2Apr il 2003, 17:00:47 The Complete FreeBSD (dns.mm), page 363
21
The Domain Name
Ser vice
In this chapter:
• Domains and zones
• Setting up a name
ser ver
• PassiveDNS usage
• Name serverona
standalone system
• Name serveronan
end-user networ k
• Reverse lookup
• Slave name servers
• The next leveldown:
delegating zones
• Messages from
named
• Upgrading a Version
4configuration
• Looking up DNS
infor mation
• Checking DNS for
correctness
• DNS security
In this chapter:
• Domains and zones
• Setting up a name
ser ver
• PassiveDNS usage

DNS provides the information needed to connect to remote systems in the form of
Resource Records,orRRs. Unfortunately,the names of the records aren’toverly
intuitive.
• A(Address) records translate host names to IP addresses. Forexample, one A record
tells you that www.FreeBSD.org (currently) has the IP address 216.136.204.117.
These are what most people think of when theyhear the name DNS. The name
specified in the A record is called the canonical name of the interface, and it should
be the one to which the PTR record (see below) refers.
1. Does this sound likeanacronym in search of a name?
dns.mm,v v4.17 (2003/04/02 03:15:05) 363
The Complete FreeBSD 364
2April 2003, 17:00:47 The Complete FreeBSD (../tools/tmac.Mn), page 364
• PTR (Pointer) records provide a translation from IP address to name. This process is
also called re verse lookup.
• MX (Mail Exchange) records specify the IP addresses of mail servers for a domain.
• SOA(Start Of Authority) records define zones,which roughly correspond to domains.
We’lllook at the distinction between zones and domains below.
• NS (Name Server) records describe name servers for a zone.
• HINFO (HardwareInformation) records describe the hardware and software that
runs on a particular system.
• CNAME (Canonical Name) records describe alternative names for a system.
FreeBSD allows you to use both /etc/hosts and DNS. One reason for this might be to
have name resolution of local hosts at startup time: there’sachicken-and-egg problem
with mounting NFS file systems before named is running.
The common objections to using DNS include:
• It’ssupposedly difficult to set up DNS configuration files.
• DNS supposedly generates a lot of network traffic.
• DNS supposedly causes a dial-on-demand system to dial all the time.
These statements are all untrue. We’lllook at them in the rest of this chapter as we set up
DNS for our reference network.

and xianggang.china.example.org would be authoritative for the zone china.example.org,
butnot for example.org.
Setting up a name server
DNS service is supplied by the name daemon,called named. named can be run in a
number of different modes. In this chapter,we’ll concentrate on setting the appropriate
configurations for our reference network. If you want to go further,check the following
documents:
• The BIND Online Documentation,inthe source distribution in the directory
/usr/src/contrib/bind/doc/html/index.html.
• TCP/IP Network Administration,byCraig Hunt (O’Reilly).
• DNS and BIND,byPaul Albitz and Cricket Liu (O’Reilly).
In the last fewyears, BIND has undergone some significant changes, mainly as a result of
abuse on the net. The current release is Version 9, but FreeBSD still ships with Version 8.
The differences are relatively minor: Version 9 introduces a number of newfeatures, but
the contents of this chapter should also apply to Version 9. The previous version was
Version 4, and you’ll still find a lot of old documentation referring to it. There were no
Versions 5, 6 or 7, and the main configuration file changed its format completely in
Version 8; eventhe name changed. We’lllook at howtoconvert the formats on page 381.
Before using the documentation above,makesure that it refers to the correct version of
BIND.
dns.mm,v v4.17 (2003/04/02 03:15:05)
Setting up a name server366
2April 2003, 17:00:47 The Complete FreeBSD (../tools/tmac.Mn), page 366
Passive DNS usage
Not every system needs to run its own name daemon. If you have another machine on the
same network, you can send requests to it. Forexample, in the reference network, freebie
and presto may be running name servers. There’snoparticular reason for bumble and
wait,both presumably slower machines, to do so as well. Instead, you can tell them to
use the name servers on the other twomachines.
To dothis, makesure that you don’tenable named in your /etc/rc.conf,and create a file

• Create a file /etc/namedb/localhost.rev containing:
$TTL 1d
@INSOA @host@. root.@host@. (
@date@ ; Serial
1h ; Refresh
5m ; Retry
100d ; Expire
1h ) ;Negative cache
IN NS @host@.
1INPTR localhost.@domain@.
We’lllook at the meaning of this file in the next section. To create it, you can start
with the file /etc/namedb/PROT O.localhost.rev,which contains a template for this
file. Replace @host@ with the FQDN of your host (freebie.example.org in this
example), @date@ (the serial number) with the date in the form yyyymmddxx,where
xx are a small integer such as 01,
1
and @domain@ with example.org..Makesure that
the FQDNs end with a trailing period. Alternatively,you can run the script
/etc/namedb/make-localhost.
• Edit the file /etc/namedb/named.conf to contain:
options {
directory "/etc/namedb";
forwarders {
139.130.237.3; 139.130.237.17;
};
zone "0.0.127.in-addr.arpa" {
type master;
file "localhost.rev";
};
/etc/namedb/named.conf should already be present on your system as well. It

nowrequired to fully define the SOA. It specifies the length of time that remote name
servers should cache records from this zone. During this time theywill not attempt
another lookup. In older versions of BIND, this value was stored in the last field of the
SOArecord below.
The remaining lines define a single SOArecord. the name on the left is the name of the
zone. The keyword IN means Internet,inother words the Internet Protocols. The BIND
software includes support for multiple network types, most of which have now been
forgotten. The keyword SOA defines the type of record. freebie.example.org is the master
name server.
The next field, grog.example.org,isthe mail address of the DNS administrator.‘‘Wait a
minute,’’ you may say,‘‘that’snot a mail address. There should be an @ there, not a ..’’
That’sright, but unfortunately DNS uses the @ sign for other purposes, and it would be a
syntax error in this position. So the implementors resorted to this kludge. To generate
the mail ID, replace the first. with an @,togiv e you
The serial number identifies this version of the zone configuration. Remote name servers
first retreive the SOArecord and check if the serial number has incremented before
deciding whether to access the rest of the zone, which could be large. Makesure you
increment this field every time you edit the file. If you don’t, your updates will not
propagate to other name servers. It’sagood idea to use a format that reflects the date, as
here: the format givesfour digits for the year,two digits for the month, twofor the day,
and twofor the number of the modification on a particular day.The serial number in this
dns.mm,v v4.17 (2003/04/02 03:15:05)
369 Chapter 21: The Domain Name Service
2April 2003, 17:00:47 The Complete FreeBSD (../tools/tmac.Mn), page 369
example shows it to be the second modification to the zone configuration on 18 March
2003.
The remaining parameters describe the timeout characteristics of the zone. Use the
values in the example unless you have a good reason to change them. The data formats
for the records require all times to be specified in seconds, and in previous versions of
BIND, this was the only choice you had. In current versions of BIND, you can use scale

dns.mm,v v4.17 (2003/04/02 03:15:05)
Name serveronanend-user networ k 370
2April 2003, 17:00:47 The Complete FreeBSD (../tools/tmac.Mn), page 370
The NS records
DNS uses a special kind of record to tell where your name servers are. In our case, we’re
running name servers on freebie and presto.Wecould write:
IN NS freebie.example.org.
IN NS presto.example.org.
This would work just fine, but in fact we’ll do it a little differently,aswe’ll see in the next
section.
Nicknames
We’rerunning a whole lot of services on the reference network, in particular a web server
and an ftp server.Byconvention, a web server machine is called www,anftp server is
called ftp,and a name server is called ns.But they’re both running on machines with
different names. What do we do? We giv e our machines nicknames:
www IN CNAME freebie
ftp IN CNAME presto
We’d liketodothe same with the name servers, but unfortunately DNS doesn’tlikethat,
and will complain about your DNS configuration all overthe world if you make ns a
CNAME. There’sagood reason for this: if you use CNAME records to define your name
servers, remote systems have toperform twolookups to find the address of the name
server,one to retreive the CNAME and one to get the corresponding A record for the
CNAME. Define newArecords for them:
IN NS ns
IN NS ns1
ns IN A223.147.37.1
ns1 IN A223.147.37.2
You’ll note that we’re using relative domain names in these examples. Theyare taken to
be relative tothe name that starts the SOArecord.
The MX records