PRO DNS AND BIND
CONTENTS PART 1 I I I PRINCIPLES AND OVERVIEW ICHAPTER AN INTRODUCTION TO DNS A BRIEF HISTORY OF NAME SERVERS NAME SERVER BASICS THE INTERNET DOMAIN NAME SYSTEM DOMAINS AND DELEGATION DOMAIN AUTHORITY DNS IMPLEMENTATION AND STRUCTURE ROOT DNS OPERATIONS TOP-LEVEL DOMAINS DNS SYSTEM COMPONENTS ZONES AND ZONE FILES MASTER AND SLAVE DNS SERVERS DNS SOFTWARE SUMMARY ICHAPTER ZONE FILES AND RESOURCE RECORDS ZONE FILE FORMAT ZONE FILE CONTENTS AN EXAMPLE ZONE FILE THE $TTL DIRECTIVE THE $ORIGIN DIRECTIVE THE SOA RESOURCE RECORD THE NS RESOURCE RECORD THE MX RESOURCE RECORD THE A RESOURCE RECORD CNAME RESOURCE RECORD WHEN CNAME RECORDS MUST BE USED ADDITIONAL RESOURCE RECORDS PTR RESOURCE RECORDS TXT RESOURCE RECORDS AAAA RESOURCE RECORDS NSEC, RRSIG, DS, DNSKEY, AND KEY RESOURCE RECORDS SRV RESOURCE RECORDS STANDARD CONFIGURATION FILE SCENARIOS DNS OPERATIONS THE DNS PROTOCOL DNS QUERIES RECURSIVE QUERIES ITERATIVE (NONRECURSIVE) QUERIES INVERSE QUERIES DNS REVERSE MAPPING IN-ADDR ARPA REVERSE-MAPPING DOMAIN ZONE MAINTENANCE FULL ZONE TRANSFER (AXFR) INCREMENTAL ZONE TRANSFER (IXFR) NOTIFY (NOTIFY) DYNAMIC UPDATE ALTERNATIVE DYNAMIC DNS APPROACHES SECURITY OVERVIEW DNS TYPES MASTER (PRIMARY) NAME SERVERS SLAVE (SECONDARY) NAME SERVERS SLAVE (SECONDARY) DNS BEHAVIOR CACHING NAME SERVERS CACHING IMPLICATIONS FORWARDING (PROXY) NAME SERVERS STEALTH (DMZ OR SPLIT) NAME SERVER STEALTH SERVERS AND THE VIEW CLAUSE STEALTH SERVER CONFIGURATION AUTHORITATIVE-ONLY NAME SERVER DNS AND IPV6 IPV6 IPV6 ADDRESS NOTATION IPV6 ADDRESS TYPES PREFIX OR SLASH NOTATION GLOBAL UNICAST IPV6 ADDRESS ALLOCATION IPV6 GLOBAL UNICAST ADDRESS FORMAT STATUS OF IPV6 DNS SUPPORT THE AAAA VS A6 RESOURCE RECORD MIXED IPV6 AND IPV4 NETWORK SUPPORT IPV6 RESOURCE RECORDS THE AAAA RESOURCE RECORD REVERSE IPV6 MAPPING THE IPV6 PTR RESOURCE RECORD PART 2 I I I GET SOMETHING RUNNING ICHAPTER INSTALLING BIND FEDORA CORE 2 INSTALLATION UPGRADING BIND 9 CONFIGURING BIND 9 FREEBSD INSTALLATION BIND 9 NONBASE INSTALL BIND 9 BASE INSTALL FREEBSD 5 3 ISSUES BUILDING BIND FROM SOURCE WINDOWS SERVER 2000 INSTALLATION BIND TYPE SAMPLES BEFORE WE START CONFIGURATION LAYOUT CONFIGURATION CONVENTIONS ZONE FILE NAMING CONVENTION REQUIRED ZONE FILES BIND NAMED CONF FILE FORMAT AND STYLE STANDARD ZONE FILES MASTER DNS SERVER MASTER NAME SERVER CONFIGURATION SLAVE DNS SERVER SLAVE NAME SERVER CONFIGURATION CACHING-ONLY DNS SERVER CACHING-ONLY NAME SERVER CONFIGURATION FORWARDING (A K A PROXY, CLIENT, REMOTE) DNS SERVER FORWARDING NAME SERVER CONFIGURATION STEALTH (A K A SPLIT OR DMZ) DNS SERVER STEALTH CONFIGURATION AUTHORITATIVE-ONLY DNS SERVER AUTHORITATIVE-ONLY NAME SERVER CONFIGURATION VIEW-BASED AUTHORITATIVE-ONLY DNS SERVER VIEW-BASED AUTHORITATIVE-ONLY NAME SERVER CONFIGURATION SECURITY AND THE VIEW SECTION COMMON DNS TASKS DELEGATE A SUBDOMAIN (SUBZONE) DOMAIN NAME SERVER CONFIGURATION SUBDOMAIN NAME SERVER CONFIGURATION VIRTUAL SUBDOMAINS CONFIGURE MAIL SERVERS FAIL-OVER DELEGATE REVERSE SUBNET MAPS ASSIGNEE ZONE FILE ASSIGNOR (END-USER) ZONE FILE DNS LOAD BALANCING BALANCING MAIL BALANCING OTHER SERVICES BALANCING SERVICES CONTROLLING THE ROUND-ROBIN EFFECTIVENESS OF DNS LOAD BALANCING DEFINE AN SPF RECORD TXT RR FORMAT SPF TYPE VALUES SPF RECORD EXAMPLES SUPPORTING HTTP://EXAMPLE COM APACHE CONFIGURATION OUT-OF-SEQUENCE SERIAL NUMBERS USE OF WILDCARDS IN ZONE FILES DNS DIAGNOSTICS AND TOOLS DNS UTILITIES THE NSLOOKUP UTILITY NSLOOKUP COMMAND FORMAT QUICK EXAMPLES OPTIONS EXAMPLES: COMMAND LINE EXAMPLE: INTERACTIVE MODE BIND DIG UTILITY DIG SYNTAX DIG OPTIONS DIG EXAMPLES DIG OUTPUT DIG RESPONSE VALUES BIND NAMED-CHECKCONF UTILITY NAMED-CHECKCONF SYNTAX NAMED-CHECKCONF OPTIONS BIND NAMED-CHECKZONE UTILITY NAMED-CHECKZONE SYNTAX RNDC RNDC SYNTAX RNDC OPTIONS RNDC CONF CLAUSES AND STATEMENTS RNDC CONFIGURATION EXAMPLES RNDC COMMANDS RNDC-CONFGEN UTILITY RNDC-CONFGEN SYNTAX RNDC-CONFGEN OPTIONS BIND NSUPDATE UTILITY NSUPDATE SYNTAX NSUPDATE OPTIONS NSUPDATE COMMAND FORMAT NSUPDATE EXAMPLE DNSSEC-KEYGEN UTILITY DNSSEC-KEYGEN SYNTAX DNSSEC-KEYGEN OPTIONS DNSSEC-KEYGEN EXAMPLES DNSSEC-SIGNZONE UTILITY DNSSEC-SIGNZONE SYNTAX DNSSEC-SIGNZONE OPTIONS DNSSEC-SIGNZONE EXAMPLES DIAGNOSING DNS PROBLEMS BEFORE THE PROBLEM HAPPENS WHEN THE PROBLEM OCCURS PART 3 I I I DNS SECURITY ICHAPTER DNS SECURE CONFIGURATIONS SECURITY OVERVIEW AND AUDIT DNS NORMAL DATA FLOW SECURITY CLASSIFICATION ADMINISTRATIVE SECURITY UP-TO-DATE SOFTWARE LIMIT FUNCTIONALITY LIMIT PERMISSIONS RUNNING BIND AS NONROOT BIND IN A CHROOT JAIL STREAM THE LOG SOFTWARE DIVERSITY A CRYPTOGRAPHIC OVERVIEW SYMMETRIC CRYPTOGRAPHY ASYMMETRIC CRYPTOGRAPHY MESSAGE DIGESTS MESSAGE AUTHENTICATION CODES DIGITAL SIGNATURES DNS CRYPTOGRAPHIC USE SECURING ZONE TRANSFERS AUTHENTICATION AND INTEGRITY OF ZONE TRANSFERS TSIG CONFIGURATION SECURING DYNAMIC UPDATES TSIG DDNS CONFIGURATION SIG(0) CONFIGURATION DNSSEC THE DNSSEC ENVIRONMENT ISLANDS OF SECURITY CHAINS OF TRUST SECURING OR SIGNING THE ZONE SECURE ZONE MAINTENANCE SECURE DELEGATION DYNAMIC DNS AND DNSSEC DNSSEC IMPLEMENTATION SECURING THE EXAMPLE COM ZONE ESTABLISHING A TRUSTED ANCHOR SIGNING THE SUB EXAMPLE COM ZONE CREATING THE CHAIN OF TRUST KEY ROLLOVER DNSSEC LOOKASIDE VALIDATION DLV CONFIGURATION DLV SERVICE PART 4 I I I REFERENCE ICHAPTER BIND CONFIGURATION REFERENCE BIND COMMAND LINE BIND DEBUG LEVELS BIND SIGNALS BIND CONFIGURATION OVERVIEW LAYOUT STYLES NAMED-CHECKCONF IS YOUR FRIEND BIND CLAUSES BIND ADDRESS_MATCH_LIST DEFINITION BIND ACL CLAUSE BIND CONTROLS CLAUSE BIND INCLUDE STATEMENT BIND KEY CLAUSE BIND LOGGING CLAUSE BIND LWRES CLAUSE BIND MASTERS CLAUSE BIND OPTIONS CLAUSE BIND SERVER CLAUSE BIND TRUSTED-KEYS CLAUSE BIND VIEW CLAUSE BIND ZONE CLAUSE BIND STATEMENTS BIND CONTROLS STATEMENTS INET STATEMENT BIND LOGGING STATEMENTS CHANNEL STATEMENT CATEGORY STATEMENT BIND RESOLVER STATEMENTS VIEW SEARCH NDOTS BIND TRANSFER STATEMENTS ALLOW-NOTIFY ALLOW-TRANSFER ALLOW-UPDATE ALLOW-UPDATE-FORWARDING ALSO-NOTIFY ALT-TRANSFER-SOURCE, ALT-TRANSFER-SOURCE-V6 IXFR-FROM-DIFFERENCES MAX-JOURNAL-SIZE MAX-REFRESH-TIME, MIN-REFRESH-TIME MAX-RETRY-TIME, MIN-RETRY-TIME MAX-TRANSFER-IDLE-IN MAX-TRANSFER-IDLE-OUT MAX-TRANSFER-TIME-IN MAX-TRANSFER-TIME-OUT MULTI-MASTER NOTIFY NOTIFY-SOURCE, NOTIFY-SOURCE-V6 PROVIDE-IXFR REQUEST-IXFR SERIAL-QUERY-RATE TRANSFER-FORMAT TRANSFER-SOURCE, TRANSFER-SOURCE-V6 TRANSFERS-IN TRANSFERS-PER-NS TRANSFERS-OUT UPDATE-POLICY USE-ALT-TRANSFER-SOURCE DNS BIND OPERATIONS AVOID-V4-UDP-PORTS, AVOID-V6-UDP-PORTS CHECK-NAMES CLEANING-INTERVAL CORESIZE DATABASE DATASIZE DIALUP DIRECTORY DUAL-STACK-SERVER DUMP-FILE EDNS-UDP-SIZE FILES HEARTBEAT-INTERVAL HOSTNAME INTERFACE-INTERVAL LAME-TTL LISTEN-ON LISTEN-ON-V6 MATCH-MAPPED-ADDRESSES MAX-CACHE-SIZE MAX-CACHE-TTL MAX-NCACHE-TTL MEMSTATISTICS-FILE PID-FILE PORT PREFERRED-GLUE QUERYLOG RECURSING-FILE SERVER-ID STACKSIZE STATISTICS-FILE TCP-LISTEN-QUEUE TCP-CLIENTS VERSION ZONE-STATISTICS DNS BIND QUERY STATEMENTS ADDITIONAL-FROM-AUTH, ADDITIONAL-FROM-CACHE ALLOW-QUERY ALLOW-RECURSION AUTH-NXDOMAIN BLACKHOLE DELEGATION-ONLY FORWARD FORWARDERS MINIMAL-RESPONSES QUERY-SOURCE, QUERY-SOURCE-V6 RECURSION RECURSIVE-CLIENTS ROOT-DELEGATION-ONLY RRSET-ORDER SORTLIST DNS BIND SECURITY STATEMENTS ALGORITHM DISABLE-ALGORITHMS DNSSEC-ENABLE DNSSEC-LOOKASIDE DNSSEC-MUST-BE-SECURE KEY-DIRECTORY RANDOM-DEVICE SECRET SIG-VALIDITY-INTERVAL TKEY-DHKEY TKEY-DOMAIN TKEY-GSSAPI-CREDENTIAL DNS BIND SERVER STATEMENTS BOGUS EDNS KEYS TRANSFERS DNS BIND VIEW STATEMENTS MATCH-CLIENTS MATCH-DESTINATIONS MATCH-RECURSIVE-ONLY DNS BIND ZONE STATEMENTS FILE MASTERS TYPE ZONE FILE REFERENCE DNS ZONE FILE STRUCTURE DNS DIRECTIVES THE $INCLUDE DIRECTIVE THE $GENERATE DIRECTIVE DNS RESOURCE RECORDS RESOURCE RECORD COMMON FORMAT RRSETS RESOURCE RECORD DESCRIPTIONS IPV4 ADDRESS (A) RECORD EXPERIMENTAL IPV6 ADDRESS (A6) RECORD IPV6 ADDRESS (AAAA) RECORD AFS DATABASE (AFSDB) RECORD ADDRESS PREFIX LIST (APL) RECORD ATM ADDRESS (ATMA) RECORD CERTIFICATE (CERT) RECORD CANONICAL NAME (CNAME) RECORD DELEGATION OF REVERSE NAMES (DNAME) RECORD DNSKEY RECORD DELEGATION SIGNER (DS) RECORD SYSTEM INFORMATION (HINFO) RECORD INTEGRATED SERVICES DIGITAL NETWORK (ISDN) RECORD IPSEC KEY (IPSECKEY) RECORD PUBLIC KEY (KEY) RECORD KEY EXCHANGER (KX) RECORD LOCATION (LOC) RECORD MAILBOX (MB) RECORD MAIL GROUP (MG) RECORD MAILBOX RENAMED (MR) RECORD MAILBOX MAIL LIST INFORMATION (MINFO) RECORD MAIL EXCHANGE (MX) RECORD NAMING AUTHORITY POINTER (NAPTR) RECORD NAME SERVER (NS) RECORD NETWORK SERVICE ACCESS POINT (NSAP) RECORD NEXT SECURE (NSEC) RECORD POINTER (PTR) RECORD X 400 TO RFC 822 E-MAIL (PX) RECORD RESPONSIBLE PERSON (RP) RECORD RESOURCE RECORD SIGNATURE (RRSIG) RECORD ROUTE THROUGH (RT) RECORD SIGNATURE (SIG) RECORD START OF AUTHORITY (SOA) RECORD SERVICES (SRV) RECORD SSH KEY FINGERPRINT (SSHFP) RECORD TEXT (TXT) RECORD WELL-KNOWN SERVICE (WKS) RECORD X 25 ADDRESS (X25) RECORD ALTERNATIVE CRYPTOGRAPHIC ALGORITHMS USER-DEFINED RRS PART 5 I I I PROGRAMMING ICHAPTER BIND APIS AND RESOLVER LIBRARIES BIND API OVERVIEW ADVANCED DATABASE API (ADB) SIMPLE DATABASE API (SDB) THE SIMPLE DATABASE API (SDB) CALLBACK OVERVIEW REGISTERING THE CALLBACKS ADDING THE DRIVER TO BIND THE CALLBACK FUNCTIONS RETURNING RRS MEMORY MANAGEMENT FOR DRIVERS LOGGING FOR DRIVERS TESTING THE DRIVER SDB SAMPLE DRIVER RESOLVER LIBRARIES POSIX LIBRARY STATUS THE RES LIBRARY SET INVOKING THE RES LIBRARY THE _RES STRUCTURE RES LIBRARY FUNCTIONS DNS MESSAGES AND RECORDS DNS MESSAGE FORMATS DNS MESSAGE OVERVIEW DNS MESSAGE FORMAT DNS MESSAGE HEADER DNS QUESTION SECTION DNS ANSWER, AUTHORITY, AND ADDITIONAL SECTIONS EDNS0 TRANSACTIONS OPT PSEUDO RR FORMAT DNS BINARY RR FORMAT SECURITY ALGORITHM FORMATS NSEC BITMAP FORMAT