382N/A - Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC") 873N/A - Copyright (C) 2000-2003 Internet Software Consortium. 873N/A - Permission to use, copy, modify, and/or distribute this software for any 873N/A - purpose with or without fee is hereby granted, provided that the above 873N/A - copyright notice and this permission notice appear in all copies. 873N/A - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH 873N/A - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY 873N/A - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, 873N/A - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM 382N/A - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE 873N/A - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR 873N/A - PERFORMANCE OF THIS SOFTWARE. 873N/A<
meta http-
equiv="Content-Type" content="text/html; charset=ISO-8859-1">
382N/A<
title>Chapter�1.�Introduction</
title>
873N/A<
meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
382N/A<
link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
382N/A<
link rel="prev" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
873N/A<
body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
1902N/A<
table width="100%" summary="Navigation header">
2045N/A<
tr><
th colspan="3" align="center">Chapter�1.�Introduction</
th></
tr>
1902N/A<
td width="20%" align="left">
1902N/A<
th width="60%" align="center">�</
th>
873N/A<
div class="chapter" lang="en">
873N/A<
div class="titlepage"><
div><
div><
h2 class="title">
941N/A<
p><
b>Table of Contents</
b></
p>
873N/A<
dt><
span class="sect1"><
a href="Bv9ARM.ch01.html#id2564404">Organization of This Document</
a></
span></
dt>
2028N/A<
dt><
span class="sect1"><
a href="Bv9ARM.ch01.html#id2564544">Conventions Used in This Document</
a></
span></
dt>
2028N/A<
dt><
span class="sect1"><
a href="Bv9ARM.ch01.html#id2564725">The Domain Name System (<
acronym class="acronym">DNS</
acronym>)</
a></
span></
dt>
873N/A<
dt><
span class="sect2"><
a href="Bv9ARM.ch01.html#id2567565">Name Servers in Multiple Roles</
a></
span></
dt>
873N/A The Internet Domain Name System (<
acronym class="acronym">DNS</
acronym>)
873N/A to specify the names of entities in the Internet in a hierarchical
873N/A manner, the rules used for delegating authority over names, and the
2028N/A system implementation that actually maps names to Internet
873N/A addresses. <
acronym class="acronym">DNS</
acronym> data is maintained in a
873N/A hierarchical databases.
1968N/A<
div class="sect1" lang="en">
873N/A<
div class="titlepage"><
div><
div><
h2 class="title" style="clear: both">
1968N/A<
a name="id2564380"></
a>Scope of Document</
h2></
div></
div></
div>
873N/A The Berkeley Internet Name Domain
2028N/A (<
acronym class="acronym">BIND</
acronym>) implements a
1117N/A domain name server for a number of operating systems. This
2028N/A document provides basic information about the installation and
873N/A care of the Internet Systems Consortium (<
acronym class="acronym">ISC</
acronym>)
2028N/A <
acronym class="acronym">BIND</
acronym> version 9 software package for
941N/A This version of the manual corresponds to BIND version 9.10.
873N/A<
div class="sect1" lang="en">
873N/A<
div class="titlepage"><
div><
div><
h2 class="title" style="clear: both">
873N/A<
a name="id2564404"></
a>Organization of This Document</
h2></
div></
div></
div>
1968N/A In this document, <
span class="emphasis"><
em>Chapter 1</
em></
span> introduces
1899N/A the basic <
acronym class="acronym">DNS</
acronym> and <
acronym class="acronym">BIND</
acronym> concepts. <
span class="emphasis"><
em>Chapter 2</
em></
span>
1968N/A describes resource requirements for running <
acronym class="acronym">BIND</
acronym> in various
1968N/A environments. Information in <
span class="emphasis"><
em>Chapter 3</
em></
span> is
1968N/A <
span class="emphasis"><
em>task-oriented</
em></
span> in its presentation and is
1968N/A organized functionally, to aid in the process of installing the
1968N/A <
acronym class="acronym">BIND</
acronym> 9 software. The task-oriented
1968N/A <
span class="emphasis"><
em>Chapter 4</
em></
span>, which contains more advanced
1968N/A concepts that the system administrator may need for implementing
1968N/A certain options. <
span class="emphasis"><
em>Chapter 5</
em></
span>
1968N/A describes the <
acronym class="acronym">BIND</
acronym> 9 lightweight
1968N/A resolver. The contents of <
span class="emphasis"><
em>Chapter 6</
em></
span> are
1968N/A organized as in a reference manual to aid in the ongoing
1968N/A maintenance of the software. <
span class="emphasis"><
em>Chapter 7</
em></
span> addresses
1968N/A security considerations, and
1968N/A <
span class="emphasis"><
em>Chapter 8</
em></
span> contains troubleshooting help. The
1968N/A main body of the document is followed by several
1968N/A <
span class="emphasis"><
em>appendices</
em></
span> which contain useful reference
1968N/A information, such as a <
span class="emphasis"><
em>bibliography</
em></
span> and
1968N/A historic information related to <
acronym class="acronym">BIND</
acronym>
1968N/A<
div class="sect1" lang="en">
1968N/A<
div class="titlepage"><
div><
div><
h2 class="title" style="clear: both">
1968N/A<
a name="id2564544"></
a>Conventions Used in This Document</
h2></
div></
div></
div>
1968N/A In this document, we use the following general typographic
1968N/A<
div class="informaltable"><
table border="1">
1968N/A <
span class="emphasis"><
em>To describe:</
em></
span>
1968N/A <
span class="emphasis"><
em>We use the style:</
em></
span>
873N/A a pathname, filename, URL, hostname,
873N/A mailing list name, or new term or concept
873N/A <
code class="filename">Fixed width</
code>
2028N/A <
strong class="userinput"><
code>Fixed Width Bold</
code></
strong>
1117N/A <
code class="computeroutput">Fixed Width</
code>
873N/A The following conventions are used in descriptions of the
1117N/A <
acronym class="acronym">BIND</
acronym> configuration file:</
p>
2028N/A<
div class="informaltable"><
table border="1">
873N/A <
span class="emphasis"><
em>To describe:</
em></
span>
2028N/A <
span class="emphasis"><
em>We use the style:</
em></
span>
1968N/A <
code class="literal">Fixed Width</
code>
2028N/A <
code class="varname">Fixed Width</
code>
873N/A [<
span class="optional">Text is enclosed in square brackets</
span>]
873N/A<
div class="sect1" lang="en">
1968N/A<
div class="titlepage"><
div><
div><
h2 class="title" style="clear: both">
1968N/A<
a name="id2564725"></
a>The Domain Name System (<
acronym class="acronym">DNS</
acronym>)</
h2></
div></
div></
div>
1968N/A The purpose of this document is to explain the installation
1968N/A and upkeep of the <
acronym class="acronym">BIND</
acronym> (Berkeley Internet
1968N/A Name Domain) software package, and we
1968N/A begin by reviewing the fundamentals of the Domain Name System
1968N/A (<
acronym class="acronym">DNS</
acronym>) as they relate to <
acronym class="acronym">BIND</
acronym>.
1968N/A<
div class="sect2" lang="en">
1968N/A<
div class="titlepage"><
div><
div><
h3 class="title">
1968N/A<
a name="id2564746"></
a>DNS Fundamentals</
h3></
div></
div></
div>
873N/A The Domain Name System (DNS) is a hierarchical, distributed
873N/A database. It stores information for mapping Internet host names to
873N/A addresses and vice versa, mail routing information, and other data
873N/A used by Internet applications.
873N/A Clients look up information in the DNS by calling a
873N/A <
span class="emphasis"><
em>resolver</
em></
span> library, which sends queries to one or
873N/A more <
span class="emphasis"><
em>name servers</
em></
span> and interprets the responses.
873N/A The <
acronym class="acronym">BIND</
acronym> 9 software distribution
1431N/A name server, <
span><
strong class="command">named</
strong></
span>, and a resolver
1431N/A library, <
span><
strong class="command">liblwres</
strong></
span>. The older
1431N/A <
span><
strong class="command">libbind</
strong></
span> resolver library is also available
2028N/A from ISC as a separate download.
873N/A<
div class="sect2" lang="en">
873N/A<
div class="titlepage"><
div><
div><
h3 class="title">
873N/A<
a name="id2564849"></
a>Domains and Domain Names</
h3></
div></
div></
div>
2028N/A The data stored in the DNS is identified by <
span class="emphasis"><
em>domain names</
em></
span> that are organized as a tree according to
873N/A organizational or administrative boundaries. Each node of the tree,
873N/A called a <
span class="emphasis"><
em>domain</
em></
span>, is given a label. The domain
873N/A node is the concatenation of all the labels on the path from the
873N/A node to the <
span class="emphasis"><
em>root</
em></
span> node. This is represented
873N/A in written form as a string of labels listed from right to left and
873N/A separated by dots. A label need only be unique within its parent
2028N/A For example, a domain name for a host at the
2028N/A company <
span class="emphasis"><
em>Example, Inc.</
em></
span> could be
2028N/A where <
code class="literal">com</
code> is the
2028N/A <
code class="literal">example</
code> is
2028N/A a subdomain of <
code class="literal">com</
code>, and
2028N/A <
code class="literal">ourhost</
code> is the
873N/A For administrative purposes, the name space is partitioned into
2045N/A areas called <
span class="emphasis"><
em>zones</
em></
span>, each starting at a node and
2045N/A extending down to the leaf nodes or to nodes where other zones
1151N/A The data for each zone is stored in a <
span class="emphasis"><
em>name server</
em></
span>, which answers queries about the zone using the
1151N/A <
span class="emphasis"><
em>DNS protocol</
em></
span>.
2028N/A The data associated with each domain name is stored in the
2028N/A form of <
span class="emphasis"><
em>resource records</
em></
span> (<
acronym class="acronym">RR</
acronym>s).
2028N/A Some of the supported resource record types are described in
2028N/A <
a href="Bv9ARM.ch06.html#types_of_resource_records_and_when_to_use_them" title="Types of Resource Records and When to Use Them">the section called “Types of Resource Records and When to Use Them”</
a>.
2065N/A For more detailed information about the design of the DNS and
2065N/A the DNS protocol, please refer to the standards documents listed in
2065N/A <
a href="Bv9ARM.ch09.html#rfcs" title="Request for Comments (RFCs)">the section called “Request for Comments (RFCs)”</
a>.
2065N/A<
div class="sect2" lang="en">
2065N/A<
div class="titlepage"><
div><
div><
h3 class="title">
2065N/A<
a name="id2567186"></
a>Zones</
h3></
div></
div></
div>
2065N/A To properly operate a name server, it is important to understand
2045N/A the difference between a <
span class="emphasis"><
em>zone</
em></
span>
2045N/A and a <
span class="emphasis"><
em>domain</
em></
span>.
2045N/A As stated previously, a zone is a point of delegation in
2045N/A the <
acronym class="acronym">DNS</
acronym> tree. A zone consists of
2045N/A those contiguous parts of the domain
2045N/A tree for which a name server has complete information and over which
2045N/A it has authority. It contains all domain names from a certain point
2045N/A downward in the domain tree except those which are delegated to
2045N/A other zones. A delegation point is marked by one or more
2045N/A <
span class="emphasis"><
em>NS records</
em></
span> in the
2045N/A parent zone, which should be matched by equivalent NS records at
2045N/A the root of the delegated zone.
2028N/A domain which includes names
2028N/A exactly to a single domain, but could also include only part of a
2028N/A domain, the rest of which could be delegated to other
2028N/A name servers. Every name in the <
acronym class="acronym">DNS</
acronym>
2028N/A <
span class="emphasis"><
em>domain</
em></
span>, even if it is
2028N/A <
span class="emphasis"><
em>terminal</
em></
span>, that is, has no
2028N/A <
span class="emphasis"><
em>subdomains</
em></
span>. Every subdomain is a domain and
2028N/A every domain except the root is also a subdomain. The terminology is
2028N/A not intuitive and we suggest that you read RFCs 1033, 1034 and 1035
2028N/A gain a complete understanding of this difficult and subtle
1899N/A Though <
acronym class="acronym">BIND</
acronym> is called a "domain name
1899N/A it deals primarily in terms of zones. The master and slave
1899N/A zones, not domains. When you ask some other site if it is willing to
1899N/A be a slave server for your <
span class="emphasis"><
em>domain</
em></
span>, you are
1899N/A actually asking for slave service for some collection of zones.
1899N/A<
div class="sect2" lang="en">
1899N/A<
div class="titlepage"><
div><
div><
h3 class="title">
1899N/A<
a name="id2567262"></
a>Authoritative Name Servers</
h3></
div></
div></
div>
1899N/A Each zone is served by at least
1899N/A one <
span class="emphasis"><
em>authoritative name server</
em></
span>,
2028N/A which contains the complete data for the zone.
2028N/A To make the DNS tolerant of server and network failures,
2028N/A most zones have two or more authoritative servers, on
2028N/A Responses from authoritative servers have the "authoritative
2028N/A answer" (AA) bit set in the response packets. This makes them
2028N/A easy to identify when debugging DNS configurations using tools like
2028N/A <
span><
strong class="command">dig</
strong></
span> (<
a href="Bv9ARM.ch03.html#diagnostic_tools" title="Diagnostic Tools">the section called “Diagnostic Tools”</
a>).
2028N/A<
div class="sect3" lang="en">
2028N/A<
div class="titlepage"><
div><
div><
h4 class="title">
2028N/A<
a name="id2567286"></
a>The Primary Master</
h4></
div></
div></
div>
2028N/A The authoritative server where the master copy of the zone
2028N/A data is maintained is called the
2028N/A <
span class="emphasis"><
em>primary master</
em></
span> server, or simply the
2028N/A <
span class="emphasis"><
em>primary</
em></
span>. Typically it loads the zone
1899N/A contents from some local file edited by humans or perhaps
1899N/A generated mechanically from some other local file which is
1899N/A edited by humans. This file is called the
1899N/A <
span class="emphasis"><
em>zone file</
em></
span> or
1899N/A <
span class="emphasis"><
em>master file</
em></
span>.
1899N/A In some cases, however, the master file may not be edited
1899N/A by humans at all, but may instead be the result of
2011N/A <
span class="emphasis"><
em>dynamic update</
em></
span> operations.
1899N/A<
div class="sect3" lang="en">
1899N/A<
div class="titlepage"><
div><
div><
h4 class="title">
1899N/A<
a name="id2567384"></
a>Slave Servers</
h4></
div></
div></
div>
1899N/A The other authoritative servers, the <
span class="emphasis"><
em>slave</
em></
span>
1899N/A servers (also known as <
span class="emphasis"><
em>secondary</
em></
span> servers)
1431N/A the zone contents from another server using a replication process
2115N/A known as a <
span class="emphasis"><
em>zone transfer</
em></
span>. Typically the data
1968N/A transferred directly from the primary master, but it is also
1968N/A to transfer it from another slave. In other words, a slave server
1968N/A may itself act as a master to a subordinate slave server.
1968N/A<
div class="sect3" lang="en">
1151N/A<
div class="titlepage"><
div><
div><
h4 class="title">
2115N/A<
a name="id2567405"></
a>Stealth Servers</
h4></
div></
div></
div>
2115N/A Usually all of the zone's authoritative servers are listed in
2028N/A NS records in the parent zone. These NS records constitute
2028N/A a <
span class="emphasis"><
em>delegation</
em></
span> of the zone from the parent.
2028N/A The authoritative servers are also listed in the zone file itself,
2028N/A at the <
span class="emphasis"><
em>top level</
em></
span> or <
span class="emphasis"><
em>apex</
em></
span>
2028N/A of the zone. You can list servers in the zone's top-level NS
2028N/A records that are not in the parent's NS delegation, but you cannot
2028N/A list servers in the parent's delegation that are not present at
2028N/A A <
span class="emphasis"><
em>stealth server</
em></
span> is a server that is
2028N/A authoritative for a zone but is not listed in that zone's NS
2028N/A records. Stealth servers can be used for keeping a local copy of
2028N/A zone to speed up access to the zone's records or to make sure that
2028N/A zone is available even if all the "official" servers for the zone
873N/A A configuration where the primary master server itself is a
873N/A stealth server is often referred to as a "hidden primary"
873N/A configuration. One use for this configuration is when the primary
873N/A is behind a firewall and therefore unable to communicate directly
873N/A<
div class="sect2" lang="en">
873N/A<
div class="titlepage"><
div><
div><
h3 class="title">
873N/A<
a name="id2567435"></
a>Caching Name Servers</
h3></
div></
div></
div>
873N/A The resolver libraries provided by most operating systems are
873N/A <
span class="emphasis"><
em>stub resolvers</
em></
span>, meaning that they are not
2028N/A performing the full DNS resolution process by themselves by talking
2028N/A directly to the authoritative servers. Instead, they rely on a
873N/A name server to perform the resolution on their behalf. Such a
873N/A is called a <
span class="emphasis"><
em>recursive</
em></
span> name server; it performs
873N/A <
span class="emphasis"><
em>recursive lookups</
em></
span> for local clients.
2028N/A To improve performance, recursive servers cache the results of
2028N/A the lookups they perform. Since the processes of recursion and
873N/A caching are intimately connected, the terms
873N/A <
span class="emphasis"><
em>recursive server</
em></
span> and
873N/A <
span class="emphasis"><
em>caching server</
em></
span> are often used synonymously.
873N/A The length of time for which a record may be retained in
873N/A the cache of a caching name server is controlled by the
2028N/A Time To Live (TTL) field associated with each resource record.
2028N/A<
div class="sect3" lang="en">
2028N/A<
div class="titlepage"><
div><
div><
h4 class="title">
2028N/A<
a name="id2567539"></
a>Forwarding</
h4></
div></
div></
div>
2028N/A Even a caching name server does not necessarily perform
2028N/A the complete recursive lookup itself. Instead, it can
2028N/A <
span class="emphasis"><
em>forward</
em></
span> some or all of the queries
2028N/A that it cannot satisfy from its cache to another caching name
2028N/A commonly referred to as a <
span class="emphasis"><
em>forwarder</
em></
span>.
2028N/A There may be one or more forwarders,
2028N/A and they are queried in turn until the list is exhausted or an
2028N/A is found. Forwarders are typically used when you do not
2028N/A wish all the servers at a given site to interact directly with the
2028N/A the Internet servers. A typical scenario would involve a number
2028N/A of internal <
acronym class="acronym">DNS</
acronym> servers and an
2028N/A Internet firewall. Servers unable
2028N/A to pass packets through the firewall would forward to the server
2028N/A that can do it, and that server would query the Internet <
acronym class="acronym">DNS</
acronym> servers
2028N/A on the internal server's behalf.
1899N/A<
div class="sect2" lang="en">
1899N/A<
div class="titlepage"><
div><
div><
h3 class="title">
873N/A<
a name="id2567565"></
a>Name Servers in Multiple Roles</
h3></
div></
div></
div>
873N/A The <
acronym class="acronym">BIND</
acronym> name server can
1899N/A a master for some zones, a slave for other zones, and as a caching
873N/A (recursive) server for a set of local clients.
873N/A However, since the functions of authoritative name service
873N/A often advantageous to run them on separate server machines.
873N/A A server that only provides authoritative name service
873N/A (an <
span class="emphasis"><
em>authoritative-only</
em></
span> server) can run with
873N/A recursion disabled, improving reliability and security.
873N/A A server that is not authoritative for any zones and only provides
1899N/A clients (a <
span class="emphasis"><
em>caching-only</
em></
span> server)
873N/A does not need to be reachable from the Internet at large and can
873N/A be placed inside a firewall.
941N/A<
table width="100%" summary="Navigation footer">
873N/A<
td width="40%" align="left">
2028N/A<
td width="20%" align="center">�</
td>
873N/A<
td width="40%" align="left" valign="top">BIND 9 Administrator Reference Manual�</
td>
873N/A<
td width="20%" align="center"><
a accesskey="h" href="Bv9ARM.html">Home</
a></
td>
873N/A<
td width="40%" align="right" valign="top">�Chapter�2.�<
acronym class="acronym">BIND</
acronym> Resource Requirements</
td>