Bv9ARM.ch01.html revision d024bae030b8530eb46932c304a6d4fdecbaf38a
dcfda24abf565c442d058cbf81b2180d847a1b3eAutomatic Updater - Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
75c0816e8295e180f4bc7f10db3d0d880383bc1cMark Andrews - Copyright (C) 2000-2003 Internet Software Consortium.
4a14ce5ba00ab7bc55c99ffdcf59c7a4ab902721Automatic Updater - Permission to use, copy, modify, and distribute this software for any
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - purpose with or without fee is hereby granted, provided that the above
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - copyright notice and this permission notice appear in all copies.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein - PERFORMANCE OF THIS SOFTWARE.
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater<!-- $Id: Bv9ARM.ch01.html,v 1.32 2006/11/08 02:08:04 marka Exp $ -->
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
e21a2904f02a03fa06b6db04d348f65fe9c67b2bMark Andrews<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="prev" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<link rel="next" href="Bv9ARM.ch02.html" title="Chapter�2.�BIND Resource Requirements">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<tr><th colspan="3" align="center">Chapter�1.�Introduction</th></tr>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a accesskey="p" href="Bv9ARM.html">Prev</a>�</td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch02.html">Next</a>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h2 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="Bv9ARM.ch01"></a>Chapter�1.�Introduction</h2></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2569703">Scope of Document</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2569837">Organization of This Document</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2569781">Conventions Used in This Document</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2570167">The Domain Name System (<acronym class="acronym">DNS</acronym>)</a></span></dt>
f77c5a1336bc11ae235f1b91f1b7cbae1137c3e8Automatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2570188">DNS Fundamentals</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2570222">Domains and Domain Names</a></span></dt>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2570307">Zones</a></span></dt>
f77c5a1336bc11ae235f1b91f1b7cbae1137c3e8Automatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2572705">Authoritative Name Servers</a></span></dt>
f77c5a1336bc11ae235f1b91f1b7cbae1137c3e8Automatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2572877">Caching Name Servers</a></span></dt>
f77c5a1336bc11ae235f1b91f1b7cbae1137c3e8Automatic Updater<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2573144">Name Servers in Multiple Roles</a></span></dt>
f77c5a1336bc11ae235f1b91f1b7cbae1137c3e8Automatic Updater The Internet Domain Name System (<acronym class="acronym">DNS</acronym>)
f77c5a1336bc11ae235f1b91f1b7cbae1137c3e8Automatic Updater consists of the syntax
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to specify the names of entities in the Internet in a hierarchical
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein manner, the rules used for delegating authority over names, and the
f77c5a1336bc11ae235f1b91f1b7cbae1137c3e8Automatic Updater system implementation that actually maps names to Internet
f77c5a1336bc11ae235f1b91f1b7cbae1137c3e8Automatic Updater addresses. <acronym class="acronym">DNS</acronym> data is maintained in a
f77c5a1336bc11ae235f1b91f1b7cbae1137c3e8Automatic Updater group of distributed
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater hierarchical databases.
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater<div class="titlepage"><div><div><h2 class="title" style="clear: both">
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater<a name="id2569703"></a>Scope of Document</h2></div></div></div>
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater The Berkeley Internet Name Domain
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater (<acronym class="acronym">BIND</acronym>) implements a
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater domain name server for a number of operating systems. This
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater document provides basic information about the installation and
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater care of the Internet Systems Consortium (<acronym class="acronym">ISC</acronym>)
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater <acronym class="acronym">BIND</acronym> version 9 software package for
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater system administrators.
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater This version of the manual corresponds to BIND version 9.4.
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater<div class="titlepage"><div><div><h2 class="title" style="clear: both">
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater<a name="id2569837"></a>Organization of This Document</h2></div></div></div>
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater In this document, <span class="emphasis"><em>Section 1</em></span> introduces
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater the basic <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym> concepts. <span class="emphasis"><em>Section 2</em></span>
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater describes resource requirements for running <acronym class="acronym">BIND</acronym> in various
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater environments. Information in <span class="emphasis"><em>Section 3</em></span> is
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater <span class="emphasis"><em>task-oriented</em></span> in its presentation and is
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater organized functionally, to aid in the process of installing the
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater <acronym class="acronym">BIND</acronym> 9 software. The task-oriented
6f64d4ab8e68f9b2333bcbfc755396d29a4a9d7cAutomatic Updater section is followed by
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater <span class="emphasis"><em>Section 4</em></span>, which contains more advanced
f77c5a1336bc11ae235f1b91f1b7cbae1137c3e8Automatic Updater concepts that the system administrator may need for implementing
44d0f0256fbdce130a18655023c3b06bacacbd61Automatic Updater certain options. <span class="emphasis"><em>Section 5</em></span>
f77c5a1336bc11ae235f1b91f1b7cbae1137c3e8Automatic Updater describes the <acronym class="acronym">BIND</acronym> 9 lightweight
f77c5a1336bc11ae235f1b91f1b7cbae1137c3e8Automatic Updater resolver. The contents of <span class="emphasis"><em>Section 6</em></span> are
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein organized as in a reference manual to aid in the ongoing
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein maintenance of the software. <span class="emphasis"><em>Section 7</em></span> addresses
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein security considerations, and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="emphasis"><em>Section 8</em></span> contains troubleshooting help. The
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein main body of the document is followed by several
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="emphasis"><em>Appendices</em></span> which contain useful reference
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein information, such as a <span class="emphasis"><em>Bibliography</em></span> and
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews historic information related to <acronym class="acronym">BIND</acronym>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and the Domain Name
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h2 class="title" style="clear: both">
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews<a name="id2569781"></a>Conventions Used in This Document</h2></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein In this document, we use the following general typographic
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein conventions:
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews <span class="emphasis"><em>To describe:</em></span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="emphasis"><em>We use the style:</em></span>
acb72d5e2c83b597332e3eb0c7d59e1142f1adfdMark Andrews a pathname, filename, URL, hostname,
3cddb2c552ee6582e8db0849c28747f6b6ca57feAutomatic Updater mailing list name, or new term or concept
66f25f2ceeb589e67efe7af2413baaa3426b0042Automatic Updater <strong class="userinput"><code>Fixed Width Bold</code></strong>
38417cbfb1a328c20b5b723b8584a02c57f88897Automatic Updater program output
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The following conventions are used in descriptions of the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <acronym class="acronym">BIND</acronym> configuration file:</p>
3a5fe5abf08f16b8d31ab8ee9a788063110ef000Automatic Updater <span class="emphasis"><em>To describe:</em></span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="emphasis"><em>We use the style:</em></span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Optional input
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein [<span class="optional">Text is enclosed in square brackets</span>]
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h2 class="title" style="clear: both">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="id2570167"></a>The Domain Name System (<acronym class="acronym">DNS</acronym>)</h2></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The purpose of this document is to explain the installation
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and upkeep of the <acronym class="acronym">BIND</acronym> software
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews package, and we
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein begin by reviewing the fundamentals of the Domain Name System
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (<acronym class="acronym">DNS</acronym>) as they relate to <acronym class="acronym">BIND</acronym>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="id2570188"></a>DNS Fundamentals</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The Domain Name System (DNS) is a hierarchical, distributed
f77c5a1336bc11ae235f1b91f1b7cbae1137c3e8Automatic Updater database. It stores information for mapping Internet host names to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein addresses and vice versa, mail routing information, and other data
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews used by Internet applications.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Clients look up information in the DNS by calling a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="emphasis"><em>resolver</em></span> library, which sends queries to one or
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein more <span class="emphasis"><em>name servers</em></span> and interprets the responses.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The <acronym class="acronym">BIND</acronym> 9 software distribution
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein name server, <span><strong class="command">named</strong></span>, and two resolver
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein libraries, <span><strong class="command">liblwres</strong></span> and <span><strong class="command">libbind</strong></span>.
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<div class="titlepage"><div><div><h3 class="title">
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews<a name="id2570222"></a>Domains and Domain Names</h3></div></div></div>
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews The data stored in the DNS is identified by <span class="emphasis"><em>domain names</em></span> that are organized as a tree according to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein organizational or administrative boundaries. Each node of the tree,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein called a <span class="emphasis"><em>domain</em></span>, is given a label. The domain
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein node is the concatenation of all the labels on the path from the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein node to the <span class="emphasis"><em>root</em></span> node. This is represented
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein in written form as a string of labels listed from right to left and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein separated by dots. A label need only be unique within its parent
f77c5a1336bc11ae235f1b91f1b7cbae1137c3e8Automatic Updater For example, a domain name for a host at the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein company <span class="emphasis"><em>Example, Inc.</em></span> could be
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="literal">ourhost.example.com</code>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein top level domain to which
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="literal">ourhost.example.com</code> belongs,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a subdomain of <code class="literal">com</code>, and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein name of the host.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein For administrative purposes, the name space is partitioned into
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein areas called <span class="emphasis"><em>zones</em></span>, each starting at a node and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein extending down to the leaf nodes or to nodes where other zones
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The data for each zone is stored in a <span class="emphasis"><em>name server</em></span>, which answers queries about the zone using the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="emphasis"><em>DNS protocol</em></span>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The data associated with each domain name is stored in the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein form of <span class="emphasis"><em>resource records</em></span> (<acronym class="acronym">RR</acronym>s).
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Some of the supported resource record types are described in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <a href="Bv9ARM.ch06.html#types_of_resource_records_and_when_to_use_them" title="Types of Resource Records and When to Use Them">the section called “Types of Resource Records and When to Use Them”</a>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein For more detailed information about the design of the DNS and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the DNS protocol, please refer to the standards documents listed in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <a href="Bv9ARM.ch09.html#rfcs" title="Request for Comments (RFCs)">the section called “Request for Comments (RFCs)”</a>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="id2570307"></a>Zones</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein To properly operate a name server, it is important to understand
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the difference between a <span class="emphasis"><em>zone</em></span>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and a <span class="emphasis"><em>domain</em></span>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein As stated previously, a zone is a point of delegation in
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the <acronym class="acronym">DNS</acronym> tree. A zone consists of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein those contiguous parts of the domain
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein tree for which a name server has complete information and over which
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein it has authority. It contains all domain names from a certain point
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein downward in the domain tree except those which are delegated to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein other zones. A delegation point is marked by one or more
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="emphasis"><em>NS records</em></span> in the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein parent zone, which should be matched by equivalent NS records at
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the root of the delegated zone.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein For instance, consider the <code class="literal">example.com</code>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein domain which includes names
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein such as <code class="literal">host.aaa.example.com</code> and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="literal">host.bbb.example.com</code> even though
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the <code class="literal">example.com</code> zone includes
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein only delegations for the <code class="literal">aaa.example.com</code> and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <code class="literal">bbb.example.com</code> zones. A zone can
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein exactly to a single domain, but could also include only part of a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein domain, the rest of which could be delegated to other
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein name servers. Every name in the <acronym class="acronym">DNS</acronym>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="emphasis"><em>domain</em></span>, even if it is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="emphasis"><em>terminal</em></span>, that is, has no
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="emphasis"><em>subdomains</em></span>. Every subdomain is a domain and
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein every domain except the root is also a subdomain. The terminology is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein not intuitive and we suggest that you read RFCs 1033, 1034 and 1035
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein gain a complete understanding of this difficult and subtle
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Though <acronym class="acronym">BIND</acronym> is called a "domain name
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein it deals primarily in terms of zones. The master and slave
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein declarations in the <code class="filename">named.conf</code> file
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein zones, not domains. When you ask some other site if it is willing to
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein be a slave server for your <span class="emphasis"><em>domain</em></span>, you are
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein actually asking for slave service for some collection of zones.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="id2572705"></a>Authoritative Name Servers</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Each zone is served by at least
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein one <span class="emphasis"><em>authoritative name server</em></span>,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein which contains the complete data for the zone.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein To make the DNS tolerant of server and network failures,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein most zones have two or more authoritative servers, on
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein different networks.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Responses from authoritative servers have the "authoritative
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein answer" (AA) bit set in the response packets. This makes them
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein easy to identify when debugging DNS configurations using tools like
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span><strong class="command">dig</strong></span> (<a href="Bv9ARM.ch03.html#diagnostic_tools" title="Diagnostic Tools">the section called “Diagnostic Tools”</a>).
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h4 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="id2572728"></a>The Primary Master</h4></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The authoritative server where the master copy of the zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein data is maintained is called the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="emphasis"><em>primary master</em></span> server, or simply the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="emphasis"><em>primary</em></span>. Typically it loads the zone
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein contents from some local file edited by humans or perhaps
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein generated mechanically from some other local file which is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein edited by humans. This file is called the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="emphasis"><em>zone file</em></span> or
47012ae6dbf18a2503d7b33c1c9583dc38625cb7Mark Andrews <span class="emphasis"><em>master file</em></span>.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein In some cases, however, the master file may not be edited
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein by humans at all, but may instead be the result of
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein <span class="emphasis"><em>dynamic update</em></span> operations.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<div class="titlepage"><div><div><h4 class="title">
c71787bd6356c92e9c7d0a174cd63ab17fcf34c6Eric Luce<a name="id2572758"></a>Slave Servers</h4></div></div></div>
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce The other authoritative servers, the <span class="emphasis"><em>slave</em></span>
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce servers (also known as <span class="emphasis"><em>secondary</em></span> servers)
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater the zone contents from another server using a replication process
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater known as a <span class="emphasis"><em>zone transfer</em></span>. Typically the data
c71787bd6356c92e9c7d0a174cd63ab17fcf34c6Eric Luce transferred directly from the primary master, but it is also
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater to transfer it from another slave. In other words, a slave server
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater may itself act as a master to a subordinate slave server.
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce<div class="titlepage"><div><div><h4 class="title">
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce<a name="id2572848"></a>Stealth Servers</h4></div></div></div>
c71787bd6356c92e9c7d0a174cd63ab17fcf34c6Eric Luce Usually all of the zone's authoritative servers are listed in
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater NS records in the parent zone. These NS records constitute
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater a <span class="emphasis"><em>delegation</em></span> of the zone from the parent.
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce The authoritative servers are also listed in the zone file itself,
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce at the <span class="emphasis"><em>top level</em></span> or <span class="emphasis"><em>apex</em></span>
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater of the zone. You can list servers in the zone's top-level NS
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater records that are not in the parent's NS delegation, but you cannot
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce list servers in the parent's delegation that are not present at
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce the zone's top level.
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater A <span class="emphasis"><em>stealth server</em></span> is a server that is
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater authoritative for a zone but is not listed in that zone's NS
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce records. Stealth servers can be used for keeping a local copy of
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce zone to speed up access to the zone's records or to make sure that
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce zone is available even if all the "official" servers for the zone
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce inaccessible.
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce A configuration where the primary master server itself is a
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce stealth server is often referred to as a "hidden primary"
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce configuration. One use for this configuration is when the primary
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce is behind a firewall and therefore unable to communicate directly
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce with the outside world.
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce<div class="titlepage"><div><div><h3 class="title">
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce<a name="id2572877"></a>Caching Name Servers</h3></div></div></div>
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce The resolver libraries provided by most operating systems are
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce <span class="emphasis"><em>stub resolvers</em></span>, meaning that they are not
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein performing the full DNS resolution process by themselves by talking
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein directly to the authoritative servers. Instead, they rely on a
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein name server to perform the resolution on their behalf. Such a
c71787bd6356c92e9c7d0a174cd63ab17fcf34c6Eric Luce is called a <span class="emphasis"><em>recursive</em></span> name server; it performs
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce <span class="emphasis"><em>recursive lookups</em></span> for local clients.
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce To improve performance, recursive servers cache the results of
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce the lookups they perform. Since the processes of recursion and
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater caching are intimately connected, the terms
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater <span class="emphasis"><em>recursive server</em></span> and
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater <span class="emphasis"><em>caching server</em></span> are often used synonymously.
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater The length of time for which a record may be retained in
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater the cache of a caching name server is controlled by the
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater Time To Live (TTL) field associated with each resource record.
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce<div class="titlepage"><div><div><h4 class="title">
c71787bd6356c92e9c7d0a174cd63ab17fcf34c6Eric Luce<a name="id2573117"></a>Forwarding</h4></div></div></div>
ac93437301f55ed69bf85883a497a75598c628f9Automatic Updater Even a caching name server does not necessarily perform
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce the complete recursive lookup itself. Instead, it can
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce <span class="emphasis"><em>forward</em></span> some or all of the queries
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce that it cannot satisfy from its cache to another caching name
c71787bd6356c92e9c7d0a174cd63ab17fcf34c6Eric Luce commonly referred to as a <span class="emphasis"><em>forwarder</em></span>.
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce There may be one or more forwarders,
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce and they are queried in turn until the list is exhausted or an
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce is found. Forwarders are typically used when you do not
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein wish all the servers at a given site to interact directly with the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein the Internet servers. A typical scenario would involve a number
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein of internal <acronym class="acronym">DNS</acronym> servers and an
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein Internet firewall. Servers unable
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein to pass packets through the firewall would forward to the server
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein that can do it, and that server would query the Internet <acronym class="acronym">DNS</acronym> servers
f293a69bcd1c1dd7bdac8f4102fc2398b9e475c8Eric Luce on the internal server's behalf.
bea931e17b7567f09107f93ab7e25c7f00abeb9cMark Andrews<div class="titlepage"><div><div><h3 class="title">
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a name="id2573144"></a>Name Servers in Multiple Roles</h3></div></div></div>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein The <acronym class="acronym">BIND</acronym> name server can
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein simultaneously act as
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein a master for some zones, a slave for other zones, and as a caching
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews (recursive) server for a set of local clients.
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews However, since the functions of authoritative name service
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein and caching/recursive name service are logically separate, it is
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein often advantageous to run them on separate server machines.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein A server that only provides authoritative name service
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein (an <span class="emphasis"><em>authoritative-only</em></span> server) can run with
71c66a876ecca77923638d3f94cc0783152b2f03Mark Andrews recursion disabled, improving reliability and security.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein A server that is not authoritative for any zones and only provides
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein recursive service to local
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews clients (a <span class="emphasis"><em>caching-only</em></span> server)
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews does not need to be reachable from the Internet at large and can
5a4557e8de2951a2796676b5ec4b6a90caa5be14Mark Andrews be placed inside a firewall.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<a accesskey="p" href="Bv9ARM.html">Prev</a>�</td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="40%" align="right">�<a accesskey="n" href="Bv9ARM.ch02.html">Next</a>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="40%" align="left" valign="top">BIND 9 Administrator Reference Manual�</td>
f77c5a1336bc11ae235f1b91f1b7cbae1137c3e8Automatic Updater<td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein<td width="40%" align="right" valign="top">�Chapter�2.�<acronym class="acronym">BIND</acronym> Resource Requirements</td>