em></span>, that is, has no
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync <span class="emphasis"><em>subdomains</em></span>. Every subdomain is a domain and
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync every domain except the root is also a subdomain. The terminology is
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync not intuitive and we suggest that you read RFCs 1033, 1034 and 1035
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync gain a complete understanding of this difficult and subtle
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync Though <acronym class="acronym">BIND</acronym> is called a "domain name
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync it deals primarily in terms of zones. The master and slave
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync declarations in the <code class="filename">named.conf</code> file
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync zones, not domains. When you ask some other site if it is willing to
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync be a slave server for your <span class="emphasis"><em>domain</em></span>, you are
a6ff37a401cc2d7445a3fdc9640aeecb17aa5c22vboxsync actually asking for slave service for some collection of zones.
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<a name="auth_servers"></a>Authoritative Name Servers</h3></div></div></div>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync Each zone is served by at least
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync one <span class="emphasis"><em>authoritative name server</em></span>,
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync which contains the complete data for the zone.
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync To make the DNS tolerant of server and network failures,
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync most zones have two or more authoritative servers, on
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync different networks.
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync Responses from authoritative servers have the "authoritative
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync answer" (AA) bit set in the response packets. This makes them
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync easy to identify when debugging DNS configurations using tools like
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync <span class="command"><strong>dig</strong></span> (<a class="xref" href="Bv9ARM.ch03.html#diagnostic_tools" title="Diagnostic Tools">the section called “Diagnostic Tools”</a>).
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<a name="primary_master"></a>The Primary Master</h4></div></div></div>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync The authoritative server where the master copy of the zone
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync data is maintained is called the
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync <span class="emphasis"><em>primary master</em></span> server, or simply the
a6ff37a401cc2d7445a3fdc9640aeecb17aa5c22vboxsync <span class="emphasis"><em>primary</em></span>. Typically it loads the zone
a6ff37a401cc2d7445a3fdc9640aeecb17aa5c22vboxsync contents from some local file edited by humans or perhaps
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync generated mechanically from some other local file which is
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync edited by humans. This file is called the
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync <span class="emphasis"><em>zone file</em></span> or
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync <span class="emphasis"><em>master file</em></span>.
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync In some cases, however, the master file may not be edited
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync by humans at all, but may instead be the result of
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync <span class="emphasis"><em>dynamic update</em></span> operations.
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<a name="slave_server"></a>Slave Servers</h4></div></div></div>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync The other authoritative servers, the <span class="emphasis"><em>slave</em></span>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync servers (also known as <span class="emphasis"><em>secondary</em></span> servers)
a6ff37a401cc2d7445a3fdc9640aeecb17aa5c22vboxsync the zone contents from another server using a replication process
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync known as a <span class="emphasis"><em>zone transfer</em></span>. Typically the data
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync transferred directly from the primary master, but it is also
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync to transfer it from another slave. In other words, a slave server
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync may itself act as a master to a subordinate slave server.
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<a name="stealth_server"></a>Stealth Servers</h4></div></div></div>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync Usually all of the zone's authoritative servers are listed in
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync NS records in the parent zone. These NS records constitute
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync a <span class="emphasis"><em>delegation</em></span> of the zone from the parent.
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync The authoritative servers are also listed in the zone file itself,
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync at the <span class="emphasis"><em>top level</em></span> or <span class="emphasis"><em>apex</em></span>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync of the zone. You can list servers in the zone's top-level NS
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync records that are not in the parent's NS delegation, but you cannot
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync list servers in the parent's delegation that are not present at
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync the zone's top level.
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync A <span class="emphasis"><em>stealth server</em></span> is a server that is
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync authoritative for a zone but is not listed in that zone's NS
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync records. Stealth servers can be used for keeping a local copy of
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync zone to speed up access to the zone's records or to make sure that
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync zone is available even if all the "official" servers for the zone
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync inaccessible.
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync A configuration where the primary master server itself is a
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync stealth server is often referred to as a "hidden primary"
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync configuration. One use for this configuration is when the primary
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync is behind a firewall and therefore unable to communicate directly
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync with the outside world.
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<a name="cache_servers"></a>Caching Name Servers</h3></div></div></div>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync The resolver libraries provided by most operating systems are
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync <span class="emphasis"><em>stub resolvers</em></span>, meaning that they are not
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync performing the full DNS resolution process by themselves by talking
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync directly to the authoritative servers. Instead, they rely on a
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync name server to perform the resolution on their behalf. Such a
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync is called a <span class="emphasis"><em>recursive</em></span> name server; it performs
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync <span class="emphasis"><em>recursive lookups</em></span> for local clients.
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync To improve performance, recursive servers cache the results of
73dbc31308c7ab9165dcd4817a500673234e8d94vboxsync the lookups they perform. Since the processes of recursion and
73dbc31308c7ab9165dcd4817a500673234e8d94vboxsync caching are intimately connected, the terms
73dbc31308c7ab9165dcd4817a500673234e8d94vboxsync <span class="emphasis"><em>recursive server</em></span> and
73dbc31308c7ab9165dcd4817a500673234e8d94vboxsync <span class="emphasis"><em>caching server</em></span> are often used synonymously.
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync The length of time for which a record may be retained in
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync the cache of a caching name server is controlled by the
0b80b22020c2d2c55a20d2a73023f17214e5d6bavboxsync Time To Live (TTL) field associated with each resource record.
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<a name="forwarder"></a>Forwarding</h4></div></div></div>
a6ff37a401cc2d7445a3fdc9640aeecb17aa5c22vboxsync Even a caching name server does not necessarily perform
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync the complete recursive lookup itself. Instead, it can
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync <span class="emphasis"><em>forward</em></span> some or all of the queries
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync that it cannot satisfy from its cache to another caching name
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync commonly referred to as a <span class="emphasis"><em>forwarder</em></span>.
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync There may be one or more forwarders,
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync and they are queried in turn until the list is exhausted or an
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync is found. Forwarders are typically used when you do not
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync wish all the servers at a given site to interact directly with the
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync the Internet servers. A typical scenario would involve a number
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync of internal <acronym class="acronym">DNS</acronym> servers and an
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync Internet firewall. Servers unable
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync to pass packets through the firewall would forward to the server
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync that can do it, and that server would query the Internet <acronym class="acronym">DNS</acronym> servers
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync on the internal server's behalf.
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<a name="multi_role"></a>Name Servers in Multiple Roles</h3></div></div></div>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync The <acronym class="acronym">BIND</acronym> name server can
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync simultaneously act as
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync a master for some zones, a slave for other zones, and as a caching
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync (recursive) server for a set of local clients.
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync However, since the functions of authoritative name service
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync and caching/recursive name service are logically separate, it is
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync often advantageous to run them on separate server machines.
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync A server that only provides authoritative name service
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync (an <span class="emphasis"><em>authoritative-only</em></span> server) can run with
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync recursion disabled, improving reliability and security.
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync A server that is not authoritative for any zones and only provides
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync recursive service to local
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync clients (a <span class="emphasis"><em>caching-only</em></span> server)
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync does not need to be reachable from the Internet at large and can
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync be placed inside a firewall.
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<td width="40%" align="right">�<a accesskey="n" href="Bv9ARM.ch02.html">Next</a>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<td width="40%" align="left" valign="top">BIND 9 Administrator Reference Manual�</td>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<td width="40%" align="right" valign="top">�Chapter�2.�<acronym class="acronym">BIND</acronym> Resource Requirements</td>
febf3f1de573e25fb134b8453a22b0732b4c52e2vboxsync<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.2</p>