Using the Domain Name System (DNS)

Understanding named-the BIND Name Server

The named daemon is the name server that responds to queries about hostnames and IP addresses. Based on the configuration files and the local DNS database, named either provides answers to queries or asks other servers and caches their responses. The named server also performs a function referred to as zone transfer, which involves copying data among the name servers in a domain.

Secret

The named name server can be configured to operate in one of three modes:

• Primary or Master-This is the authoritative name server that keeps the master copy of the domain's data on disk. There is one primary server for each domain or subdomain.

• Secondary or Slave-A secondary name server copies its domain's data from the primary server using a zone transfer operation. There can be one or more secondary name servers for a domain.

• Caching-A caching name server loads the addresses of a few authoritative servers for the root domain and gets all domain data by caching responses to queries resolved by contacting other name servers. Primary and secondary servers also cache responses. The Time To Live (TTL) field associated with each resource record controls the length of time for which a record may be retained in the cache of a caching name server. As you see later in this chapter, you can easily extend a caching-only name server into a primary name server.

  A name server can be authoritative or not. As the term implies, the response from an authoritative name server is supposed to be accurate. The primary and secondary name servers are authoritative for their own domains, but they are not authoritative for responses provided from cached information. Caching name servers are never authoritative because all of their responses come from cached information.

To run a name server on your Red Hat Linux system, you have to run named with the appropriate configuration files. Later in this chapter, you learn about the configuration files and data files that control how the name server operates.

Understanding Resolver Library

Finding an IP address for a hostname is referred to as resolving the hostname. Network-aware applications, such as a Web browser or an FTP client, use a resolver library to perform the conversion from the name to an IP address. Depending on the settings in the /etc/host.conf file, the resolver library consults the /etc/hosts file or makes a DNS query to resolve a hostname to its IP address. The resolver library queries the name servers listed in the /etc/resolv.conf file.

You do not need to learn much about the resolver library unless you are writing network-aware applications. To run Internet services properly, all you need to learn is how to configure the resolver. Subsequent sections in this chapter show you how to configure this and other aspects of DNS.

Using DNS Utility Programs

You can use the DNS utility programs-dig and host-to try out DNS from the shell prompt interactively. These utility programs are DNS clients. You can use them to query the DNS database and debug any name server you might set up on your system. By default, these programs query the name server listed in your system's /etc/resolv.conf file.

dig addlab.nws.noaa.gov

; <<>> DiG 9.2.1 <<>> addlab.nws.noaa.gov
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18561
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 6, ADDITIONAL: 6

;; QUESTION SECTION:
;addlab.nws.noaa.gov.           IN      A

;; ANSWER SECTION:
addlab.nws.noaa.gov.    86400   IN      A       140.90.141.131

;; AUTHORITY SECTION:
nws.noaa.gov.           86400   IN      NS      netinfo.hqnoc.noaa.gov.
nws.noaa.gov.           86400   IN      NS      ns3.noc.noaa.gov.
nws.noaa.gov.           86400   IN      NS      nwrns.noaa.gov.
nws.noaa.gov.           86400   IN      NS      serns.noaa.gov.
nws.noaa.gov.           86400   IN      NS      merns.noaa.gov.
nws.noaa.gov.           86400   IN      NS      mwrns.noaa.gov.

;; ADDITIONAL SECTION:
netinfo.hqnoc.noaa.gov. 86400   IN      A       140.90.148.33
ns3.noc.noaa.gov.       86400   IN      A       140.90.143.33
nwrns.noaa.gov.         67000   IN      A       161.55.32.3
serns.noaa.gov.         69806   IN      A       192.111.123.245
merns.noaa.gov.         68814   IN      A       192.94.173.133
mwrns.noaa.gov.         68801   IN      A       140.172.253.1

;; Query time: 50 msec
;; SERVER: 192.168.0.1#53(192.168.0.1)
;; WHEN: Sun Feb 16 17:59:12 2003
;; MSG SIZE  rcvd: 279

;; ANSWER SECTION:
addlab.nws.noaa.gov.    86400   IN      A       140.90.141.131

dig -x 140.90.141.131

; <<>> DiG 9.2.1 <<>> -x 140.90.141.131
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22285
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 6, ADDITIONAL: 6

;; QUESTION SECTION:
;131.141.90.140.in-addr.arpa.   IN      PTR

;; ANSWER SECTION:
131.141.90.140.in-addr.arpa. 86400 IN   PTR     addlab.nws.noaa.gov.

;; AUTHORITY SECTION:
141.90.140.in-addr.arpa. 86400  IN      NS      merns.noaa.gov.
141.90.140.in-addr.arpa. 86400  IN      NS      mwrns.noaa.gov.
141.90.140.in-addr.arpa. 86400  IN      NS      nwrns.noaa.gov.
141.90.140.in-addr.arpa. 86400  IN      NS      serns.noaa.gov.
141.90.140.in-addr.arpa. 86400  IN      NS      netinfo.hqnoc.noaa.gov.
141.90.140.in-addr.arpa. 86400  IN      NS      ns3.noc.noaa.gov.

;; ADDITIONAL SECTION:
ns3.noc.noaa.gov.       86400   IN      A       140.90.143.33
merns.noaa.gov.         86400   IN      A       192.94.173.133
mwrns.noaa.gov.         86400   IN      A       140.172.253.1
nwrns.noaa.gov.         86400   IN      A       161.55.32.3
serns.noaa.gov.         86400   IN      A       192.111.123.245
netinfo.hqnoc.noaa.gov. 86400   IN      A       140.90.148.33

;; Query time: 56 msec
;; SERVER: 192.168.0.1#53(192.168.0.1)
;; WHEN: Sun Feb 16 18:03:06 2003
;; MSG SIZE  rcvd: 304

dig MX comcast.net

; <<>> DiG 9.2.1 <<>> MX comcast.net
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34566
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 3

;; QUESTION SECTION:
;comcast.net.                   IN      MX

;; ANSWER SECTION:
comcast.net.            229297  IN      MX      0 mx00.comcast.net.

;; AUTHORITY SECTION:
comcast.net.            12924   IN      NS      NS01.JDC01.PA.comcast.net.
comcast.net.            12924   IN      NS      NS02.JDC01.PA.comcast.net.

;; ADDITIONAL SECTION:
mx00.comcast.net.       5742    IN      A       24.153.64.1
NS01.JDC01.PA.comcast.net. 6437 IN      A       66.45.25.71
NS02.JDC01.PA.comcast.net. 2332 IN      A       66.45.25.72

;; Query time: 1459 msec
;; SERVER: 192.168.0.1#53(192.168.0.1)
;; WHEN: Sun Feb 16 18:05:21 2003
;; MSG SIZE  rcvd: 145

host www.gao.gov
www.gao.gov has address 161.203.16.2

host -t ptr 161.203.16.2
2.16.203.161.in-addr.arpa. domain name pointer www.gao.gov.

host -t cname www.ee.umd.edu
www.ee.umd.edu. is an alias for www.ece.umd.edu.

Configuring the Resolver

You do not need a name server running on your system to use the DNS clients-dig and host. You can use them to query one of your domain's name servers. Typically, your ISP provides you with this information. You have to list the IP addresses of these name servers in the /etc/resolv.conf file-the resolver library reads this file to determine how to resolve hostnames. The format of this file is

domain your-domain.com
search your-domain.com
nameserver A.B.C.D
nameserver X.Y.Z.W

where A.B.C.D and X.Y.Z.W are the IP addresses (dotted-decimal IP addresses, such as 192.168.0.1) of the primary and secondary name servers your ISP provides you.

Secret

The domain line in /etc/resolv.conf lists the local domain name. The search line specifies the domains on which a hostname is searched first (usually, you put your own domain in the search line). The domain listed on the search line is appended to any hostname before the resolver library tries to resolve it. For example, if the search line contains your-domain.com, then when you look for a host named mailhost, the resolver library first tries mailhost.your-domain.com; if that fails, it tries mailhost. The search line applies to any hostname you try to access. For example, if you are trying to access www.redhat.com, the resolver first tries www.redhat.com.your-domain.com and then www.redhat.com.

Another important configuration file is /etc/host.conf-this file tells the resolver what to do when attempting to resolve a hostname. A typical /etc/host/conf file contains the following line:

order hosts,bind 

This tells the resolver to consult the /etc/hosts file first and, if that fails, to query the name server listed in the /etc/resolv.conf file. As explained in Chapter 6, the /etc/hosts file associates IP addresses to hostnames. A typical line from the /etc/hosts file looks like the following:

127.0.0.1    lnbp200  localhost.localdomain  localhost

This line says that the IP address 127.0.0.1 is assigned to the hostnames lnbp200, localhost.localdomain, and localhost.

hosts:      files nisplus dns

Examining the /etc/named.conf File

The first configuration file you need is /etc/named.conf. The named server reads this configuration file when it starts. You already have this file if you have installed the DNS Name Server when you installed Red Hat Linux in Chapter 2. Here's what the default /etc/named.conf file contains:

// generated by named-bootconf.pl

options {
        directory "/var/named";
        /*
         * If there is a firewall between you and nameservers you want
         * to talk to, you might need to uncomment the query-source
         * directive below.  Previous versions of BIND always asked
         * questions using port 53, but BIND 8.1 uses an unprivileged
         * port by default.
         */
        // query-source address * port 53;
};

//
// a caching only nameserver config
//
controls {
        inet 127.0.0.1 allow { localhost; } keys { rndckey; };
};
zone "." IN {
        type hint;
        file "named.ca";
};

zone "localhost" IN {
        type master;
        file "localhost.zone";
        allow-update { none; };
};

zone "0.0.127.in-addr.arpa" IN {
        type master;
        file "named.local";
        allow-update { none; };
};

include "/etc/rndc.key";

Comments are C-style (/* ... */) or C++-style (start with //). The file contains block statements enclosed in curly braces ({...}) and terminated by a semicolon (;). A block statement, in turn, contains other statements, each ending with a semicolon.

This /etc/named.conf file begins with an options block statement with a number of option statements. The directory option statement tells named where to look for all other files that appear on file lines in the configuration file. In this case, named looks for the files in the /var/named directory.

Secret

The controls statement in /etc/named.conf contains security information so that the rndc command can connect to the named service at port 953 and interact with named. In this case, the controls statement contains the following line:

inet 127.0.0.1 allow { localhost; } keys { rndckey; };

This says the rndc can connect from localhost with the key named rndc (the file /etc/rndc.key defines the key and the encryption algorithm to be used).

The rndc (remote name daemon control) utility is a successor to the older ndc (name daemon controller) utility used to control the named server by sending it messages over a special control channel, a TCP port where named listens for messages. The rndc utility uses a cryptographic key and authenticates itself to the named server by using a fast MD5 secure hash algorithm called HMAC-MD5 (see RFCs 2085 and 2104 for more information on HMAC-MD5). The named server has the same cryptographic key so that it can decode the authentication information sent by rndc.

After the options and controls statements, the /etc/named.conf file contains several zone statements, each enclosed in curly braces and terminated by a semicolon. Each zone statement defines a zone. The first zone is named "." (root zone); it's a hint zone that specifies the root name servers.

The next two zone statements in /etc/named.conf are master zones. The syntax for a master zone statement for an Internet class zone (indicated by the IN keyword) is as follows:

zone "zone-name" IN {
        type master;
        file "zone-file";
        [...other optional statements...]
};

The zone-name is the name of the zone, and zone-file is the zone file that contains the resource records (RR)-the database entries-for that zone.

The /etc/named.conf file ends with an include statement:

include "/etc/rndc.key";

This statement inserts the contents of the /etc/rndc.key file into the /etc/named.conf file. This enables you to place sensitive configuration data (such as encryption keys) in a separate file with appropriate permissions to prevent nonroot users from accessing it. In this case, the /etc/rndc.key file contains the key named rndc, which was referenced in the options statement eariler in the /etc/named.conf file. Here is what the key definition looks like:

key "rndckey" {
        algorithm       hmac-md5;
        secret "AbigLongEncryptionKey";
};

The algorithm option specifies the type of algorithm, which can be dsa or hmac-md5. The secret option specifies the encryption key.

dnssec-keygen -a hmac-md5 -b 128 -n HOST yourhost.domain.

Understanding the Zone File Format

The zone file typically starts with a number of directives, each of which begins with a dollar sign ($) followed by a keyword. Two commonly used directives are $TTL and $ORIGIN.

For example, the line

$TTL    86400

uses the $TTL directive to set the default time to live (TTL) for subsequent records with undefined TTLs. The value is in seconds, and the valid TTLs are in the range 0 to 2147483647 seconds. In this case, the directive sets the default TTL as 86400 seconds (or one day). The time specified in the time-to-live directive indicates how long the information in that record should be considered valid.

The $ORIGIN directive sets the domain name that will be appended to any unqualified records. For example, the following $ORIGIN directive sets the domain name to localhost:

$ORIGIN localhost.

After the directives, the zone file contains one or more resource records. These records follow a specific format, which is outlined in the next section.

Understanding Resource Record (RR) Format

You have to understand the format of the resource records before you can understand and intelligently work with zone files. Each resource record has the following format (the optional fields are shown in square brackets):

[domain] [ttl] [class] type data [;comment]

Secret

In a resource record the fields are separated by tabs or spaces and may contain some special characters, such as an @ symbol for the domain and a semicolon (;) to indicate the start of a comment.

The first field, which must begin at the first character of the line, identifies the domain. You can use the @ symbol to use the current $ORIGIN for the domain name for this record. If you have multiple records for the same domain name, leave the first field blank.

The optional ttl field specifies the time to live-the duration for which the data can be cached and considered valid. You can specify the duration in one of the following formats:

• N, where N is a number meaning N seconds

• NW, where N is a number meaning N weeks

• ND, where N is a number meaning N days

• NH, where N is a number meaning N hours

• NM, where N is a number meaning N minutes

• NS, where N is a number meaning N seconds

  The letters W, D, H, M, and S can also be in lowercase. Thus, you can write 86400 or 1D (or 1d) to indicate a duration of one day. You can also combine these to specify more precise durations, such as 5w6d16h to indicate 5 weeks, 6 days, and 16 hours.

  The class field specifies the network type. The most commonly used value for this field is IN for Internet. Other values are CH for ChaosNet (an obsolete network used long ago by Symbolics Lisp computers), and HS for Hesiod (an NIS-like database service based on BIND).

  Next in the resource record is the type field, which denotes the type of record (such as SOA, NS, A, or PTR). Table 18-1 lists many commonly used DNS resource record types. The data field comes next, and it depends on the type field.

  Table 18-1: Common DNS Resource Record Types

  Type	Name	Description
  A	Address	Specifies the host address corresponding to a name
  A	IPv6 Address	Specifies the IPv6 host address corresponding to a name
  CERT	Digital Certificate	Holds a digital certificate
  CNAME	Canonical Name	Defines the nickname or alias for a hostname
  DNAME	Delegation Name	Replaces specified domain name with another name to be looked up
  HINFO	Host Info	Identifies the hardware and operating system for a host
  KEY	Public Key	Stores a public key associated with a DNS name
  MX	Mail Exchanger	Identifies the host that accepts mail meant for a domain (used to route email)
  NS	Name Server	Identifies authoritative name servers for a zone
  PTR	Pointer	Specifies the name corresponding to an address (used for reverse mapping-converting an IP address to a hostname)
  RP	Responsible Person	Provides the name of a technical contact for a domain
  SIG	Signature	Contains data authenticated in the secure DNS (see RFC 2535 for details)
  SOA	Start of authority	Indicates that all subsequent records are authoritative for this zone
  SRV	Services	Lists well-known network services provided by the domain
  TXT	Text	Used to include comments and other information in the DNS database
  WKS	Well Known Services	Lists services provided by a host (this has been deprecated and is no longer used)

You should learn to read the resource records, at least the ones of type SOA, NS, A, PTR, and MX, which are some of the most commonly used. The next few sections briefly describe these records, illustrating each record type through an example.

@     1D IN SOA       @ root (
                      42              ; serial 
                      3H              ; refresh -- 3 hours
                      15M             ; retry -- 15 minutes
                      1W              ; expiry -- 1 week
                      1D )            ; minimum -- 1 day

.                        3600000  IN  NS    A.ROOT-SERVERS.NET.

A.ROOT-SERVERS.NET.      3600000      A     198.41.0.4

1       IN      PTR     localhost.

naba    IN    MX    10    mailhub.lnbsoft.com.

Understanding the /var/named/named.ca File

Information about the root name servers is in the file /var/named/named.ca, as specified in the zone statement for the root zone in the /etc/named.conf file. The following listing shows the /var/named/named.ca file from a Red Hat Linux system:

;       This file holds the information on root name servers needed to
;       initialize cache of Internet domain name servers
;       (e.g. reference this file in the "cache  .  <file>"
;       configuration file of BIND domain name servers).
;
;       This file is made available by InterNIC
;       under anonymous FTP as
;           file                /domain/named.cache
;           on server           FTP.INTERNIC.NET
;
;       last update:    Nov 5, 2002
;       related version of root zone:   2002110501
;
;
; formerly NS.INTERNIC.NET
;
.                        3600000  IN  NS    A.ROOT-SERVERS.NET.
A.ROOT-SERVERS.NET.      3600000      A     198.41.0.4
;
; formerly NS1.ISI.EDU
;
.                        3600000      NS    B.ROOT-SERVERS.NET.
B.ROOT-SERVERS.NET.      3600000      A     128.9.0.107
;
; formerly C.PSI.NET
;
.                        3600000      NS    C.ROOT-SERVERS.NET.
C.ROOT-SERVERS.NET.      3600000      A     192.33.4.12
;
; formerly TERP.UMD.EDU
;
.                        3600000      NS    D.ROOT-SERVERS.NET.
D.ROOT-SERVERS.NET.      3600000      A     128.8.10.90
;
; formerly NS.NASA.GOV
;
.                        3600000      NS    E.ROOT-SERVERS.NET.
E.ROOT-SERVERS.NET.      3600000      A     192.203.230.10
;
; formerly NS.ISC.ORG
;
.                        3600000      NS    F.ROOT-SERVERS.NET.
F.ROOT-SERVERS.NET.      3600000      A     192.5.5.241
;
; formerly NS.NIC.DDN.MIL
;
.                        3600000      NS    G.ROOT-SERVERS.NET.
G.ROOT-SERVERS.NET.      3600000      A     192.112.36.4
;
; formerly AOS.ARL.ARMY.MIL
;
.                        3600000      NS    H.ROOT-SERVERS.NET.
H.ROOT-SERVERS.NET.      3600000      A     128.63.2.53
;
; formerly NIC.NORDU.NET
;
.                        3600000      NS    I.ROOT-SERVERS.NET.
I.ROOT-SERVERS.NET.      3600000      A     192.36.148.17
;
; operated by VeriSign, Inc.
;
.                        3600000      NS    J.ROOT-SERVERS.NET.
J.ROOT-SERVERS.NET.      3600000      A     192.58.128.30
;
; housed in LINX, operated by RIPE NCC
;
.                        3600000      NS    K.ROOT-SERVERS.NET.
K.ROOT-SERVERS.NET.      3600000      A     193.0.14.129
;
; operated by IANA
;
.                        3600000      NS    L.ROOT-SERVERS.NET.
L.ROOT-SERVERS.NET.      3600000      A     198.32.64.12
;
; housed in Japan, operated by WIDE
;
.                        3600000      NS    M.ROOT-SERVERS.NET.
M.ROOT-SERVERS.NET.      3600000      A     202.12.27.33
; End of File

This file contains NS and A resource records that specify the names of authoritative name servers and their addresses for the root zone (indicated by the '.' in the first field of each NS record).

The comment lines in the file begin with a semicolon. These comments give you hints about the location of the root name servers. There are 13 root name servers for the Internet, most of the root servers are located in the United States. This file is a necessity for any name server because the name server has to be able to reach at least one root name server.

Understanding the /var/named/localhost.zone File

The /etc/named.conf file includes a zone statement for the localhost zone that specifies the zone file as localhost.zone. That file is located in the /var/named directory of your Red Hat Linux system. The /var/named/localhost.zone file contains the following resource records:

$TTL    86400
$ORIGIN localhost.
@           1D IN SOA       @ root (
                            42              ; serial (d. adams)
                            3H              ; refresh
                            15M             ; retry
                            1W              ; expiry
                            1D )            ; minimum

            1D IN NS        @
            1D IN A         127.0.0.1   

This zone file starts with a $TTL directive that sets the default TTL to one day (86400 seconds) for subsequent records with undefined TTLs. Next, a $ORIGIN directive sets the domain name to localhost.

After these two directives, the /var/named/localhost.zone file contains three resource records (RRs): an SOA record, an NS record, and an A record. The SOA and the NS record specify the localhost as the primary authoritative name server for the zone. The A record specifies the address of localhost as 127.0.0.1.

Understanding the /var/named/named.local File

The third zone in the /etc/named.conf file specifies a reverse-mapping zone named 0.0.127.in-addr.arpa. For this zone, the zone file is /var/named/named.local, which contains the following:

$TTL    86400
@       IN      SOA     localhost. root.localhost.  (
                                      1997022700 ; Serial