Bv9ARM.ch01.html revision f00c53aafe031bb7ef2e3b03934701ac44dfe258
69fe9aaafdd6a141610e86a777d325db75422070Mark Andrews<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
40f53fa8d9c6a4fc38c0014495e7a42b08f52481David Lawrence - Copyright (C) 2000-2017 Internet Systems Consortium, Inc. ("ISC")
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews - This Source Code Form is subject to the terms of the Mozilla Public
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews - License, v. 2.0. If a copy of the MPL was not distributed with this
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff - file, You can obtain one at http://mozilla.org/MPL/2.0/.
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff<meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff<link rel="home" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff<link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff<link rel="prev" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff<link rel="next" href="Bv9ARM.ch02.html" title="Chapter�2.�BIND Resource Requirements">
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff<table width="100%" summary="Navigation header">
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff<tr><th colspan="3" align="center">Chapter�1.�Introduction</th></tr>
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff<a accesskey="p" href="Bv9ARM.html">Prev</a>�</td>
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff<td width="20%" align="right">�<a accesskey="n" href="Bv9ARM.ch02.html">Next</a>
ed019cabc1cc75d4412010c331876e4ae5080a4dDavid Lawrence<div class="titlepage"><div><div><h1 class="title">
ed019cabc1cc75d4412010c331876e4ae5080a4dDavid Lawrence<a name="Bv9ARM.ch01"></a>Chapter�1.�Introduction</h1></div></div></div>
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff<dt><span class="section"><a href="Bv9ARM.ch01.html#doc_scope">Scope of Document</a></span></dt>
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff<dt><span class="section"><a href="Bv9ARM.ch01.html#organization">Organization of This Document</a></span></dt>
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff<dt><span class="section"><a href="Bv9ARM.ch01.html#conventions">Conventions Used in This Document</a></span></dt>
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff<dt><span class="section"><a href="Bv9ARM.ch01.html#dns_overview">The Domain Name System (<acronym class="acronym">DNS</acronym>)</a></span></dt>
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff<dt><span class="section"><a href="Bv9ARM.ch01.html#dns_fundamentals">DNS Fundamentals</a></span></dt>
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff<dt><span class="section"><a href="Bv9ARM.ch01.html#domain_names">Domains and Domain Names</a></span></dt>
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff<dt><span class="section"><a href="Bv9ARM.ch01.html#zones">Zones</a></span></dt>
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff<dt><span class="section"><a href="Bv9ARM.ch01.html#auth_servers">Authoritative Name Servers</a></span></dt>
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff<dt><span class="section"><a href="Bv9ARM.ch01.html#cache_servers">Caching Name Servers</a></span></dt>
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff<dt><span class="section"><a href="Bv9ARM.ch01.html#multi_role">Name Servers in Multiple Roles</a></span></dt>
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff The Internet Domain Name System (<acronym class="acronym">DNS</acronym>)
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein consists of the syntax
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff to specify the names of entities in the Internet in a hierarchical
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff manner, the rules used for delegating authority over names, and the
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff system implementation that actually maps names to Internet
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein addresses. <acronym class="acronym">DNS</acronym> data is maintained in a
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff group of distributed
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff hierarchical databases.
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff<div class="titlepage"><div><div><h2 class="title" style="clear: both">
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff<a name="doc_scope"></a>Scope of Document</h2></div></div></div>
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff The Berkeley Internet Name Domain
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein (<acronym class="acronym">BIND</acronym>) implements a
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff domain name server for a number of operating systems. This
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein document provides basic information about the installation and
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff care of the Internet Systems Consortium (<acronym class="acronym">ISC</acronym>)
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff <acronym class="acronym">BIND</acronym> version 9 software package for
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff system administrators.
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff <p>This version of the manual corresponds to BIND version 9.11.</p>
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff<div class="titlepage"><div><div><h2 class="title" style="clear: both">
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein<a name="organization"></a>Organization of This Document</h2></div></div></div>
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein In this document, <span class="emphasis"><em>Chapter 1</em></span> introduces
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff the basic <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym> concepts. <span class="emphasis"><em>Chapter 2</em></span>
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff describes resource requirements for running <acronym class="acronym">BIND</acronym> in various
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff environments. Information in <span class="emphasis"><em>Chapter 3</em></span> is
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein <span class="emphasis"><em>task-oriented</em></span> in its presentation and is
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein organized functionally, to aid in the process of installing the
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein <acronym class="acronym">BIND</acronym> 9 software. The task-oriented
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff section is followed by
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff <span class="emphasis"><em>Chapter 4</em></span>, which contains more advanced
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff concepts that the system administrator may need for implementing
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff certain options. <span class="emphasis"><em>Chapter 5</em></span>
7a166c5c61a5aaa6eeb929bed152dc0a6b128e3dMichael Graff describes the <acronym class="acronym">BIND</acronym> 9 lightweight
7a166c5c61a5aaa6eeb929bed152dc0a6b128e3dMichael Graff resolver. The contents of <span class="emphasis"><em>Chapter 6</em></span> are
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff organized as in a reference manual to aid in the ongoing
7a166c5c61a5aaa6eeb929bed152dc0a6b128e3dMichael Graff maintenance of the software. <span class="emphasis"><em>Chapter 7</em></span> addresses
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff security considerations, and
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff <span class="emphasis"><em>Chapter 8</em></span> contains troubleshooting help. The
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff main body of the document is followed by several
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff <span class="emphasis"><em>appendices</em></span> which contain useful reference
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff information, such as a <span class="emphasis"><em>bibliography</em></span> and
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff historic information related to <acronym class="acronym">BIND</acronym>
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff and the Domain Name
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff<div class="titlepage"><div><div><h2 class="title" style="clear: both">
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff<a name="conventions"></a>Conventions Used in This Document</h2></div></div></div>
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff In this document, we use the following general typographic
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein conventions:
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff <span class="emphasis"><em>To describe:</em></span>
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff <span class="emphasis"><em>We use the style:</em></span>
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff a pathname, filename, URL, hostname,
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff mailing list name, or new term or concept
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein literal user
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff <strong class="userinput"><code>Fixed Width Bold</code></strong>
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein program output
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff <code class="computeroutput">Fixed Width</code>
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff The following conventions are used in descriptions of the
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff <acronym class="acronym">BIND</acronym> configuration file:</p>
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein <span class="emphasis"><em>To describe:</em></span>
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff <span class="emphasis"><em>We use the style:</em></span>
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff Optional input
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff [<span class="optional">Text is enclosed in square brackets</span>]
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff<div class="titlepage"><div><div><h2 class="title" style="clear: both">
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff<a name="dns_overview"></a>The Domain Name System (<acronym class="acronym">DNS</acronym>)</h2></div></div></div>
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff The purpose of this document is to explain the installation
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein and upkeep of the <acronym class="acronym">BIND</acronym> (Berkeley Internet
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff Name Domain) software package, and we
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff begin by reviewing the fundamentals of the Domain Name System
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff (<acronym class="acronym">DNS</acronym>) as they relate to <acronym class="acronym">BIND</acronym>.
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff<div class="titlepage"><div><div><h3 class="title">
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff<a name="dns_fundamentals"></a>DNS Fundamentals</h3></div></div></div>
7a166c5c61a5aaa6eeb929bed152dc0a6b128e3dMichael Graff The Domain Name System (DNS) is a hierarchical, distributed
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff database. It stores information for mapping Internet host names to
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff addresses and vice versa, mail routing information, and other data
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff used by Internet applications.
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff Clients look up information in the DNS by calling a
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff <span class="emphasis"><em>resolver</em></span> library, which sends queries to one or
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff more <span class="emphasis"><em>name servers</em></span> and interprets the responses.
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff The <acronym class="acronym">BIND</acronym> 9 software distribution
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff contains a name server, <span class="command"><strong>named</strong></span>, and a
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff resolver library, <span class="command"><strong>liblwres</strong></span>.
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff<div class="titlepage"><div><div><h3 class="title">
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff<a name="domain_names"></a>Domains and Domain Names</h3></div></div></div>
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein The data stored in the DNS is identified by <span class="emphasis"><em>domain names</em></span> that are organized as a tree according to
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff organizational or administrative boundaries. Each node of the tree,
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff called a <span class="emphasis"><em>domain</em></span>, is given a label. The domain
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff node is the concatenation of all the labels on the path from the
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff node to the <span class="emphasis"><em>root</em></span> node. This is represented
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff in written form as a string of labels listed from right to left and
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff separated by dots. A label need only be unique within its parent
7a166c5c61a5aaa6eeb929bed152dc0a6b128e3dMichael Graff For example, a domain name for a host at the
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff company <span class="emphasis"><em>Example, Inc.</em></span> could be
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein <code class="literal">ourhost.example.com</code>,
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff top level domain to which
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff <code class="literal">ourhost.example.com</code> belongs,
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff a subdomain of <code class="literal">com</code>, and
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff name of the host.
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff For administrative purposes, the name space is partitioned into
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff areas called <span class="emphasis"><em>zones</em></span>, each starting at a node and
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff extending down to the leaf nodes or to nodes where other zones
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff The data for each zone is stored in a <span class="emphasis"><em>name server</em></span>, which answers queries about the zone using the
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff <span class="emphasis"><em>DNS protocol</em></span>.
7a166c5c61a5aaa6eeb929bed152dc0a6b128e3dMichael Graff The data associated with each domain name is stored in the
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein form of <span class="emphasis"><em>resource records</em></span> (<acronym class="acronym">RR</acronym>s).
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff Some of the supported resource record types are described in
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff <a class="xref" href="Bv9ARM.ch06.html#types_of_resource_records_and_when_to_use_them" title="Types of Resource Records and When to Use Them">the section called “Types of Resource Records and When to Use Them”</a>.
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff For more detailed information about the design of the DNS and
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff the DNS protocol, please refer to the standards documents listed in
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff <a class="xref" href="Bv9ARM.ch11.html#rfcs" title="Request for Comments (RFCs)">the section called “Request for Comments (RFCs)”</a>.
7a166c5c61a5aaa6eeb929bed152dc0a6b128e3dMichael Graff<div class="titlepage"><div><div><h3 class="title">
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff<a name="zones"></a>Zones</h3></div></div></div>
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff To properly operate a name server, it is important to understand
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff the difference between a <span class="emphasis"><em>zone</em></span>
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff and a <span class="emphasis"><em>domain</em></span>.
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff As stated previously, a zone is a point of delegation in
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff the <acronym class="acronym">DNS</acronym> tree. A zone consists of
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff those contiguous parts of the domain
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff tree for which a name server has complete information and over which
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff it has authority. It contains all domain names from a certain point
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff downward in the domain tree except those which are delegated to
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff other zones. A delegation point is marked by one or more
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff <span class="emphasis"><em>NS records</em></span> in the
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff parent zone, which should be matched by equivalent NS records at
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff the root of the delegated zone.
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein For instance, consider the <code class="literal">example.com</code>
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff domain which includes names
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff such as <code class="literal">host.aaa.example.com</code> and
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff <code class="literal">host.bbb.example.com</code> even though
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff the <code class="literal">example.com</code> zone includes
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff only delegations for the <code class="literal">aaa.example.com</code> and
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff <code class="literal">bbb.example.com</code> zones. A zone can
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff exactly to a single domain, but could also include only part of a
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff domain, the rest of which could be delegated to other
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff name servers. Every name in the <acronym class="acronym">DNS</acronym>
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff <span class="emphasis"><em>domain</em></span>, even if it is
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff <span class="emphasis"><em>terminal</em></span>, that is, has no
915723e4007e177b10c0e1c9d1bfe77ac2bfe853Michael Graff <span class="emphasis"><em>subdomains</em></span>. Every subdomain is a domain and
915723e4007e177b10c0e1c9d1bfe77ac2bfe853Michael Graff every domain except the root is also a subdomain. The terminology is
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein not intuitive and we suggest that you read RFCs 1033, 1034 and 1035
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff gain a complete understanding of this difficult and subtle
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff Though <acronym class="acronym">BIND</acronym> is called a "domain name
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff it deals primarily in terms of zones. The master and slave
915723e4007e177b10c0e1c9d1bfe77ac2bfe853Michael Graff declarations in the <code class="filename">named.conf</code> file
915723e4007e177b10c0e1c9d1bfe77ac2bfe853Michael Graff zones, not domains. When you ask some other site if it is willing to
ab023a65562e62b85a824509d829b6fad87e00b1Rob Austein be a slave server for your <span class="emphasis"><em>domain</em></span>, you are
915723e4007e177b10c0e1c9d1bfe77ac2bfe853Michael Graff actually asking for slave service for some collection of zones.
915723e4007e177b10c0e1c9d1bfe77ac2bfe853Michael Graff<div class="titlepage"><div><div><h3 class="title">
915723e4007e177b10c0e1c9d1bfe77ac2bfe853Michael Graff<a name="auth_servers"></a>Authoritative Name Servers</h3></div></div></div>
915723e4007e177b10c0e1c9d1bfe77ac2bfe853Michael Graff Each zone is served by at least
7a166c5c61a5aaa6eeb929bed152dc0a6b128e3dMichael Graff one <span class="emphasis"><em>authoritative name server</em></span>,
f9fdb43a912a53c44627449ace57921b143eef60Michael Graff which contains the complete data for the zone.
1a69a1a78cfaa86f3b68bbc965232b7876d4da2aDavid Lawrence To make the DNS tolerant of server and network failures,
<span class="command"><strong>dig</strong></span> (<a class="xref" href="Bv9ARM.ch03.html#diagnostic_tools" title="Diagnostic Tools">the section called “Diagnostic Tools”</a>).
at the <span class="emphasis"><em>top level</em></span> or <span class="emphasis"><em>apex</em></span>
that can do it, and that server would query the Internet <acronym class="acronym">DNS</acronym> servers