1181 lines
20 KiB
HTML
1181 lines
20 KiB
HTML
<HTML
|
|
><HEAD
|
|
><TITLE
|
|
>Introduction </TITLE
|
|
><META
|
|
NAME="GENERATOR"
|
|
CONTENT="Modular DocBook HTML Stylesheet Version 1.73
|
|
"><LINK
|
|
REL="HOME"
|
|
TITLE="BIND 9 Administrator Reference Manual"
|
|
HREF="Bv9ARM.html"><LINK
|
|
REL="PREVIOUS"
|
|
TITLE="BIND 9 Administrator Reference Manual"
|
|
HREF="Bv9ARM.html"><LINK
|
|
REL="NEXT"
|
|
TITLE="BIND Resource Requirements"
|
|
HREF="Bv9ARM.ch02.html"></HEAD
|
|
><BODY
|
|
CLASS="chapter"
|
|
BGCOLOR="#FFFFFF"
|
|
TEXT="#000000"
|
|
LINK="#0000FF"
|
|
VLINK="#840084"
|
|
ALINK="#0000FF"
|
|
><DIV
|
|
CLASS="NAVHEADER"
|
|
><TABLE
|
|
SUMMARY="Header navigation table"
|
|
WIDTH="100%"
|
|
BORDER="0"
|
|
CELLPADDING="0"
|
|
CELLSPACING="0"
|
|
><TR
|
|
><TH
|
|
COLSPAN="3"
|
|
ALIGN="center"
|
|
>BIND 9 Administrator Reference Manual</TH
|
|
></TR
|
|
><TR
|
|
><TD
|
|
WIDTH="10%"
|
|
ALIGN="left"
|
|
VALIGN="bottom"
|
|
><A
|
|
HREF="Bv9ARM.html"
|
|
ACCESSKEY="P"
|
|
>Prev</A
|
|
></TD
|
|
><TD
|
|
WIDTH="80%"
|
|
ALIGN="center"
|
|
VALIGN="bottom"
|
|
></TD
|
|
><TD
|
|
WIDTH="10%"
|
|
ALIGN="right"
|
|
VALIGN="bottom"
|
|
><A
|
|
HREF="Bv9ARM.ch02.html"
|
|
ACCESSKEY="N"
|
|
>Next</A
|
|
></TD
|
|
></TR
|
|
></TABLE
|
|
><HR
|
|
ALIGN="LEFT"
|
|
WIDTH="100%"></DIV
|
|
><DIV
|
|
CLASS="chapter"
|
|
><H1
|
|
><A
|
|
NAME="ch01"
|
|
>Chapter 1. Introduction </A
|
|
></H1
|
|
><DIV
|
|
CLASS="TOC"
|
|
><DL
|
|
><DT
|
|
><B
|
|
>Table of Contents</B
|
|
></DT
|
|
><DT
|
|
>1.1. <A
|
|
HREF="Bv9ARM.ch01.html#AEN15"
|
|
>Scope of Document</A
|
|
></DT
|
|
><DT
|
|
>1.2. <A
|
|
HREF="Bv9ARM.ch01.html#AEN22"
|
|
>Organization of This Document</A
|
|
></DT
|
|
><DT
|
|
>1.3. <A
|
|
HREF="Bv9ARM.ch01.html#AEN42"
|
|
>Conventions Used in This Document</A
|
|
></DT
|
|
><DT
|
|
>1.4. <A
|
|
HREF="Bv9ARM.ch01.html#AEN107"
|
|
>The Domain Name System (<SPAN
|
|
CLASS="acronym"
|
|
>DNS</SPAN
|
|
>)</A
|
|
></DT
|
|
></DL
|
|
></DIV
|
|
><P
|
|
>The Internet Domain Name System (<SPAN
|
|
CLASS="acronym"
|
|
>DNS</SPAN
|
|
>) consists of the syntax
|
|
to specify the names of entities in the Internet in a hierarchical
|
|
manner, the rules used for delegating authority over names, and the
|
|
system implementation that actually maps names to Internet
|
|
addresses. <SPAN
|
|
CLASS="acronym"
|
|
>DNS</SPAN
|
|
> data is maintained in a group of distributed
|
|
hierarchical databases.</P
|
|
><DIV
|
|
CLASS="sect1"
|
|
><H1
|
|
CLASS="sect1"
|
|
><A
|
|
NAME="AEN15"
|
|
>1.1. Scope of Document</A
|
|
></H1
|
|
><P
|
|
>The Berkeley Internet Name Domain (<SPAN
|
|
CLASS="acronym"
|
|
>BIND</SPAN
|
|
>) implements an
|
|
domain name server for a number of operating systems. This
|
|
document provides basic information about the installation and
|
|
care of the Internet Software Consortium (<SPAN
|
|
CLASS="acronym"
|
|
>ISC</SPAN
|
|
>)
|
|
<SPAN
|
|
CLASS="acronym"
|
|
>BIND</SPAN
|
|
> version 9 software package for system
|
|
administrators.</P
|
|
><P
|
|
>This version of the manual corresponds to BIND version 9.3.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="sect1"
|
|
><H1
|
|
CLASS="sect1"
|
|
><A
|
|
NAME="AEN22"
|
|
>1.2. Organization of This Document</A
|
|
></H1
|
|
><P
|
|
>In this document, <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>Section 1</I
|
|
></SPAN
|
|
> introduces
|
|
the basic <SPAN
|
|
CLASS="acronym"
|
|
>DNS</SPAN
|
|
> and <SPAN
|
|
CLASS="acronym"
|
|
>BIND</SPAN
|
|
> concepts. <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>Section 2</I
|
|
></SPAN
|
|
>
|
|
describes resource requirements for running <SPAN
|
|
CLASS="acronym"
|
|
>BIND</SPAN
|
|
> in various
|
|
environments. Information in <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>Section 3</I
|
|
></SPAN
|
|
> is
|
|
<SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>task-oriented</I
|
|
></SPAN
|
|
> in its presentation and is
|
|
organized functionally, to aid in the process of installing the
|
|
<SPAN
|
|
CLASS="acronym"
|
|
>BIND</SPAN
|
|
> 9 software. The task-oriented section is followed by
|
|
<SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>Section 4</I
|
|
></SPAN
|
|
>, which contains more advanced
|
|
concepts that the system administrator may need for implementing
|
|
certain options. <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>Section 5</I
|
|
></SPAN
|
|
>
|
|
describes the <SPAN
|
|
CLASS="acronym"
|
|
>BIND</SPAN
|
|
> 9 lightweight
|
|
resolver. The contents of <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>Section 6</I
|
|
></SPAN
|
|
> are
|
|
organized as in a reference manual to aid in the ongoing
|
|
maintenance of the software. <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>Section 7
|
|
</I
|
|
></SPAN
|
|
>addresses security considerations, and
|
|
<SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>Section 8</I
|
|
></SPAN
|
|
> contains troubleshooting help. The
|
|
main body of the document is followed by several
|
|
<SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>Appendices</I
|
|
></SPAN
|
|
> which contain useful reference
|
|
information, such as a <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>Bibliography</I
|
|
></SPAN
|
|
> and
|
|
historic information related to <SPAN
|
|
CLASS="acronym"
|
|
>BIND</SPAN
|
|
> and the Domain Name
|
|
System.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="sect1"
|
|
><H1
|
|
CLASS="sect1"
|
|
><A
|
|
NAME="AEN42"
|
|
>1.3. Conventions Used in This Document</A
|
|
></H1
|
|
><P
|
|
>In this document, we use the following general typographic
|
|
conventions:</P
|
|
><DIV
|
|
CLASS="informaltable"
|
|
><A
|
|
NAME="AEN45"
|
|
></A
|
|
><P
|
|
></P
|
|
><TABLE
|
|
CELLPADDING="3"
|
|
BORDER="1"
|
|
CLASS="CALSTABLE"
|
|
><TBODY
|
|
><TR
|
|
><TD
|
|
WIDTH="288"
|
|
ALIGN="LEFT"
|
|
VALIGN="MIDDLE"
|
|
> <P
|
|
><SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>To
|
|
describe:</I
|
|
></SPAN
|
|
></P
|
|
></TD
|
|
><TD
|
|
WIDTH="252"
|
|
ALIGN="LEFT"
|
|
VALIGN="MIDDLE"
|
|
> <P
|
|
><SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>We use the style:</I
|
|
></SPAN
|
|
></P
|
|
></TD
|
|
></TR
|
|
><TR
|
|
><TD
|
|
WIDTH="288"
|
|
ALIGN="LEFT"
|
|
VALIGN="MIDDLE"
|
|
> <P
|
|
>a pathname, filename, URL, hostname,
|
|
mailing list name, or new term or concept</P
|
|
></TD
|
|
><TD
|
|
WIDTH="252"
|
|
ALIGN="LEFT"
|
|
VALIGN="MIDDLE"
|
|
><P
|
|
><TT
|
|
CLASS="filename"
|
|
>Fixed width</TT
|
|
></P
|
|
></TD
|
|
></TR
|
|
><TR
|
|
><TD
|
|
WIDTH="288"
|
|
ALIGN="LEFT"
|
|
VALIGN="MIDDLE"
|
|
><P
|
|
>literal user
|
|
input</P
|
|
></TD
|
|
><TD
|
|
WIDTH="252"
|
|
ALIGN="LEFT"
|
|
VALIGN="MIDDLE"
|
|
><P
|
|
><TT
|
|
CLASS="userinput"
|
|
><B
|
|
>Fixed Width Bold</B
|
|
></TT
|
|
></P
|
|
></TD
|
|
></TR
|
|
><TR
|
|
><TD
|
|
WIDTH="288"
|
|
ALIGN="LEFT"
|
|
VALIGN="MIDDLE"
|
|
><P
|
|
>program output</P
|
|
></TD
|
|
><TD
|
|
WIDTH="252"
|
|
ALIGN="LEFT"
|
|
VALIGN="MIDDLE"
|
|
><P
|
|
><TT
|
|
CLASS="computeroutput"
|
|
>Fixed Width</TT
|
|
></P
|
|
></TD
|
|
></TR
|
|
></TBODY
|
|
></TABLE
|
|
><P
|
|
></P
|
|
></DIV
|
|
><P
|
|
>The following conventions are used in descriptions of the
|
|
<SPAN
|
|
CLASS="acronym"
|
|
>BIND</SPAN
|
|
> configuration file:<DIV
|
|
CLASS="informaltable"
|
|
><A
|
|
NAME="AEN77"
|
|
></A
|
|
><P
|
|
></P
|
|
><TABLE
|
|
CELLPADDING="3"
|
|
BORDER="1"
|
|
CLASS="CALSTABLE"
|
|
><TBODY
|
|
><TR
|
|
><TD
|
|
WIDTH="288"
|
|
ALIGN="LEFT"
|
|
VALIGN="MIDDLE"
|
|
><P
|
|
><SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>To
|
|
describe:</I
|
|
></SPAN
|
|
></P
|
|
></TD
|
|
><TD
|
|
WIDTH="252"
|
|
ALIGN="LEFT"
|
|
VALIGN="MIDDLE"
|
|
><P
|
|
><SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>We use the style:</I
|
|
></SPAN
|
|
></P
|
|
></TD
|
|
></TR
|
|
><TR
|
|
><TD
|
|
WIDTH="288"
|
|
ALIGN="LEFT"
|
|
VALIGN="MIDDLE"
|
|
><P
|
|
>keywords</P
|
|
></TD
|
|
><TD
|
|
WIDTH="252"
|
|
ALIGN="LEFT"
|
|
VALIGN="MIDDLE"
|
|
><P
|
|
><TT
|
|
CLASS="literal"
|
|
>Fixed Width</TT
|
|
></P
|
|
></TD
|
|
></TR
|
|
><TR
|
|
><TD
|
|
WIDTH="288"
|
|
ALIGN="LEFT"
|
|
VALIGN="MIDDLE"
|
|
><P
|
|
>variables</P
|
|
></TD
|
|
><TD
|
|
WIDTH="252"
|
|
ALIGN="LEFT"
|
|
VALIGN="MIDDLE"
|
|
><P
|
|
><TT
|
|
CLASS="varname"
|
|
>Fixed Width</TT
|
|
></P
|
|
></TD
|
|
></TR
|
|
><TR
|
|
><TD
|
|
WIDTH="288"
|
|
ALIGN="LEFT"
|
|
VALIGN="MIDDLE"
|
|
><P
|
|
>Optional input</P
|
|
></TD
|
|
><TD
|
|
WIDTH="252"
|
|
ALIGN="LEFT"
|
|
VALIGN="MIDDLE"
|
|
><P
|
|
>[<SPAN
|
|
CLASS="optional"
|
|
>Text is enclosed in square brackets</SPAN
|
|
>]</P
|
|
></TD
|
|
></TR
|
|
></TBODY
|
|
></TABLE
|
|
><P
|
|
></P
|
|
></DIV
|
|
></P
|
|
></DIV
|
|
><DIV
|
|
CLASS="sect1"
|
|
><H1
|
|
CLASS="sect1"
|
|
><A
|
|
NAME="AEN107"
|
|
>1.4. The Domain Name System (<SPAN
|
|
CLASS="acronym"
|
|
>DNS</SPAN
|
|
>)</A
|
|
></H1
|
|
><P
|
|
>The purpose of this document is to explain the installation
|
|
and upkeep of the <SPAN
|
|
CLASS="acronym"
|
|
>BIND</SPAN
|
|
> software package, and we
|
|
begin by reviewing the fundamentals of the Domain Name System
|
|
(<SPAN
|
|
CLASS="acronym"
|
|
>DNS</SPAN
|
|
>) as they relate to <SPAN
|
|
CLASS="acronym"
|
|
>BIND</SPAN
|
|
>.
|
|
</P
|
|
><DIV
|
|
CLASS="sect2"
|
|
><H2
|
|
CLASS="sect2"
|
|
><A
|
|
NAME="AEN114"
|
|
>1.4.1. DNS Fundamentals</A
|
|
></H2
|
|
><P
|
|
>The Domain Name System (DNS) is the hierarchical, distributed
|
|
database. It stores information for mapping Internet host names to IP
|
|
addresses and vice versa, mail routing information, and other data
|
|
used by Internet applications.</P
|
|
><P
|
|
>Clients look up information in the DNS by calling a
|
|
<SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>resolver</I
|
|
></SPAN
|
|
> library, which sends queries to one or
|
|
more <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>name servers</I
|
|
></SPAN
|
|
> and interprets the responses.
|
|
The <SPAN
|
|
CLASS="acronym"
|
|
>BIND</SPAN
|
|
> 9 software distribution contains a
|
|
name server, <B
|
|
CLASS="command"
|
|
>named</B
|
|
>, and two resolver
|
|
libraries, <B
|
|
CLASS="command"
|
|
>liblwres</B
|
|
> and <B
|
|
CLASS="command"
|
|
>libbind</B
|
|
>.
|
|
</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="sect2"
|
|
><H2
|
|
CLASS="sect2"
|
|
><A
|
|
NAME="AEN124"
|
|
>1.4.2. Domains and Domain Names</A
|
|
></H2
|
|
><P
|
|
>The data stored in the DNS is identified by <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>domain
|
|
names</I
|
|
></SPAN
|
|
> that are organized as a tree according to
|
|
organizational or administrative boundaries. Each node of the tree,
|
|
called a <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>domain</I
|
|
></SPAN
|
|
>, is given a label. The domain name of the
|
|
node is the concatenation of all the labels on the path from the
|
|
node to the <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>root</I
|
|
></SPAN
|
|
> node. This is represented
|
|
in written form as a string of labels listed from right to left and
|
|
separated by dots. A label need only be unique within its parent
|
|
domain.</P
|
|
><P
|
|
>For example, a domain name for a host at the
|
|
company <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>Example, Inc.</I
|
|
></SPAN
|
|
> could be
|
|
<TT
|
|
CLASS="literal"
|
|
>mail.example.com</TT
|
|
>,
|
|
where <TT
|
|
CLASS="literal"
|
|
>com</TT
|
|
> is the
|
|
top level domain to which
|
|
<TT
|
|
CLASS="literal"
|
|
>ourhost.example.com</TT
|
|
> belongs,
|
|
<TT
|
|
CLASS="literal"
|
|
>example</TT
|
|
> is
|
|
a subdomain of <TT
|
|
CLASS="literal"
|
|
>com</TT
|
|
>, and
|
|
<TT
|
|
CLASS="literal"
|
|
>ourhost</TT
|
|
> is the
|
|
name of the host.</P
|
|
><P
|
|
>For administrative purposes, the name space is partitioned into
|
|
areas called <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>zones</I
|
|
></SPAN
|
|
>, each starting at a node and
|
|
extending down to the leaf nodes or to nodes where other zones start.
|
|
The data for each zone is stored in a <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>name
|
|
server</I
|
|
></SPAN
|
|
>, which answers queries about the zone using the
|
|
<SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>DNS protocol</I
|
|
></SPAN
|
|
>.
|
|
</P
|
|
><P
|
|
>The data associated with each domain name is stored in the
|
|
form of <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>resource records</I
|
|
></SPAN
|
|
> (<SPAN
|
|
CLASS="acronym"
|
|
>RR</SPAN
|
|
>s).
|
|
Some of the supported resource record types are described in
|
|
<A
|
|
HREF="Bv9ARM.ch06.html#types_of_resource_records_and_when_to_use_them"
|
|
>Section 6.3.1</A
|
|
>.</P
|
|
><P
|
|
>For more detailed information about the design of the DNS and
|
|
the DNS protocol, please refer to the standards documents listed in
|
|
<A
|
|
HREF="Bv9ARM.ch09.html#rfcs"
|
|
>Section A.3.1</A
|
|
>.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="sect2"
|
|
><H2
|
|
CLASS="sect2"
|
|
><A
|
|
NAME="AEN148"
|
|
>1.4.3. Zones</A
|
|
></H2
|
|
><P
|
|
>To properly operate a name server, it is important to understand
|
|
the difference between a <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>zone</I
|
|
></SPAN
|
|
>
|
|
and a <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>domain</I
|
|
></SPAN
|
|
>.</P
|
|
><P
|
|
>As we stated previously, a zone is a point of delegation in
|
|
the <SPAN
|
|
CLASS="acronym"
|
|
>DNS</SPAN
|
|
> tree. A zone consists of
|
|
those contiguous parts of the domain
|
|
tree for which a name server has complete information and over which
|
|
it has authority. It contains all domain names from a certain point
|
|
downward in the domain tree except those which are delegated to
|
|
other zones. A delegation point is marked by one or more
|
|
<SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>NS records</I
|
|
></SPAN
|
|
> in the
|
|
parent zone, which should be matched by equivalent NS records at
|
|
the root of the delegated zone.</P
|
|
><P
|
|
>For instance, consider the <TT
|
|
CLASS="literal"
|
|
>example.com</TT
|
|
>
|
|
domain which includes names
|
|
such as <TT
|
|
CLASS="literal"
|
|
>host.aaa.example.com</TT
|
|
> and
|
|
<TT
|
|
CLASS="literal"
|
|
>host.bbb.example.com</TT
|
|
> even though
|
|
the <TT
|
|
CLASS="literal"
|
|
>example.com</TT
|
|
> zone includes
|
|
only delegations for the <TT
|
|
CLASS="literal"
|
|
>aaa.example.com</TT
|
|
> and
|
|
<TT
|
|
CLASS="literal"
|
|
>bbb.example.com</TT
|
|
> zones. A zone can map
|
|
exactly to a single domain, but could also include only part of a
|
|
domain, the rest of which could be delegated to other
|
|
name servers. Every name in the <SPAN
|
|
CLASS="acronym"
|
|
>DNS</SPAN
|
|
> tree is a
|
|
<SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>domain</I
|
|
></SPAN
|
|
>, even if it is
|
|
<SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>terminal</I
|
|
></SPAN
|
|
>, that is, has no
|
|
<SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>subdomains</I
|
|
></SPAN
|
|
>. Every subdomain is a domain and
|
|
every domain except the root is also a subdomain. The terminology is
|
|
not intuitive and we suggest that you read RFCs 1033, 1034 and 1035 to
|
|
gain a complete understanding of this difficult and subtle
|
|
topic.</P
|
|
><P
|
|
>Though <SPAN
|
|
CLASS="acronym"
|
|
>BIND</SPAN
|
|
> is called a "domain name server",
|
|
it deals primarily in terms of zones. The master and slave
|
|
declarations in the <TT
|
|
CLASS="filename"
|
|
>named.conf</TT
|
|
> file specify
|
|
zones, not domains. When you ask some other site if it is willing to
|
|
be a slave server for your <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>domain</I
|
|
></SPAN
|
|
>, you are
|
|
actually asking for slave service for some collection of zones.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="sect2"
|
|
><H2
|
|
CLASS="sect2"
|
|
><A
|
|
NAME="AEN171"
|
|
>1.4.4. Authoritative Name Servers</A
|
|
></H2
|
|
><P
|
|
>Each zone is served by at least
|
|
one <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>authoritative name server</I
|
|
></SPAN
|
|
>,
|
|
which contains the complete data for the zone.
|
|
To make the DNS tolerant of server and network failures,
|
|
most zones have two or more authoritative servers.
|
|
</P
|
|
><P
|
|
>Responses from authoritative servers have the "authoritative
|
|
answer" (AA) bit set in the response packets. This makes them
|
|
easy to identify when debugging DNS configurations using tools like
|
|
<B
|
|
CLASS="command"
|
|
>dig</B
|
|
> (<A
|
|
HREF="Bv9ARM.ch03.html#diagnostic_tools"
|
|
>Section 3.3.1.1</A
|
|
>).</P
|
|
><DIV
|
|
CLASS="sect3"
|
|
><H3
|
|
CLASS="sect3"
|
|
><A
|
|
NAME="AEN178"
|
|
>1.4.4.1. The Primary Master</A
|
|
></H3
|
|
><P
|
|
> The authoritative server where the master copy of the zone data is maintained is
|
|
called the <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>primary master</I
|
|
></SPAN
|
|
> server, or simply the
|
|
<SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>primary</I
|
|
></SPAN
|
|
>. It loads the zone contents from some
|
|
local file edited by humans or perhaps generated mechanically from
|
|
some other local file which is edited by humans. This file is called
|
|
the <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>zone file</I
|
|
></SPAN
|
|
> or <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>master file</I
|
|
></SPAN
|
|
>.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="sect3"
|
|
><H3
|
|
CLASS="sect3"
|
|
><A
|
|
NAME="AEN185"
|
|
>1.4.4.2. Slave Servers</A
|
|
></H3
|
|
><P
|
|
>The other authoritative servers, the <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>slave</I
|
|
></SPAN
|
|
>
|
|
servers (also known as <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>secondary</I
|
|
></SPAN
|
|
> servers) load
|
|
the zone contents from another server using a replication process
|
|
known as a <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>zone transfer</I
|
|
></SPAN
|
|
>. Typically the data are
|
|
transferred directly from the primary master, but it is also possible
|
|
to transfer it from another slave. In other words, a slave server
|
|
may itself act as a master to a subordinate slave server.</P
|
|
></DIV
|
|
><DIV
|
|
CLASS="sect3"
|
|
><H3
|
|
CLASS="sect3"
|
|
><A
|
|
NAME="AEN191"
|
|
>1.4.4.3. Stealth Servers</A
|
|
></H3
|
|
><P
|
|
>Usually all of the zone's authoritative servers are listed in
|
|
NS records in the parent zone. These NS records constitute
|
|
a <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>delegation</I
|
|
></SPAN
|
|
> of the zone from the parent.
|
|
The authoritative servers are also listed in the zone file itself,
|
|
at the <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>top level</I
|
|
></SPAN
|
|
> or <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>apex</I
|
|
></SPAN
|
|
>
|
|
of the zone. You can list servers in the zone's top-level NS
|
|
records that are not in the parent's NS delegation, but you cannot
|
|
list servers in the parent's delegation that are not present at
|
|
the zone's top level.</P
|
|
><P
|
|
>A <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>stealth server</I
|
|
></SPAN
|
|
> is a server that is
|
|
authoritative for a zone but is not listed in that zone's NS
|
|
records. Stealth servers can be used for keeping a local copy of a
|
|
zone to speed up access to the zone's records or to make sure that the
|
|
zone is available even if all the "official" servers for the zone are
|
|
inaccessible.</P
|
|
><P
|
|
>A configuration where the primary master server itself is a
|
|
stealth server is often referred to as a "hidden primary"
|
|
configuration. One use for this configuration is when the primary master
|
|
is behind a firewall and therefore unable to communicate directly
|
|
with the outside world.</P
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="sect2"
|
|
><H2
|
|
CLASS="sect2"
|
|
><A
|
|
NAME="AEN200"
|
|
>1.4.5. Caching Name Servers</A
|
|
></H2
|
|
><P
|
|
>The resolver libraries provided by most operating systems are
|
|
<SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>stub resolvers</I
|
|
></SPAN
|
|
>, meaning that they are not capable of
|
|
performing the full DNS resolution process by themselves by talking
|
|
directly to the authoritative servers. Instead, they rely on a local
|
|
name server to perform the resolution on their behalf. Such a server
|
|
is called a <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>recursive</I
|
|
></SPAN
|
|
> name server; it performs
|
|
<SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>recursive lookups</I
|
|
></SPAN
|
|
> for local clients.</P
|
|
><P
|
|
>To improve performance, recursive servers cache the results of
|
|
the lookups they perform. Since the processes of recursion and
|
|
caching are intimately connected, the terms
|
|
<SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>recursive server</I
|
|
></SPAN
|
|
> and
|
|
<SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>caching server</I
|
|
></SPAN
|
|
> are often used synonymously.</P
|
|
><P
|
|
>The length of time for which a record may be retained in
|
|
in the cache of a caching name server is controlled by the
|
|
Time To Live (TTL) field associated with each resource record.
|
|
</P
|
|
><DIV
|
|
CLASS="sect3"
|
|
><H3
|
|
CLASS="sect3"
|
|
><A
|
|
NAME="AEN210"
|
|
>1.4.5.1. Forwarding</A
|
|
></H3
|
|
><P
|
|
>Even a caching name server does not necessarily perform
|
|
the complete recursive lookup itself. Instead, it can
|
|
<SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>forward</I
|
|
></SPAN
|
|
> some or all of the queries
|
|
that it cannot satisfy from its cache to another caching name server,
|
|
commonly referred to as a <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>forwarder</I
|
|
></SPAN
|
|
>.
|
|
</P
|
|
><P
|
|
>There may be one or more forwarders,
|
|
and they are queried in turn until the list is exhausted or an answer
|
|
is found. Forwarders are typically used when you do not
|
|
wish all the servers at a given site to interact directly with the rest of
|
|
the Internet servers. A typical scenario would involve a number
|
|
of internal <SPAN
|
|
CLASS="acronym"
|
|
>DNS</SPAN
|
|
> servers and an Internet firewall. Servers unable
|
|
to pass packets through the firewall would forward to the server
|
|
that can do it, and that server would query the Internet <SPAN
|
|
CLASS="acronym"
|
|
>DNS</SPAN
|
|
> servers
|
|
on the internal server's behalf. An added benefit of using the forwarding
|
|
feature is that the central machine develops a much more complete
|
|
cache of information that all the clients can take advantage
|
|
of.</P
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="sect2"
|
|
><H2
|
|
CLASS="sect2"
|
|
><A
|
|
NAME="AEN218"
|
|
>1.4.6. Name Servers in Multiple Roles</A
|
|
></H2
|
|
><P
|
|
>The <SPAN
|
|
CLASS="acronym"
|
|
>BIND</SPAN
|
|
> name server can simultaneously act as
|
|
a master for some zones, a slave for other zones, and as a caching
|
|
(recursive) server for a set of local clients.</P
|
|
><P
|
|
>However, since the functions of authoritative name service
|
|
and caching/recursive name service are logically separate, it is
|
|
often advantageous to run them on separate server machines.
|
|
|
|
A server that only provides authoritative name service
|
|
(an <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>authoritative-only</I
|
|
></SPAN
|
|
> server) can run with
|
|
recursion disabled, improving reliability and security.
|
|
|
|
A server that is not authoritative for any zones and only provides
|
|
recursive service to local
|
|
clients (a <SPAN
|
|
CLASS="emphasis"
|
|
><I
|
|
CLASS="emphasis"
|
|
>caching-only</I
|
|
></SPAN
|
|
> server)
|
|
does not need to be reachable from the Internet at large and can
|
|
be placed inside a firewall.</P
|
|
></DIV
|
|
></DIV
|
|
></DIV
|
|
><DIV
|
|
CLASS="NAVFOOTER"
|
|
><HR
|
|
ALIGN="LEFT"
|
|
WIDTH="100%"><TABLE
|
|
SUMMARY="Footer navigation table"
|
|
WIDTH="100%"
|
|
BORDER="0"
|
|
CELLPADDING="0"
|
|
CELLSPACING="0"
|
|
><TR
|
|
><TD
|
|
WIDTH="33%"
|
|
ALIGN="left"
|
|
VALIGN="top"
|
|
><A
|
|
HREF="Bv9ARM.html"
|
|
ACCESSKEY="P"
|
|
>Prev</A
|
|
></TD
|
|
><TD
|
|
WIDTH="34%"
|
|
ALIGN="center"
|
|
VALIGN="top"
|
|
><A
|
|
HREF="Bv9ARM.html"
|
|
ACCESSKEY="H"
|
|
>Home</A
|
|
></TD
|
|
><TD
|
|
WIDTH="33%"
|
|
ALIGN="right"
|
|
VALIGN="top"
|
|
><A
|
|
HREF="Bv9ARM.ch02.html"
|
|
ACCESSKEY="N"
|
|
>Next</A
|
|
></TD
|
|
></TR
|
|
><TR
|
|
><TD
|
|
WIDTH="33%"
|
|
ALIGN="left"
|
|
VALIGN="top"
|
|
>BIND 9 Administrator Reference Manual</TD
|
|
><TD
|
|
WIDTH="34%"
|
|
ALIGN="center"
|
|
VALIGN="top"
|
|
> </TD
|
|
><TD
|
|
WIDTH="33%"
|
|
ALIGN="right"
|
|
VALIGN="top"
|
|
><SPAN
|
|
CLASS="acronym"
|
|
>BIND</SPAN
|
|
> Resource Requirements</TD
|
|
></TR
|
|
></TABLE
|
|
></DIV
|
|
></BODY
|
|
></HTML
|
|
> |