Bv9ARM.ch01.html revision 0da02c26a6631c25f075a8e4ac6de9e58f49a0c2
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync - Copyright (C) 2000-2016 Internet Systems Consortium, Inc. ("ISC")
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync - This Source Code Form is subject to the terms of the Mozilla Public
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync - License, v. 2.0. If a copy of the MPL was not distributed with this
23179f1443b03947d85eccc81cbc6b5153a4abf3vboxsync - file, You can obtain one at http://mozilla.org/MPL/2.0/.
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync<link rel="prev" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync<link rel="next" href="Bv9ARM.ch02.html" title="Chapter�2.�BIND Resource Requirements">
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync<tr><th colspan="3" align="center">Chapter�1.�Introduction</th></tr>
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch02.html">Next</a>
d087ca503f848ff64d0cc3c060796758815530f6vboxsync<a name="Bv9ARM.ch01"></a>Chapter�1.�Introduction</h1></div></div></div>
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync<dt><span class="section"><a href="Bv9ARM.ch01.html#doc_scope">Scope of Document</a></span></dt>
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync<dt><span class="section"><a href="Bv9ARM.ch01.html#organization">Organization of This Document</a></span></dt>
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync<dt><span class="section"><a href="Bv9ARM.ch01.html#conventions">Conventions Used in This Document</a></span></dt>
662d52947eeb3fc8fca3b23991a5eee47077f896vboxsync<dt><span class="section"><a href="Bv9ARM.ch01.html#dns_overview">The Domain Name System (<acronym class="acronym">DNS</acronym>)</a></span></dt>
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync<dt><span class="section"><a href="Bv9ARM.ch01.html#dns_fundamentals">DNS Fundamentals</a></span></dt>
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync<dt><span class="section"><a href="Bv9ARM.ch01.html#domain_names">Domains and Domain Names</a></span></dt>
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync<dt><span class="section"><a href="Bv9ARM.ch01.html#zones">Zones</a></span></dt>
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync<dt><span class="section"><a href="Bv9ARM.ch01.html#auth_servers">Authoritative Name Servers</a></span></dt>
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync<dt><span class="section"><a href="Bv9ARM.ch01.html#cache_servers">Caching Name Servers</a></span></dt>
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync<dt><span class="section"><a href="Bv9ARM.ch01.html#multi_role">Name Servers in Multiple Roles</a></span></dt>
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync The Internet Domain Name System (<acronym class="acronym">DNS</acronym>)
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync consists of the syntax
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync to specify the names of entities in the Internet in a hierarchical
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync manner, the rules used for delegating authority over names, and the
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync system implementation that actually maps names to Internet
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync addresses. <acronym class="acronym">DNS</acronym> data is maintained in a
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync group of distributed
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync hierarchical databases.
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync<div class="titlepage"><div><div><h2 class="title" style="clear: both">
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync<a name="doc_scope"></a>Scope of Document</h2></div></div></div>
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync The Berkeley Internet Name Domain
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync (<acronym class="acronym">BIND</acronym>) implements a
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync domain name server for a number of operating systems. This
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync document provides basic information about the installation and
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync care of the Internet Systems Consortium (<acronym class="acronym">ISC</acronym>)
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync <acronym class="acronym">BIND</acronym> version 9 software package for
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync system administrators.
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync <p>This version of the manual corresponds to BIND version 9.11.</p>
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync<div class="titlepage"><div><div><h2 class="title" style="clear: both">
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync<a name="organization"></a>Organization of This Document</h2></div></div></div>
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync In this document, <span class="emphasis"><em>Chapter 1</em></span> introduces
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync the basic <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym> concepts. <span class="emphasis"><em>Chapter 2</em></span>
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync describes resource requirements for running <acronym class="acronym">BIND</acronym> in various
78dfd747e1837f5de0bc5625c39dff4b98e3d4d4vboxsync environments. Information in <span class="emphasis"><em>Chapter 3</em></span> is
78dfd747e1837f5de0bc5625c39dff4b98e3d4d4vboxsync <span class="emphasis"><em>task-oriented</em></span> in its presentation and is
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync organized functionally, to aid in the process of installing the
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync <acronym class="acronym">BIND</acronym> 9 software. The task-oriented
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync section is followed by
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync <span class="emphasis"><em>Chapter 4</em></span>, which contains more advanced
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync concepts that the system administrator may need for implementing
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync certain options. <span class="emphasis"><em>Chapter 5</em></span>
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync describes the <acronym class="acronym">BIND</acronym> 9 lightweight
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync resolver. The contents of <span class="emphasis"><em>Chapter 6</em></span> are
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync organized as in a reference manual to aid in the ongoing
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync maintenance of the software. <span class="emphasis"><em>Chapter 7</em></span> addresses
871e10e7975870a9309c7a9871993337f9d699b2vboxsync security considerations, and
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync <span class="emphasis"><em>Chapter 8</em></span> contains troubleshooting help. The
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync main body of the document is followed by several
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync <span class="emphasis"><em>appendices</em></span> which contain useful reference
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync information, such as a <span class="emphasis"><em>bibliography</em></span> and
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync historic information related to <acronym class="acronym">BIND</acronym>
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync and the Domain Name
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync<div class="titlepage"><div><div><h2 class="title" style="clear: both">
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync<a name="conventions"></a>Conventions Used in This Document</h2></div></div></div>
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync In this document, we use the following general typographic
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync conventions:
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync <span class="emphasis"><em>To describe:</em></span>
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync <span class="emphasis"><em>We use the style:</em></span>
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync a pathname, filename, URL, hostname,
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync mailing list name, or new term or concept
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync literal user
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync <strong class="userinput"><code>Fixed Width Bold</code></strong>
3dd53c06fd54914761cf550503f02fce1ed5a815vboxsync program output
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync The following conventions are used in descriptions of the
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync <acronym class="acronym">BIND</acronym> configuration file:</p>
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync <span class="emphasis"><em>To describe:</em></span>
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync <span class="emphasis"><em>We use the style:</em></span>
d087ca503f848ff64d0cc3c060796758815530f6vboxsync Optional input
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync [<span class="optional">Text is enclosed in square brackets</span>]
23b87301b6b4b64e23d2f7932e43ee5093cd6fd4vboxsync<div class="titlepage"><div><div><h2 class="title" style="clear: both">
23b87301b6b4b64e23d2f7932e43ee5093cd6fd4vboxsync<a name="dns_overview"></a>The Domain Name System (<acronym class="acronym">DNS</acronym>)</h2></div></div></div>
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync The purpose of this document is to explain the installation
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync and upkeep of the <acronym class="acronym">BIND</acronym> (Berkeley Internet
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync Name Domain) software package, and we
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync begin by reviewing the fundamentals of the Domain Name System
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync (<acronym class="acronym">DNS</acronym>) as they relate to <acronym class="acronym">BIND</acronym>.
c7ede00506e75acd368eeba9f264f2e09297fd21vboxsync<a name="dns_fundamentals"></a>DNS Fundamentals</h3></div></div></div>
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync The Domain Name System (DNS) is a hierarchical, distributed
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync database. It stores information for mapping Internet host names to
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync addresses and vice versa, mail routing information, and other data
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync used by Internet applications.
c6e231f4d3a3140918fbf7ff9307b1aec6394877vboxsync Clients look up information in the DNS by calling a
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync <span class="emphasis"><em>resolver</em></span> library, which sends queries to one or
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync more <span class="emphasis"><em>name servers</em></span> and interprets the responses.
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync The <acronym class="acronym">BIND</acronym> 9 software distribution
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync name server, <span class="command"><strong>named</strong></span>, and a resolver
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync library, <span class="command"><strong>liblwres</strong></span>. The older
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync <span class="command"><strong>libbind</strong></span> resolver library is also available
0bbcd928b2a3d73607f224687249c3cec733aee3vboxsync from ISC as a separate download.
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync<a name="domain_names"></a>Domains and Domain Names</h3></div></div></div>
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync The data stored in the DNS is identified by <span class="emphasis"><em>domain names</em></span> that are organized as a tree according to
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync organizational or administrative boundaries. Each node of the tree,
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync called a <span class="emphasis"><em>domain</em></span>, is given a label. The domain
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync name of the
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync node is the concatenation of all the labels on the path from the
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync node to the <span class="emphasis"><em>root</em></span> node. This is represented
57b49c1557a310ee615bc0ee79dd2a2e92319a1bvboxsync in written form as a string of labels listed from right to left and
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync separated by dots. A label need only be unique within its parent
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync For example, a domain name for a host at the
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync company <span class="emphasis"><em>Example, Inc.</em></span> could be
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync top level domain to which
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync <code class="literal">ourhost.example.com</code> belongs,
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync a subdomain of <code class="literal">com</code>, and
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync name of the host.
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync For administrative purposes, the name space is partitioned into
662d52947eeb3fc8fca3b23991a5eee47077f896vboxsync areas called <span class="emphasis"><em>zones</em></span>, each starting at a node and
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync extending down to the leaf nodes or to nodes where other zones
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync The data for each zone is stored in a <span class="emphasis"><em>name server</em></span>, which answers queries about the zone using the
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync <span class="emphasis"><em>DNS protocol</em></span>.
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync The data associated with each domain name is stored in the
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync form of <span class="emphasis"><em>resource records</em></span> (<acronym class="acronym">RR</acronym>s).
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync Some of the supported resource record types are described in
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync <a class="xref" href="Bv9ARM.ch06.html#types_of_resource_records_and_when_to_use_them" title="Types of Resource Records and When to Use Them">the section called “Types of Resource Records and When to Use Them”</a>.
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync For more detailed information about the design of the DNS and
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync the DNS protocol, please refer to the standards documents listed in
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync <a class="xref" href="Bv9ARM.ch11.html#rfcs" title="Request for Comments (RFCs)">the section called “Request for Comments (RFCs)”</a>.
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync To properly operate a name server, it is important to understand
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync the difference between a <span class="emphasis"><em>zone</em></span>
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync and a <span class="emphasis"><em>domain</em></span>.
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync As stated previously, a zone is a point of delegation in
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync the <acronym class="acronym">DNS</acronym> tree. A zone consists of
d087ca503f848ff64d0cc3c060796758815530f6vboxsync those contiguous parts of the domain
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync tree for which a name server has complete information and over which
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync it has authority. It contains all domain names from a certain point
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync downward in the domain tree except those which are delegated to
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync other zones. A delegation point is marked by one or more
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync <span class="emphasis"><em>NS records</em></span> in the
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync parent zone, which should be matched by equivalent NS records at
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync the root of the delegated zone.
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync For instance, consider the <code class="literal">example.com</code>
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync domain which includes names
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync such as <code class="literal">host.aaa.example.com</code> and
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync <code class="literal">host.bbb.example.com</code> even though
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync the <code class="literal">example.com</code> zone includes
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync only delegations for the <code class="literal">aaa.example.com</code> and
d087ca503f848ff64d0cc3c060796758815530f6vboxsync <code class="literal">bbb.example.com</code> zones. A zone can
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync exactly to a single domain, but could also include only part of a
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync domain, the rest of which could be delegated to other
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync name servers. Every name in the <acronym class="acronym">DNS</acronym>
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync <span class="emphasis"><em>domain</em></span>, even if it is
d087ca503f848ff64d0cc3c060796758815530f6vboxsync <span class="emphasis"><em>terminal</em></span>, that is, has no
d087ca503f848ff64d0cc3c060796758815530f6vboxsync <span class="emphasis"><em>subdomains</em></span>. Every subdomain is a domain and
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync every domain except the root is also a subdomain. The terminology is
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync not intuitive and we suggest that you read RFCs 1033, 1034 and 1035
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync gain a complete understanding of this difficult and subtle
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync Though <acronym class="acronym">BIND</acronym> is called a "domain name
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync it deals primarily in terms of zones. The master and slave
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync declarations in the <code class="filename">named.conf</code> file
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync zones, not domains. When you ask some other site if it is willing to
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync be a slave server for your <span class="emphasis"><em>domain</em></span>, you are
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync actually asking for slave service for some collection of zones.
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync<a name="auth_servers"></a>Authoritative Name Servers</h3></div></div></div>
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync Each zone is served by at least
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync one <span class="emphasis"><em>authoritative name server</em></span>,
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync which contains the complete data for the zone.
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync To make the DNS tolerant of server and network failures,
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync most zones have two or more authoritative servers, on
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync different networks.
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync Responses from authoritative servers have the "authoritative
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync answer" (AA) bit set in the response packets. This makes them
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync easy to identify when debugging DNS configurations using tools like
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync <span class="command"><strong>dig</strong></span> (<a class="xref" href="Bv9ARM.ch03.html#diagnostic_tools" title="Diagnostic Tools">the section called “Diagnostic Tools”</a>).
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync<a name="primary_master"></a>The Primary Master</h4></div></div></div>
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync The authoritative server where the master copy of the zone
46fcc16fd8ee95bb4e5c4e662aebcc86248c8ef0vboxsync data is maintained is called the
46fcc16fd8ee95bb4e5c4e662aebcc86248c8ef0vboxsync <span class="emphasis"><em>primary master</em></span> server, or simply the
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync <span class="emphasis"><em>primary</em></span>. Typically it loads the zone
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync contents from some local file edited by humans or perhaps
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync generated mechanically from some other local file which is
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync edited by humans. This file is called the
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync <span class="emphasis"><em>zone file</em></span> or
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync <span class="emphasis"><em>master file</em></span>.
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync In some cases, however, the master file may not be edited
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync by humans at all, but may instead be the result of
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync <span class="emphasis"><em>dynamic update</em></span> operations.
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync<a name="slave_server"></a>Slave Servers</h4></div></div></div>
46fcc16fd8ee95bb4e5c4e662aebcc86248c8ef0vboxsync The other authoritative servers, the <span class="emphasis"><em>slave</em></span>
ac2b2ae448fe887af9a3269e40afff11ebb1f9d3vboxsync servers (also known as <span class="emphasis"><em>secondary</em></span> servers)
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync the zone contents from another server using a replication process
3210d802772fda28654a9ed8e52249bc68439919vboxsync known as a <span class="emphasis"><em>zone transfer</em></span>. Typically the data
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync transferred directly from the primary master, but it is also
3210d802772fda28654a9ed8e52249bc68439919vboxsync to transfer it from another slave. In other words, a slave server
059d5f3885b71a585838612f08cfea528ae1c699vboxsync may itself act as a master to a subordinate slave server.
3210d802772fda28654a9ed8e52249bc68439919vboxsync<a name="stealth_server"></a>Stealth Servers</h4></div></div></div>
3210d802772fda28654a9ed8e52249bc68439919vboxsync Usually all of the zone's authoritative servers are listed in
059d5f3885b71a585838612f08cfea528ae1c699vboxsync NS records in the parent zone. These NS records constitute
3210d802772fda28654a9ed8e52249bc68439919vboxsync a <span class="emphasis"><em>delegation</em></span> of the zone from the parent.
3210d802772fda28654a9ed8e52249bc68439919vboxsync The authoritative servers are also listed in the zone file itself,
059d5f3885b71a585838612f08cfea528ae1c699vboxsync at the <span class="emphasis"><em>top level</em></span> or <span class="emphasis"><em>apex</em></span>
3210d802772fda28654a9ed8e52249bc68439919vboxsync of the zone. You can list servers in the zone's top-level NS
3210d802772fda28654a9ed8e52249bc68439919vboxsync records that are not in the parent's NS delegation, but you cannot
3210d802772fda28654a9ed8e52249bc68439919vboxsync list servers in the parent's delegation that are not present at
3210d802772fda28654a9ed8e52249bc68439919vboxsync the zone's top level.
c6a7efb9f28c7b1fe96721fd5f0c6c33fa1f30e8vboxsync A <span class="emphasis"><em>stealth server</em></span> is a server that is
0bbcd928b2a3d73607f224687249c3cec733aee3vboxsync authoritative for a zone but is not listed in that zone's NS
0bbcd928b2a3d73607f224687249c3cec733aee3vboxsync records. Stealth servers can be used for keeping a local copy of
c6a7efb9f28c7b1fe96721fd5f0c6c33fa1f30e8vboxsync zone to speed up access to the zone's records or to make sure that
3210d802772fda28654a9ed8e52249bc68439919vboxsync zone is available even if all the "official" servers for the zone
3210d802772fda28654a9ed8e52249bc68439919vboxsync inaccessible.
c6a7efb9f28c7b1fe96721fd5f0c6c33fa1f30e8vboxsync A configuration where the primary master server itself is a
3210d802772fda28654a9ed8e52249bc68439919vboxsync stealth server is often referred to as a "hidden primary"
3210d802772fda28654a9ed8e52249bc68439919vboxsync configuration. One use for this configuration is when the primary
3210d802772fda28654a9ed8e52249bc68439919vboxsync is behind a firewall and therefore unable to communicate directly
3210d802772fda28654a9ed8e52249bc68439919vboxsync with the outside world.
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync<a name="cache_servers"></a>Caching Name Servers</h3></div></div></div>
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync The resolver libraries provided by most operating systems are
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync <span class="emphasis"><em>stub resolvers</em></span>, meaning that they are not
70f7b6ff8dc13303a70e552dd7003aa672e985a2vboxsync performing the full DNS resolution process by themselves by talking
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync directly to the authoritative servers. Instead, they rely on a
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync name server to perform the resolution on their behalf. Such a
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync is called a <span class="emphasis"><em>recursive</em></span> name server; it performs
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync <span class="emphasis"><em>recursive lookups</em></span> for local clients.
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync To improve performance, recursive servers cache the results of
4b34a2a15d6421e86cd192dfe63b817d1dab38a1vboxsync the lookups they perform. Since the processes of recursion and
4e5fcef7c6a2263e90ed7b67a5770ae87523e4e2vboxsync caching are intimately connected, the terms
d087ca503f848ff64d0cc3c060796758815530f6vboxsync <span class="emphasis"><em>recursive server</em></span> and
d087ca503f848ff64d0cc3c060796758815530f6vboxsync <span class="emphasis"><em>caching server</em></span> are often used synonymously.
70f7b6ff8dc13303a70e552dd7003aa672e985a2vboxsync The length of time for which a record may be retained in
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync the cache of a caching name server is controlled by the
70f7b6ff8dc13303a70e552dd7003aa672e985a2vboxsync Time To Live (TTL) field associated with each resource record.
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync<a name="forwarder"></a>Forwarding</h4></div></div></div>
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync Even a caching name server does not necessarily perform
d3d793358894cf30c4122856fd6de309aafc6529vboxsync the complete recursive lookup itself. Instead, it can
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync <span class="emphasis"><em>forward</em></span> some or all of the queries
d3d793358894cf30c4122856fd6de309aafc6529vboxsync that it cannot satisfy from its cache to another caching name
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync commonly referred to as a <span class="emphasis"><em>forwarder</em></span>.
8fb6be6f5ae8945f4b7918705a3cc7a96672449cvboxsync There may be one or more forwarders,
8fb6be6f5ae8945f4b7918705a3cc7a96672449cvboxsync and they are queried in turn until the list is exhausted or an
70f7b6ff8dc13303a70e552dd7003aa672e985a2vboxsync is found. Forwarders are typically used when you do not
70f7b6ff8dc13303a70e552dd7003aa672e985a2vboxsync wish all the servers at a given site to interact directly with the
70f7b6ff8dc13303a70e552dd7003aa672e985a2vboxsync the Internet servers. A typical scenario would involve a number
70f7b6ff8dc13303a70e552dd7003aa672e985a2vboxsync of internal <acronym class="acronym">DNS</acronym> servers and an
70f7b6ff8dc13303a70e552dd7003aa672e985a2vboxsync Internet firewall. Servers unable
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync to pass packets through the firewall would forward to the server
d087ca503f848ff64d0cc3c060796758815530f6vboxsync that can do it, and that server would query the Internet <acronym class="acronym">DNS</acronym> servers
d087ca503f848ff64d0cc3c060796758815530f6vboxsync on the internal server's behalf.
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync<a name="multi_role"></a>Name Servers in Multiple Roles</h3></div></div></div>
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync The <acronym class="acronym">BIND</acronym> name server can
70f7b6ff8dc13303a70e552dd7003aa672e985a2vboxsync simultaneously act as
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync a master for some zones, a slave for other zones, and as a caching
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync (recursive) server for a set of local clients.
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync However, since the functions of authoritative name service
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync and caching/recursive name service are logically separate, it is
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync often advantageous to run them on separate server machines.
268d53aeda7383774becd5d847e35ed29559204evboxsync A server that only provides authoritative name service
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync (an <span class="emphasis"><em>authoritative-only</em></span> server) can run with
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync recursion disabled, improving reliability and security.
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync A server that is not authoritative for any zones and only provides
3dd53c06fd54914761cf550503f02fce1ed5a815vboxsync recursive service to local
3dd53c06fd54914761cf550503f02fce1ed5a815vboxsync clients (a <span class="emphasis"><em>caching-only</em></span> server)
47699a0c42ead32866009e0d91bfb349490feaf9vboxsync does not need to be reachable from the Internet at large and can
3dd53c06fd54914761cf550503f02fce1ed5a815vboxsync be placed inside a firewall.
d3d793358894cf30c4122856fd6de309aafc6529vboxsync<td width="40%" align="right">�<a accesskey="n" href="Bv9ARM.ch02.html">Next</a>
c7ede00506e75acd368eeba9f264f2e09297fd21vboxsync<td width="40%" align="left" valign="top">BIND 9 Administrator Reference Manual�</td>
c7ede00506e75acd368eeba9f264f2e09297fd21vboxsync<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
70f7b6ff8dc13303a70e552dd7003aa672e985a2vboxsync<td width="40%" align="right" valign="top">�Chapter�2.�<acronym class="acronym">BIND</acronym> Resource Requirements</td>
57b49c1557a310ee615bc0ee79dd2a2e92319a1bvboxsync<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.1b1</p>