Bv9ARM.ch03.html revision 3970098dcd2a7122541667b4b56cea8abce8ccf2
cff452c7e974db5053cdbd0d7bbbab2e3b4c91b9Kay Sievers>Name Server Configuration</TITLE
cff452c7e974db5053cdbd0d7bbbab2e3b4c91b9Kay SieversNAME="GENERATOR"
f957632b960a0a42999b38ded7089fa602b41745Kay SieversCONTENT="Modular DocBook HTML Stylesheet Version 1.73
f957632b960a0a42999b38ded7089fa602b41745Kay SieversTITLE="BIND 9 Administrator Reference Manual"
20ffc4c4a9226b0e45cc02ad9c0108981626c0bbKay SieversREL="PREVIOUS"
19aadacf92ad86967ffb678e37b2ff9e83cb9480Jan EngelhardtTITLE="BIND Resource Requirements"
04ac799283f517672a5424e7c5bf066cfa4ca020Zbigniew Jędrzejewski-SzmekTITLE="Advanced DNS Features"
f38afcd0c7f558ca5bf0854b42f8c6954f8ad7f3Lennart PoetteringBGCOLOR="#FFFFFF"
81d112a8f0522a09fcfe317f420363a2b728137cLennart PoetteringVLINK="#840084"
f38afcd0c7f558ca5bf0854b42f8c6954f8ad7f3Lennart PoetteringALINK="#0000FF"
55d32caf94d8df547ca763be52b0c35bb6388606Lennart PoetteringCLASS="NAVHEADER"
bafb15bab99887d1b6b8a35136531bac6c3876a6Lennart PoetteringSUMMARY="Header navigation table"
eb124a97fb72d076014253b1acde69d428f15ecfLennart PoetteringCELLPADDING="0"
154ff088d371bee5651eaa2bc9bde8a34c185656Lennart PoetteringCELLSPACING="0"
f38afcd0c7f558ca5bf0854b42f8c6954f8ad7f3Lennart Poettering>BIND 9 Administrator Reference Manual</TH
f38afcd0c7f558ca5bf0854b42f8c6954f8ad7f3Lennart PoetteringVALIGN="bottom"
2e41a51ea4cf68f67d6d1e71482d95d9d50091b3Lennart PoetteringVALIGN="bottom"
f38afcd0c7f558ca5bf0854b42f8c6954f8ad7f3Lennart PoetteringVALIGN="bottom"
416446221d905b6815175dc4d525d27f8ae43d1bLennart PoetteringCLASS="chapter"
baa89da40a1d42242c9c62603501ada7e9e52613Lennart Poettering>Chapter 3. Name Server Configuration</A
df5f6971e6e15b4632884916c71daa076c8bae96Lennart Poettering>Table of Contents</B
982e44dbc3e70c97e83464a30354b80973d52b41Lennart PoetteringHREF="Bv9ARM.ch03.html#sample_configuration"
fcba531ed4c6e6f8f21d8ca4e3a56e3162b1c578Lennart Poettering>Sample Configurations</A
e1b7e7ec9b34ae6ae54a4c8084395cbf2bfe9960Lennart Poettering>Load Balancing</A
bdeeb6b543a2a2d0a494f17b85f1498859cdfc2fLennart Poettering>Name Server Operations</A
69af45035913e7119cffd94c542bd3039600e45dZbigniew Jędrzejewski-Szmek>In this section we provide some suggested configurations along
9444b1f20e311f073864d81e913bd4f32fe95cfdLennart Poetteringwith guidelines for their use. We also address the topic of reasonable
466784c8710e5cb0e0b86a16506d992d7ec5b619Kay Sieversoption setting.</P
4e09014daf8f98584b3f15e64e93bed232e70a6bLennart PoetteringNAME="sample_configuration"
4e09014daf8f98584b3f15e64e93bed232e70a6bLennart Poettering>3.1. Sample Configurations</A
bee7e928990fd8a0c5909c2022a2b9eede557c81Lennart Poettering>3.1.1. A Caching-only Name Server</A
0a825b5cd4adb4d9dadfb2e237cdceae09399804Lennart Poettering>The following sample configuration is appropriate for a caching-only
0a825b5cd4adb4d9dadfb2e237cdceae09399804Lennart Poetteringname server for use by clients internal to a corporation. All queries
452de75e5b8b1cff207243848f4e5de68620554cLennart Poetteringfrom outside clients are refused using the <B
df98a87ba389bdfc0359beedf47557411f3af434Lennart PoetteringCLASS="command"
df98a87ba389bdfc0359beedf47557411f3af434Lennart Poettering>allow-query</B
df98a87ba389bdfc0359beedf47557411f3af434Lennart Poetteringoption. Alternatively, the same effect could be achieved using suitable
bee7e928990fd8a0c5909c2022a2b9eede557c81Lennart Poetteringfirewall rules.</P
0058679911db806b6db2fa445a1ce879a436c9d6Lennart PoetteringCLASS="programlisting"
e62b3b353aa3cd66670428d453ee36b45127df1fLennart Poettering> // Two corporate subnets we wish to allow queries from.
e62b3b353aa3cd66670428d453ee36b45127df1fLennart Poetteringacl corpnets { 192.168.4.0/24; 192.168.7.0/24; };
f38afcd0c7f558ca5bf0854b42f8c6954f8ad7f3Lennart Poettering directory "/etc/namedb"; // Working directory
12179984a38fe74581333fbcdc11c822d81f505fLennart Poettering allow-query { corpnets; };
154ff088d371bee5651eaa2bc9bde8a34c185656Lennart Poettering// Provide a reverse mapping for the loopback address 127.0.0.1
ab8e074ce25b9947314c69e17afe1bd2527ee26dLennart Poettering>3.1.2. An Authoritative-only Name Server</A
ab8e074ce25b9947314c69e17afe1bd2527ee26dLennart Poettering>This sample configuration is for an authoritative-only server
b454b11220e87add6d0f011695c7912b009c853dLennart Poetteringthat is the master server for "<TT
b454b11220e87add6d0f011695c7912b009c853dLennart PoetteringCLASS="filename"
06db8540cdfc8259423ed90e7352dbc1d71eccd9Lennart Poetteringand a slave for the subdomain "<TT
06db8540cdfc8259423ed90e7352dbc1d71eccd9Lennart PoetteringCLASS="filename"
fff87a35d9e26c0d4ea41273a963c0eb20e18da4Zbigniew Jędrzejewski-SzmekCLASS="programlisting"
b8b4d3dddc7611dce3bf28004b0375d661120c62Lennart Poettering directory "/etc/namedb"; // Working directory
b8b4d3dddc7611dce3bf28004b0375d661120c62Lennart Poettering allow-query { any; }; // This is the default
b8b4d3dddc7611dce3bf28004b0375d661120c62Lennart Poettering recursion no; // Do not provide recursive service
3df82d5a8cdc510f518fd5e234ccb3233b748719Lennart Poettering// Provide a reverse mapping for the loopback address 127.0.0.1
b5c03638d48c07aa0eaf13b5f54000c7133e1883Lennart Poettering// We are the master server for example.com
356ce9915ab1a4a1e6dc26954df34936a69e7c12Lennart Poettering // IP addresses of slave servers allowed to transfer example.com
356ce9915ab1a4a1e6dc26954df34936a69e7c12Lennart Poettering allow-transfer {
3b953d68c628c6ae70adba871719ac0f16083b51Josh Triplett// We are a slave server for eng.example.com
09f727eebd87661f263d3c2c1e0de7b7771acd40Lennart Poettering // IP address of eng.example.com master server
09f727eebd87661f263d3c2c1e0de7b7771acd40Lennart Poettering masters { 192.168.4.12; };
e5ec62c56963d997edaffa904af5dc45dac23988Lennart Poettering>3.2. Load Balancing</A
826872b61e4857dfffe63ba84e2b005623baecd6Lennart Poettering>A primitive form of load balancing can be achieved in
826872b61e4857dfffe63ba84e2b005623baecd6Lennart PoetteringCLASS="acronym"
3679d1126bae52e02f6cd60fca196f616b9e660dLennart Poettering> by using multiple A records for one name.</P
3679d1126bae52e02f6cd60fca196f616b9e660dLennart Poettering>For example, if you have three WWW servers with network addresses
3679d1126bae52e02f6cd60fca196f616b9e660dLennart Poetteringof 10.0.0.1, 10.0.0.2 and 10.0.0.3, a set of records such as the
3679d1126bae52e02f6cd60fca196f616b9e660dLennart Poetteringfollowing means that clients will connect to each machine one third
cbb7712189527f9f483321607e44c4ead3dd11b8Lennart Poetteringof the time:</P
d01a73b6396f57792113c1b5df6e8492fc703e5eLennart PoetteringCLASS="informaltable"
356ce9915ab1a4a1e6dc26954df34936a69e7c12Lennart PoetteringCELLPADDING="3"
81d112a8f0522a09fcfe317f420363a2b728137cLennart PoetteringCLASS="CALSTABLE"
466784c8710e5cb0e0b86a16506d992d7ec5b619Kay SieversVALIGN="MIDDLE"
b44be3ecf6326c27aa2c6c6d1fe34e22e22592a0Lennart PoetteringVALIGN="MIDDLE"
b44be3ecf6326c27aa2c6c6d1fe34e22e22592a0Lennart PoetteringVALIGN="MIDDLE"
b44be3ecf6326c27aa2c6c6d1fe34e22e22592a0Lennart PoetteringVALIGN="MIDDLE"
f38afcd0c7f558ca5bf0854b42f8c6954f8ad7f3Lennart PoetteringVALIGN="MIDDLE"
e673ad0415d89c322e5b1a121e411f1b1d8075c0Lennart Poettering>Resource Record (RR) Data</P
b44be3ecf6326c27aa2c6c6d1fe34e22e22592a0Lennart PoetteringVALIGN="MIDDLE"
b44be3ecf6326c27aa2c6c6d1fe34e22e22592a0Lennart PoetteringCLASS="literal"
b44be3ecf6326c27aa2c6c6d1fe34e22e22592a0Lennart PoetteringVALIGN="MIDDLE"
f47ec8ebb3858553dec870e1c596e39525f46360Lennart PoetteringCLASS="literal"
b44be3ecf6326c27aa2c6c6d1fe34e22e22592a0Lennart PoetteringVALIGN="MIDDLE"
b44be3ecf6326c27aa2c6c6d1fe34e22e22592a0Lennart PoetteringCLASS="literal"
f38afcd0c7f558ca5bf0854b42f8c6954f8ad7f3Lennart PoetteringVALIGN="MIDDLE"
f38afcd0c7f558ca5bf0854b42f8c6954f8ad7f3Lennart PoetteringCLASS="literal"
f38afcd0c7f558ca5bf0854b42f8c6954f8ad7f3Lennart PoetteringVALIGN="MIDDLE"
f38afcd0c7f558ca5bf0854b42f8c6954f8ad7f3Lennart PoetteringVALIGN="MIDDLE"
b44be3ecf6326c27aa2c6c6d1fe34e22e22592a0Lennart PoetteringVALIGN="MIDDLE"
b44be3ecf6326c27aa2c6c6d1fe34e22e22592a0Lennart PoetteringCLASS="literal"
b44be3ecf6326c27aa2c6c6d1fe34e22e22592a0Lennart PoetteringVALIGN="MIDDLE"
f38afcd0c7f558ca5bf0854b42f8c6954f8ad7f3Lennart PoetteringCLASS="literal"
f38afcd0c7f558ca5bf0854b42f8c6954f8ad7f3Lennart PoetteringVALIGN="MIDDLE"
f38afcd0c7f558ca5bf0854b42f8c6954f8ad7f3Lennart PoetteringCLASS="literal"
b44be3ecf6326c27aa2c6c6d1fe34e22e22592a0Lennart PoetteringVALIGN="MIDDLE"
b44be3ecf6326c27aa2c6c6d1fe34e22e22592a0Lennart PoetteringCLASS="literal"
d2e83c23f5f0cdd3b6ec05c5c40209708721e704Kay SieversVALIGN="MIDDLE"
d2e83c23f5f0cdd3b6ec05c5c40209708721e704Kay SieversVALIGN="MIDDLE"
59704f3e937c664f7324bfbb08483c358dfbc4c6Lennart PoetteringCLASS="literal"
7f8732835295fce29479b1afc9e8ee801852db09Lennart PoetteringVALIGN="MIDDLE"
a19554ed92a7460b4e709cc40c558cde827ab85bLennart PoetteringCLASS="literal"
603cd8fe07cb03e8b11722d1a732e569e5a46347Lennart PoetteringVALIGN="MIDDLE"
a7a3f28be404875eff20443a0fa8088bcc4c18dfLennart PoetteringCLASS="literal"
7d8197d1f25c1291855bb6cffc705444978c6d8dKay SieversVALIGN="MIDDLE"
7d8197d1f25c1291855bb6cffc705444978c6d8dKay SieversCLASS="literal"
9ee58bddeb6eb044753167e0047fe836479ca5dbKay Sievers>10.0.0.3</TT
b44be3ecf6326c27aa2c6c6d1fe34e22e22592a0Lennart Poettering>When a resolver queries for these records, <SPAN
b44be3ecf6326c27aa2c6c6d1fe34e22e22592a0Lennart PoetteringCLASS="acronym"
eb124a97fb72d076014253b1acde69d428f15ecfLennart Poettering them and respond to the query with the records in a different
eb124a97fb72d076014253b1acde69d428f15ecfLennart Poettering order. In the example above, clients will randomly receive
eb124a97fb72d076014253b1acde69d428f15ecfLennart Poettering records in the order 1, 2, 3; 2, 3, 1; and 3, 1, 2. Most clients
3679d1126bae52e02f6cd60fca196f616b9e660dLennart Poettering will use the first record returned and discard the rest.</P
f38afcd0c7f558ca5bf0854b42f8c6954f8ad7f3Lennart Poettering>For more detail on ordering responses, check the
f38afcd0c7f558ca5bf0854b42f8c6954f8ad7f3Lennart PoetteringCLASS="command"
f38afcd0c7f558ca5bf0854b42f8c6954f8ad7f3Lennart Poettering>rrset-order</B
a56b63f41dc779a86573ae77814c14c1db156398Lennart Poettering> substatement in the
b44be3ecf6326c27aa2c6c6d1fe34e22e22592a0Lennart PoetteringCLASS="command"
b44be3ecf6326c27aa2c6c6d1fe34e22e22592a0Lennart Poettering> statement, see
5f1dac6bf605871615b35891a3966fa474db5b20Lennart PoetteringHREF="Bv9ARM.ch06.html#rrset_ordering"
424a19f8a2061c6b058283228734010b2fa24db4Lennart Poettering>RRset Ordering</I
424a19f8a2061c6b058283228734010b2fa24db4Lennart Poettering This substatement is not supported in
a1cccad1fe88ddd6943e18af97cf7f466296970fLennart PoetteringCLASS="acronym"
8556879e0d14925ce897875c6c264368e2d048c2Lennart Poettering> 9, and only the ordering scheme described above is
d87be9b0af81a6e07d4fb3028e45c4409100dc26Lennart Poettering>3.3. Name Server Operations</A
68f160039eb78fe122cfe0d4c49695ae91f6f0d1Lennart Poettering>3.3.1. Tools for Use With the Name Server Daemon</A
5a7e959984788cf89719dec31999409b63bb802bLennart Poettering>There are several indispensable diagnostic, administrative
68f160039eb78fe122cfe0d4c49695ae91f6f0d1Lennart Poetteringand monitoring tools available to the system administrator for controlling
68f160039eb78fe122cfe0d4c49695ae91f6f0d1Lennart Poetteringand debugging the name server daemon. We describe several in this
fd4d89b2c0b31da01d134301e30916931ae3c7d9Lennart PoetteringNAME="diagnostic_tools"
8230e26dc954a40d8c9dbc8ddd9376117021f9d2Lennart Poettering>3.3.1.1. Diagnostic Tools</A
47ae7201b1df43bd3da83a19e38483b0e5694c99Lennart PoetteringCLASS="command"
8351ceaea9480d9c2979aa2ff0f4982cfdfef58dLennart PoetteringCLASS="command"
b44be3ecf6326c27aa2c6c6d1fe34e22e22592a0Lennart PoetteringCLASS="command"
b44be3ecf6326c27aa2c6c6d1fe34e22e22592a0Lennart Poettering> programs are all command line tools
c66d36e5b5ae81f3c5297d6dacadc13c88c530f6Lennart Poetteringfor manually querying name servers. They differ in style and
59cea26a349cfa8db906b520dac72563dd773ff2Lennart PoetteringCLASS="variablelist"
d3a3f22267a7dac426b07a7ed0baa1632f5daf04Kay SieversCLASS="command"
d3a3f22267a7dac426b07a7ed0baa1632f5daf04Kay Sievers>The domain information groper (<B
d3a3f22267a7dac426b07a7ed0baa1632f5daf04Kay SieversCLASS="command"
d3a3f22267a7dac426b07a7ed0baa1632f5daf04Kay Sieversis the most versatile and complete of these lookup tools.
465349c06d994dd2cc6b6fc4109ac0b9952d500aLennart PoetteringIt has two modes: simple interactive
e01a15b71e18bf2008aec7e75041ffa42eb80b80Kay Sieversmode for a single query, and batch mode which executes a query for
a888b352eb53b07daa24fa859ceeb254336b293dLennart Poetteringeach in a list of several query lines. All query options are accessible
abd55b16547d0bb0ed1c31e72e16838f0f59f48bKay Sieversfrom the command line.</P
abd55b16547d0bb0ed1c31e72e16838f0f59f48bKay SieversCLASS="command"
169c4f65131fbc7bcb51e7d5487a715cdcd0e0ebLennart PoetteringCLASS="replaceable"
9586cdfab6a2638078702b7fea7e16b3a71899e2Lennart PoetteringCLASS="replaceable"
d0e5a33374cee92962af33dfc03873e470b014f6Lennart PoetteringCLASS="replaceable"
87a8baa35d6d65ac3b58ae8e26e338e67f8ae8edLennart PoetteringCLASS="replaceable"
65c0cf7108ae3537a357c74b4586a783baba82f9Lennart Poettering>query-class</I
f957632b960a0a42999b38ded7089fa602b41745Kay SieversCLASS="replaceable"
ad740100d108282d0244d5739d4dcc86fe4c5fdeLennart Poettering>query-option</I
f38afcd0c7f558ca5bf0854b42f8c6954f8ad7f3Lennart PoetteringCLASS="replaceable"
ff01d048b4c1455241c894cf7982662c9d28fd34Lennart PoetteringCLASS="replaceable"
71092d70af35567dd154d3de2ce04ce62e157a7cLennart Poettering>The usual simple use of dig will take the form</P
1258097cd3cdbc5dd3d264850119e553a29c5068Lennart PoetteringCLASS="command"
1258097cd3cdbc5dd3d264850119e553a29c5068Lennart Poettering>dig @server domain query-type query-class</B
7c697168102cb64c5cb65a542959684014da99c7Lennart Poettering>For more information and a list of available commands and
253ee27a0c7a410d27d490bb79ea97caed6a2b68Lennart Poetteringoptions, see the <B
71092d70af35567dd154d3de2ce04ce62e157a7cLennart PoetteringCLASS="command"
f38afcd0c7f558ca5bf0854b42f8c6954f8ad7f3Lennart PoetteringCLASS="command"
916abb21d0a6653e0187b91591e492026886b0a4Lennart PoetteringCLASS="command"
b44be3ecf6326c27aa2c6c6d1fe34e22e22592a0Lennart Poettering> utility emphasizes simplicity
b44be3ecf6326c27aa2c6c6d1fe34e22e22592a0Lennart Poetteringand ease of use. By default, it converts
b44be3ecf6326c27aa2c6c6d1fe34e22e22592a0Lennart Poetteringbetween host names and Internet addresses, but its functionality
b44be3ecf6326c27aa2c6c6d1fe34e22e22592a0Lennart Poetteringcan be extended with the use of options.</P
21bdae12e11ae20460715475d8a0c991f15464acLennart PoetteringCLASS="command"
9534ce54858c67363b841cdbdc315140437bfdb4Lennart Poettering> [-aCdlrTwv] [-c <TT
9534ce54858c67363b841cdbdc315140437bfdb4Lennart PoetteringCLASS="replaceable"
7a2a0b907b5cc60f5d9a871997d7d6e7f62bf4d8Lennart PoetteringCLASS="replaceable"
f530371f1f85a070d7d0fb5112146a43533ae00bLennart PoetteringCLASS="replaceable"
3040728b6691ea2e9df3a2060e2d49a792bbaedaLennart PoetteringCLASS="replaceable"
3679d1126bae52e02f6cd60fca196f616b9e660dLennart PoetteringCLASS="replaceable"
3f7a8c4e9f1d3ce48919e24eb2c9d56dd6fd88d8Kay SieversCLASS="replaceable"