Using the Domain Name System (DNS)

Using the Domain Name System (DNS)

In TCP/IP networks, each network interface (for example, an Ethernet card on a host computer) is identified by an IP address. Because IP addresses are hard to remember, an association is made between an easy-to-remember name and the IP address-much like the association between a name and a telephone number. For example, instead of having to remember that the IP address of Red Hat's Web server is, you can simply refer to that host by its name, When you type as the URL in a Web browser, the name has to be translated into its corresponding IP address. This is where the concept of DNS comes in.

DNS defines the following:

  • A hierarchical domain-naming system for hosts

  • A distributed database that associates a name with an IP address

  • Library routines that network applications can use to query the distributed DNS database (this library is called the resolver library)

  • A protocol for DNS clients and servers to exchange information about names and IP addresses

Nowadays, all hosts on the Internet rely on DNS to access various Internet services on remote hosts. As you may know from personal experience, when you obtain Internet access from an Internet service provider (ISP), the ISP provides you with the IP addresses of name servers. These are the DNS servers your system accesses whenever hostnames have to be mapped to IP addresses.

If you have a small LAN, you may decide to run a DNS server on one of the hosts or to use the name servers provided by the ISP. For medium-sized networks with several subnets, you can run a DNS server on each subnet to provide efficient DNS lookups. On a large corporate network, the corporate domain (such as is further subdivided into a hierarchy of subdomains, and several DNS servers may be used in each subdomain.

The following sections provide an overview of the hierarchical domain-naming convention, and describe BIND-the implementation of DNS used on most UNIX systems, including Red Hat Linux.

Understanding Hierarchical Domain Names

DNS uses a hierarchical tree of domains to organize the namespace-the entire set of names. Each higher-level domain has authority over its lower-level subdomains. Each domain represents a distinct block of the namespace and is managed by a single administrative authority. Figure 18-1 illustrates the hierarchical organization of the DNS namespace.

Click To expand
Figure 18-1: Sample Domain Names Illustrating the Hierarchical DNS Namespace.

The root of the tree is called the root domain and is represented by a single dot (.). The top-level, or root-level, domains come next. The top-level domains are further divided into second-level domains, which, in turn, can be broken into further subdomains.

The fully qualified domain name (FQDN) is constructed by stringing together the sub- domain names, from lower to higher level, using dots (.) as separators. For example, REDHAT.COM is a fully qualified domain name; so is EE.UMD.EDU. Note that each of these may also refer to a specific host computer. Figure 18-2 illustrates the components of a fully qualified domain name.

Figure 18-2: Components of a Fully Qualified Domain Name.

Domain names are case insensitive. Therefore, as far as DNS is concerned, the domains UMD.EDU and both represent University of Maryland's domain. The norm, however, is to type domain names in all lowercase.

Using the Berkeley Internet Domain Name (BIND) System

Most UNIX systems, including Red Hat Linux, come with the BIND system-a well-known implementation of DNS. The BIND software is installed during Red Hat Linux installation, as long as you select the DNS Name Server package group when selecting the packages for installation.

To see which version of BIND is installed on your Red Hat Linux system, type the following command:

rpm -q bind

As the output shows, BIND Version 9.2.1 is installed on my system.

BIND includes three major components:

  • The named daemon-the name server- that responds to queries about hostnames and IP addresses

  • A resolver library that applications can use to resolve hostnames into IP addresses and vice versa

  • Command-line DNS utility programs (DNS clients), such as dig (Domain Internet Groper) and host, that users can use to query DNS

The next few sections describe these components of BIND. Later sections describe how to configure the resolver and the name server.

Understanding named-the BIND Name Server

The named daemon is the name server that responds to queries about hostnames and IP addresses. Based on the configuration files and the local DNS database, named either provides answers to queries or asks other servers and caches their responses. The named server also performs a function referred to as zone transfer, which involves copying data among the name servers in a domain.

To run a name server on your Red Hat Linux system, you have to run named with the appropriate configuration files. Later in this chapter, you learn about the configuration files and data files that control how the name server operates.

Understanding Resolver Library

Finding an IP address for a hostname is referred to as resolving the hostname. Network-aware applications, such as a Web browser or an FTP client, use a resolver library to perform the conversion from the name to an IP address. Depending on the settings in the /etc/host.conf file, the resolver library consults the /etc/hosts file or makes a DNS query to resolve a hostname to its IP address. The resolver library queries the name servers listed in the /etc/resolv.conf file.

You do not need to learn much about the resolver library unless you are writing network-aware applications. To run Internet services properly, all you need to learn is how to configure the resolver. Subsequent sections in this chapter show you how to configure this and other aspects of DNS.

Using DNS Utility Programs

You can use the DNS utility programs-dig and host-to try out DNS from the shell prompt interactively. These utility programs are DNS clients. You can use them to query the DNS database and debug any name server you might set up on your system. By default, these programs query the name server listed in your system's /etc/resolv.conf file.

Using dig

You can use dig, the Domain Internet Groper program, to look up IP addresses for a domain name or vice versa. For example, to look up the IP address of addlab.nws, type:


dig prints the results of the DNS query with a great amount of detail. Here's the output of that dig command on my Red Hat Linux system:

; <<>> DiG 9.2.1 <<>>
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18561
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 6, ADDITIONAL: 6

;           IN      A

;; ANSWER SECTION:    86400   IN      A

;; AUTHORITY SECTION:           86400   IN      NS           86400   IN      NS           86400   IN      NS           86400   IN      NS           86400   IN      NS           86400   IN      NS

;; ADDITIONAL SECTION: 86400   IN      A       86400   IN      A         67000   IN      A         69806   IN      A         68814   IN      A         68801   IN      A

;; Query time: 50 msec
;; WHEN: Sun Feb 16 17:59:12 2003
;; MSG SIZE  rcvd: 279

The answer you are looking for-the IP address of the host-is in the in the part of the output labeled ANSWER SECTION:. Here's what that section looks like for this sample query:

;; ANSWER SECTION:    86400   IN      A

Thus, the IP address of is The other sections in dig's output shows details such as the server it queried, the authoritative name servers for the hostname it queried, the time it took to perform the query, and so on. In this example, the SERVER line near the end of dig's output shows that dig queries the name server at the IP address's the first name server listed in my system's /etc/resolv .conf file.

Reverse lookups (finding hostnames for IP addresses) are also easy with dig. All you have to do is use dig with the -x option. For example, to find the hostname corresponding to the IP address, type the following:

dig -x

On my system, the output from this query looks like this:

; <<>> DiG 9.2.1 <<>> -x
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22285
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 6, ADDITIONAL: 6

;   IN      PTR


;; AUTHORITY SECTION: 86400  IN      NS 86400  IN      NS 86400  IN      NS 86400  IN      NS 86400  IN      NS 86400  IN      NS

;; ADDITIONAL SECTION:       86400   IN      A         86400   IN      A         86400   IN      A         86400   IN      A         86400   IN      A 86400   IN      A

;; Query time: 56 msec
;; WHEN: Sun Feb 16 18:03:06 2003
;; MSG SIZE  rcvd: 304

As you can see, dig prints a lot of information in addition to the result. The answer you want comes right after the label ANSWER SECTION:, which in this case shows the hostname to be

You can use dig to query other types of DNS records than name-to-address and address-to-name lookups. For example, DNS also contains mail exchanger (record type MX) to enable delivery of mail to a specific doman. The MX record instructs querying computers where to send messages meant for a domain. To look up an MX record for a host, simply prefix the hostname with the record type. Here is an example that queries the MX record for the domain name

dig MX

Here's the resulting output on my system:

; <<>> DiG 9.2.1 <<>> MX
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34566
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3

;                   IN      MX

;; ANSWER SECTION:            229297  IN      MX      0

;; AUTHORITY SECTION:            12924   IN      NS            12924   IN      NS

;; ADDITIONAL SECTION:       5742    IN      A 6437 IN      A 2332 IN      A

;; Query time: 1459 msec
;; WHEN: Sun Feb 16 18:05:21 2003
;; MSG SIZE  rcvd: 145

Again, the ANSWER SECTION shows the MX record, which says that mail addressed to should be sent to

Using the host Command

You can also query DNS by using the host command. The host program produces output in a compact format. For example, here's a typical use of host to look up information about a host:

host has address

By default, host prints the IP address and any MX record (these records list the names of mail handlers for the host).

For a reverse lookup, use the -t ptr option, along with the IP address as an argument, as follows:

host -t ptr domain name pointer

In this case, host prints the PTR record that shows the hostname corresponding to the specified IP address.

You can also try other types of records, such as CNAME (for canonical name), as follows:

host -t cname is an alias for

This indicates that the canonical name for is

Configuring DNS

You configure DNS by using a number of configuration files. The exact set of files depends on whether or not you are running a name server and, if so, the type of name server-caching or primary. Some configuration files are needed whether you run a name server or not.

Configuring the Resolver

You do not need a name server running on your system to use the DNS clients-dig and host. You can use them to query one of your domain's name servers. Typically, your ISP provides you with this information. You have to list the IP addresses of these name servers in the /etc/resolv.conf file-the resolver library reads this file to determine how to resolve hostnames. The format of this file is

nameserver A.B.C.D
nameserver X.Y.Z.W

where A.B.C.D and X.Y.Z.W are the IP addresses (dotted-decimal IP addresses, such as of the primary and secondary name servers your ISP provides you.

Another important configuration file is /etc/host.conf-this file tells the resolver what to do when attempting to resolve a hostname. A typical /etc/host/conf file contains the following line:

order hosts,bind 

This tells the resolver to consult the /etc/hosts file first and, if that fails, to query the name server listed in the /etc/resolv.conf file. As explained in Chapter 6, the /etc/hosts file associates IP addresses to hostnames. A typical line from the /etc/hosts file looks like the following:    lnbp200  localhost.localdomain  localhost

This line says that the IP address is assigned to the hostnames lnbp200, localhost.localdomain, and localhost.

Insider Insight 

In the latest version of Linux, which uses GNU C Library version 2 (glibc 2) or later, the name service switch (NSS) file, /etc/nsswitch.conf, specifies how services such as the resolver library, NIS, NIS+, and local files such as /etc/hosts and /etc/shadow interact. For example, the following hosts entry in the /etc/nsswitch.conf file specifies that the resolver library should first try the /etc/hosts file, then try NIS+, and finally try DNS:

hosts:      files nisplus dns

To learn more about the /etc/nsswitch.conf file and what it does, type info libc "Name Service Switch" at the shell prompt in a terminal window.

Configuring a Caching Name Server

A simple, but useful name server is one that finds answers to hostname queries by using other name servers and then remembers the answer (by saving it in a cache) the next time you need it. This can shorten the time it takes to access hosts you have accessed recently because the answer is already in the cache.

When you install the DNS Name Server package group during Red Hat Linux installation, the configuration files for a caching name server are also installed. That means you can start running the caching name server without much work on your part. This section describes the configuration files and what you have to do to start the caching name server.

Examining the /etc/named.conf File

The first configuration file you need is /etc/named.conf. The named server reads this configuration file when it starts. You already have this file if you have installed the DNS Name Server when you installed Red Hat Linux in Chapter 2. Here's what the default /etc/named.conf file contains:

// generated by

options {
        directory "/var/named";
         * If there is a firewall between you and nameservers you want
         * to talk to, you might need to uncomment the query-source
         * directive below.  Previous versions of BIND always asked
         * questions using port 53, but BIND 8.1 uses an unprivileged
         * port by default.
        // query-source address * port 53;

// a caching only nameserver config
controls {
        inet allow { localhost; } keys { rndckey; };
zone "." IN {
        type hint;
        file "";

zone "localhost" IN {
        type master;
        file "";
        allow-update { none; };

zone "" IN {
        type master;
        file "named.local";
        allow-update { none; };

include "/etc/rndc.key";

Comments are C-style (/* ... */) or C++-style (start with //). The file contains block statements enclosed in curly braces ({...}) and terminated by a semicolon (;). A block statement, in turn, contains other statements, each ending with a semicolon.

This /etc/named.conf file begins with an options block statement with a number of option statements. The directory option statement tells named where to look for all other files that appear on file lines in the configuration file. In this case, named looks for the files in the /var/named directory.

After the options and controls statements, the /etc/named.conf file contains several zone statements, each enclosed in curly braces and terminated by a semicolon. Each zone statement defines a zone. The first zone is named "." (root zone); it's a hint zone that specifies the root name servers.

The next two zone statements in /etc/named.conf are master zones. The syntax for a master zone statement for an Internet class zone (indicated by the IN keyword) is as follows:

zone "zone-name" IN {
        type master;
        file "zone-file";
        [...other optional statements...]

The zone-name is the name of the zone, and zone-file is the zone file that contains the resource records (RR)-the database entries-for that zone.

The /etc/named.conf file ends with an include statement:

include "/etc/rndc.key";

This statement inserts the contents of the /etc/rndc.key file into the /etc/named.conf file. This enables you to place sensitive configuration data (such as encryption keys) in a separate file with appropriate permissions to prevent nonroot users from accessing it. In this case, the /etc/rndc.key file contains the key named rndc, which was referenced in the options statement eariler in the /etc/named.conf file. Here is what the key definition looks like:

key "rndckey" {
        algorithm       hmac-md5;
        secret "AbigLongEncryptionKey";

The algorithm option specifies the type of algorithm, which can be dsa or hmac-md5. The secret option specifies the encryption key.

Insider Insight 

To generate your own HMAC-MD5 key, use the dnssec-keygen command with the following syntax:

dnssec-keygen -a hmac-md5 -b 128 -n HOST yourhost.domain.

You should replace yourhost.domain with your host's fully qualified domain name. The dnssec-keygen command generates two files whose names begin with K followed by the hostname. One of the files has a .key extension and the other .private. Use the cat command to look at the content of either file and copy the cryptic looking key to the secret option of the /etc/rndc.key file.

Understanding the Zone File Format

The zone file typically starts with a number of directives, each of which begins with a dollar sign ($) followed by a keyword. Two commonly used directives are $TTL and $ORIGIN.

For example, the line

$TTL    86400

uses the $TTL directive to set the default time to live (TTL) for subsequent records with undefined TTLs. The value is in seconds, and the valid TTLs are in the range 0 to 2147483647 seconds. In this case, the directive sets the default TTL as 86400 seconds (or one day). The time specified in the time-to-live directive indicates how long the information in that record should be considered valid.

The $ORIGIN directive sets the domain name that will be appended to any unqualified records. For example, the following $ORIGIN directive sets the domain name to localhost:

$ORIGIN localhost.
Insider Insight 

If there is no $ORIGIN directive, the initial $ORIGIN is the same as the zone name that comes after the zone keyword in the /etc/named.conf file.

After the directives, the zone file contains one or more resource records. These records follow a specific format, which is outlined in the next section.

Understanding Resource Record (RR) Format

You have to understand the format of the resource records before you can understand and intelligently work with zone files. Each resource record has the following format (the optional fields are shown in square brackets):

[domain] [ttl] [class] type data [;comment]

You should learn to read the resource records, at least the ones of type SOA, NS, A, PTR, and MX, which are some of the most commonly used. The next few sections briefly describe these records, illustrating each record type through an example.

SOA Record

A typical SOA record has the following format:

@     1D IN SOA       @ root (
                      42              ; serial 
                      3H              ; refresh -- 3 hours
                      15M             ; retry -- 15 minutes
                      1W              ; expiry -- 1 week
                      1D )            ; minimum -- 1 day

The first field specifies the domain as an @, which means the current domain (by default, the zone name, as shown in the /etc/named.conf file). The next field specifies a TTL of one day for this record. The class field is set to IN, which means that the record is for Internet. The type field specifies the record type as SOA. The rest of the fields constitute the data for the SOA record. The data includes the name of the primary name server (in this case, @, or the current domain), the email address of the technical contact, and five different times enclosed in parentheses.

NS Record

The NS record specifies the authoritative name servers for a zone. A typical NS record looks like the following:

.                        3600000  IN  NS    A.ROOT-SERVERS.NET.

In this case, the NS record lists the authoritative name server for the root zone (notice that the name of the first field is a single dot). The TTL field specifies the record to be valid for 1,000 hours (3600000 seconds). The class is IN, for Internet, and the record type is NS. The final field lists the name of the name server (A.ROOT-SERVERS.NET.), which ends with a dot.

A Record

An A record specifies the address corresponding to a name. For example, the following A record shows the address of A.ROOT-SERVERS.NET. as

A.ROOT-SERVERS.NET.      3600000      A

In this case, the network class is not specified because the field is optional, and the default is IN.

PTR Record

PTR records are used for reverse mapping-converting an address to a name. Consider the following example:

1       IN      PTR     localhost.

This record comes from a file for a zone named Therefore, this record says that the name associated with the address is localhost.

MX Record

An MX record specifies the name of a host that accepts mail on behalf of a specific domain. For example, here's a typical MX record:

naba    IN    MX    10

This says that mail addressed to the hostnamed naba in the current domain should be sent to (this host is called a mail exchanger). The number 10 is the preference value. For a list of multiple MX records with different preference values, the ones with lower preference values are tried first.

Now that you know a bit about resource records, you can go through the zone files for the caching name server.

Understanding the /var/named/ File

Information about the root name servers is in the file /var/named/, as specified in the zone statement for the root zone in the /etc/named.conf file. The following listing shows the /var/named/ file from a Red Hat Linux system:

;       This file holds the information on root name servers needed to
;       initialize cache of Internet domain name servers
;       (e.g. reference this file in the "cache  .  <file>"
;       configuration file of BIND domain name servers).
;       This file is made available by InterNIC
;       under anonymous FTP as
;           file                /domain/named.cache
;           on server           FTP.INTERNIC.NET
;       last update:    Nov 5, 2002
;       related version of root zone:   2002110501
; formerly NS.INTERNIC.NET
.                        3600000  IN  NS    A.ROOT-SERVERS.NET.
A.ROOT-SERVERS.NET.      3600000      A
; formerly NS1.ISI.EDU
.                        3600000      NS    B.ROOT-SERVERS.NET.
B.ROOT-SERVERS.NET.      3600000      A
; formerly C.PSI.NET
.                        3600000      NS    C.ROOT-SERVERS.NET.
C.ROOT-SERVERS.NET.      3600000      A
; formerly TERP.UMD.EDU
.                        3600000      NS    D.ROOT-SERVERS.NET.
D.ROOT-SERVERS.NET.      3600000      A
; formerly NS.NASA.GOV
.                        3600000      NS    E.ROOT-SERVERS.NET.
E.ROOT-SERVERS.NET.      3600000      A
; formerly NS.ISC.ORG
.                        3600000      NS    F.ROOT-SERVERS.NET.
F.ROOT-SERVERS.NET.      3600000      A
; formerly NS.NIC.DDN.MIL
.                        3600000      NS    G.ROOT-SERVERS.NET.
G.ROOT-SERVERS.NET.      3600000      A
; formerly AOS.ARL.ARMY.MIL
.                        3600000      NS    H.ROOT-SERVERS.NET.
H.ROOT-SERVERS.NET.      3600000      A
; formerly NIC.NORDU.NET
.                        3600000      NS    I.ROOT-SERVERS.NET.
I.ROOT-SERVERS.NET.      3600000      A
; operated by VeriSign, Inc.
.                        3600000      NS    J.ROOT-SERVERS.NET.
J.ROOT-SERVERS.NET.      3600000      A
; housed in LINX, operated by RIPE NCC
.                        3600000      NS    K.ROOT-SERVERS.NET.
K.ROOT-SERVERS.NET.      3600000      A
; operated by IANA
.                        3600000      NS    L.ROOT-SERVERS.NET.
L.ROOT-SERVERS.NET.      3600000      A
; housed in Japan, operated by WIDE
.                        3600000      NS    M.ROOT-SERVERS.NET.
M.ROOT-SERVERS.NET.      3600000      A
; End of File

This file contains NS and A resource records that specify the names of authoritative name servers and their addresses for the root zone (indicated by the '.' in the first field of each NS record).

The comment lines in the file begin with a semicolon. These comments give you hints about the location of the root name servers. There are 13 root name servers for the Internet, most of the root servers are located in the United States. This file is a necessity for any name server because the name server has to be able to reach at least one root name server.

Understanding the /var/named/ File

The /etc/named.conf file includes a zone statement for the localhost zone that specifies the zone file as That file is located in the /var/named directory of your Red Hat Linux system. The /var/named/ file contains the following resource records:

$TTL    86400
$ORIGIN localhost.
@           1D IN SOA       @ root (
                            42              ; serial (d. adams)
                            3H              ; refresh
                            15M             ; retry
                            1W              ; expiry
                            1D )            ; minimum

            1D IN NS        @
            1D IN A   

This zone file starts with a $TTL directive that sets the default TTL to one day (86400 seconds) for subsequent records with undefined TTLs. Next, a $ORIGIN directive sets the domain name to localhost.

After these two directives, the /var/named/ file contains three resource records (RRs): an SOA record, an NS record, and an A record. The SOA and the NS record specify the localhost as the primary authoritative name server for the zone. The A record specifies the address of localhost as

Understanding the /var/named/named.local File

The third zone in the /etc/named.conf file specifies a reverse-mapping zone named For this zone, the zone file is /var/named/named.local, which contains the following:

$TTL    86400
@       IN      SOA     localhost. root.localhost.  (
                                      1997022700 ; Serial