BIND: a DNS server

From Elvanör's Technical Wiki
Revision as of 10:27, 20 October 2009 by Elvanor (talk | contribs)
Jump to navigation Jump to search

BIND is an excellent, high quality DNS server. Its configuration is complex though.

Documentation Resources

I've found the official documentation not very useful or clear. The following links are better:

There is also a book by Apress, Pro DNS and BIND, that can be useful.

General DNS facts

  • There is no DNS cache on Linux at the OS level (libc *might* cache stuff).

Basics

  • There is a main configuration file (/etc/bind/named.conf) that references zones for which the DNS daemon assumes responsibility. I think it is important to first understand what types of services a DNS server can perform: primary, secondary, cache, forward.
  • There is a separate file for each such zone, that actually contains the record entries.
  • named-checkzone is a very useful program that will check the syntax of a zone file and detect many errors.

Setup

  • On a DNS server that should be accessible from the public Internet, port 53 must be open, both TCP and UDP.

Configuration

  • Using a * wildcard is possible, although not recommended.
  • NS records establish which servers are authoritative. SOA records define the "start" of authority, eg which servers among all authoritative ones is the master / canonical source of data. This is used mainly for zone transfers, slave servers etc.

Zone File

  • The TTL (first directive on a zone file) represents the Time-To-Live of all records in the zone. You can override the TTL for a specific record. This value is in time units (s for seconds, h for hours, d for days, w for weeks). It should generally be quite high (like 1w) but when a change is planned this should be reduced to 2hours, and then moved back to the normal value.
  • The TTL is distinct from the other values like Serial, Refresh, Expire etc. I think (not sure yet) that these values are used for the secondary (or caching) DNS server.

DNS Round Robin

  • DNS round robin is pretty easy to setup on BIND. Note that the DNS server returns the full array of IPs for a given host; after it is up to the client to make a choice. Consider client behavior undefined. Some programs such as wget will try a different IP than the first on failure, but this behavior is really client dependent.
  • It does not seem possible to setup DNS round robin with CNAMEs.