dns-caveats.html.en revision 4aa603e6448b99f9371397d439795c91a93637ea
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head><!--
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes This file is generated from xml source: DO NOT EDIT
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<title>Issues Regarding DNS and Apache HTTP Server - Apache HTTP Server</title>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<link href="/style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<link href="/style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
0662ed52e814f8f08ef0e09956413a792584eddffuankg<link href="/style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link rel="stylesheet" type="text/css" href="/style/css/prettify.css" />
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<script src="/style/scripts/prettify.min.js" type="text/javascript">
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<link href="/images/favicon.ico" rel="shortcut icon" /></head>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<p class="menu"><a href="/mod/">Modules</a> | <a href="/mod/quickreference.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="/glossary.html">Glossary</a> | <a href="/sitemap.html">Sitemap</a></p>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<p class="apache">Apache HTTP Server Version 2.5</p>
70953fb44a7140fe206c3a5f011e24209c8c5c6abnicholes<div class="up"><a href="./"><img title="<-" alt="<-" src="/images/left.gif" /></a></div>
44f575c8cb19a7a5cd61664a7848be6bc197df02fuankg<a href="http://www.apache.org/">Apache</a> > <a href="http://httpd.apache.org/">HTTP Server</a> > <a href="http://httpd.apache.org/docs/">Documentation</a> > <a href="./">Version 2.5</a></div><div id="page-content"><div id="preamble"><h1>Issues Regarding DNS and Apache HTTP Server</h1>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<p><span>Available Languages: </span><a href="/en/dns-caveats.html" title="English"> en </a> |
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<a href="/fr/dns-caveats.html" hreflang="fr" rel="alternate" title="Fran�ais"> fr </a> |
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<a href="/ja/dns-caveats.html" hreflang="ja" rel="alternate" title="Japanese"> ja </a> |
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<a href="/ko/dns-caveats.html" hreflang="ko" rel="alternate" title="Korean"> ko </a> |
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<a href="/tr/dns-caveats.html" hreflang="tr" rel="alternate" title="T�rk�e"> tr </a></p>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes <p>This page could be summarized with the statement: don't
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes configure Apache HTTP Server in such a way that it relies on DNS resolution
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes for parsing of the configuration files. If httpd requires DNS
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes resolution to parse the configuration files then your server
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes may be subject to reliability problems (ie. it might not start up),
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes or denial and theft of service attacks (including virtual hosts able
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes to steal hits from other virtual hosts).</p>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<div id="quickview"><ul id="toc"><li><img alt="" src="/images/down.gif" /> <a href="#example">A Simple Example</a></li>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<li><img alt="" src="/images/down.gif" /> <a href="#denial">Denial of Service</a></li>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<li><img alt="" src="/images/down.gif" /> <a href="#main">The "main server" Address</a></li>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<li><img alt="" src="/images/down.gif" /> <a href="#tips">Tips to Avoid These Problems</a></li>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes</ul><ul class="seealso"><li><a href="#comments_section">Comments</a></li></ul></div>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<h2><a name="example" id="example">A Simple Example</a></h2>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes <pre class="prettyprint lang-config"># This is a misconfiguration example, do not use on your server
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<VirtualHost www.example.dom>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes ServerAdmin webgirl@example.dom
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes</VirtualHost></pre>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes <p>In order for the server to function properly, it absolutely needs
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes to have two pieces of information about each virtual host: the
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes <code class="directive"><a href="/mod/core.html#servername">ServerName</a></code> and at least one
ac7985784d08a3655291f24f711812b4d8b1cbcffuankg IP address that the server will bind and respond to. The above
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes example does not include the IP address, so httpd must use DNS
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes to find the address of <code>www.example.dom</code>. If for some
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes reason DNS is not available at the time your server is parsing
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes its config file, then this virtual host <strong>will not be
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes configured</strong>. It won't be able to respond to any hits
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes to this virtual host.</p>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes <p>Suppose that <code>www.example.dom</code> has address 192.0.2.1.
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes Then consider this configuration snippet:</p>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes <pre class="prettyprint lang-config"># This is a misconfiguration example, do not use on your server
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<VirtualHost 192.0.2.1>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes ServerAdmin webgirl@example.dom
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes</VirtualHost></pre>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes <p>This time httpd needs to use reverse DNS to find the
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes <code>ServerName</code> for this virtualhost. If that reverse
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes lookup fails then it will partially disable the virtualhost.
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes If the virtual host is name-based then it will effectively be
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes totally disabled, but if it is IP-based then it will mostly
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes work. However, if httpd should ever have to generate a full
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes URL for the server which includes the server name (such as when a
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes Redirect is issued), then it will fail to generate a valid URL.</p>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes <p>Here is a snippet that avoids both of these problems:</p>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes <pre class="prettyprint lang-config"><VirtualHost 192.0.2.1>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes ServerAdmin webgirl@example.dom
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes</VirtualHost></pre>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes </div><div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<h2><a name="denial" id="denial">Denial of Service</a></h2>
0a39e7683f6611d66c55712f50bb240428d832a1bnicholes <pre class="prettyprint lang-config"><VirtualHost www.example1.dom>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes ServerAdmin webgirl@example1.dom
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes</VirtualHost>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<VirtualHost www.example2.dom>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes ServerAdmin webguy@example2.dom
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes</VirtualHost></pre>
0662ed52e814f8f08ef0e09956413a792584eddffuankg <p>Suppose that you've assigned 192.0.2.1 to
ac7985784d08a3655291f24f711812b4d8b1cbcffuankg <code>www.example2.dom</code>. Furthermore, suppose that
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes <code>example1.dom</code> has control of their own DNS. With this
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes config you have put <code>example1.dom</code> into a position where
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes they can steal all traffic destined to <code>example2.dom</code>. To
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes do so, all they have to do is set <code>www.example1.dom</code> to
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes 192.0.2.2. Since they control their own DNS you can't stop them
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes from pointing the <code>www.example1.dom</code> record wherever they
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes <p>Requests coming in to 192.0.2.2 (including all those where
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes users typed in URLs of the form
0662ed52e814f8f08ef0e09956413a792584eddffuankg <code>http://www.example2.dom/whatever</code>) will all be served by
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes the <code>example1.dom</code> virtual host. To better understand why
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes this happens requires a more in-depth discussion of how httpd
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes matches up incoming requests with the virtual host that will
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes serve it. A rough document describing this <a href="vhosts/details.html">is available</a>.</p>
0662ed52e814f8f08ef0e09956413a792584eddffuankg </div><div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<h2><a name="main" id="main">The "main server" Address</a></h2>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes virtual host support</a> requires httpd to know
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes the IP address(es) of the host that <code class="program"><a href="/programs/httpd.html">httpd</a></code>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes is running on. To get this address it uses either the global
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes <code class="directive"><a href="/mod/core.html#servername">ServerName</a></code>
0662ed52e814f8f08ef0e09956413a792584eddffuankg (if present) or calls the C function <code>gethostname</code>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes (which should return the same as typing "hostname" at the
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes command prompt). Then it performs a DNS lookup on this address.
ac7985784d08a3655291f24f711812b4d8b1cbcffuankg At present there is no way to avoid this lookup.</p>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes <p>If you fear that this lookup might fail because your DNS
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes server is down then you can insert the hostname in
ac7985784d08a3655291f24f711812b4d8b1cbcffuankg <code>/etc/hosts</code> (where you probably already have it so
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes that the machine can boot properly). Then ensure that your
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes machine is configured to use <code>/etc/hosts</code> in the
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes event that DNS fails. Depending on what OS you are using this
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes might be accomplished by editing <code>/etc/resolv.conf</code>,
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes <p>If your server doesn't have to perform DNS for any other
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes reason then you might be able to get away with running httpd
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes with the <code>HOSTRESORDER</code> environment variable set to
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes "local". This all depends on what OS and resolver libraries you
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes are using. It also affects CGIs unless you use
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes <code class="module"><a href="/mod/mod_env.html">mod_env</a></code> to control the environment. It's best
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes to consult the man pages or FAQs for your OS.</p>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes </div><div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<h2><a name="tips" id="tips">Tips to Avoid These Problems</a></h2>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes use IP addresses in
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes <code class="directive"><a href="/mod/core.html#virtualhost">VirtualHost</a></code>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes use IP addresses in
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes <code class="directive"><a href="/mod/mpm_common.html#listen">Listen</a></code>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes ensure all virtual hosts have an explicit
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes <code class="directive"><a href="/mod/core.html#servername">ServerName</a></code>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes <li>create a <code><VirtualHost _default_:*></code>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes server that has no pages to serve</li>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<p><span>Available Languages: </span><a href="/en/dns-caveats.html" title="English"> en </a> |
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<a href="/fr/dns-caveats.html" hreflang="fr" rel="alternate" title="Fran�ais"> fr </a> |
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<a href="/ja/dns-caveats.html" hreflang="ja" rel="alternate" title="Japanese"> ja </a> |
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<a href="/ko/dns-caveats.html" hreflang="ko" rel="alternate" title="Korean"> ko </a> |
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<a href="/tr/dns-caveats.html" hreflang="tr" rel="alternate" title="T�rk�e"> tr </a></p>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes</div><div class="top"><a href="#page-header"><img src="/images/up.gif" alt="top" /></a></div><div class="section"><h2><a id="comments_section" name="comments_section">Comments</a></h2><div class="warning"><strong>Notice:</strong><br />This is not a Q&A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed again by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Freenode, or sent to our <a href="http://httpd.apache.org/lists.html">mailing lists</a>.</div>
ac7985784d08a3655291f24f711812b4d8b1cbcffuankg<script type="text/javascript"><!--//--><![CDATA[//><!--
cb2846ded4de1abbb5934b92132baf826f1babfebnicholesvar comments_shortname = 'httpd';
cb2846ded4de1abbb5934b92132baf826f1babfebnicholesvar comments_identifier = 'http://httpd.apache.org/docs/trunk/dns-caveats.html';
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes(function(w, d) {
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes if (w.location.hostname.toLowerCase() == "httpd.apache.org") {
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes d.write('<div id="comments_thread"><\/div>');
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes var s = d.createElement('script');
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier;
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes (d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s);
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes d.write('<div id="comments_thread">Comments are disabled for this page at the moment.<\/div>');
8ffac2c334103c0336602aaede650cb578611151fuankg})(window, document);
0cb770e9049c8e85ede0bbe3d47904785b15f868fuankg<p class="apache">Copyright 2014 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
cb2846ded4de1abbb5934b92132baf826f1babfebnicholes<p class="menu"><a href="/mod/">Modules</a> | <a href="/mod/quickreference.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="/glossary.html">Glossary</a> | <a href="/sitemap.html">Sitemap</a></p></div><script type="text/javascript"><!--//--><![CDATA[//><!--
cb2846ded4de1abbb5934b92132baf826f1babfebnicholesif (typeof(prettyPrint) !== 'undefined') {
ac7985784d08a3655291f24f711812b4d8b1cbcffuankg prettyPrint();