Olaf Kirch - Linux Network Administrator Guide, Second Edition

3600000; expire

3600; default ttl

}

;

; Name servers

IN NS niels

IN NS gauss.maths.groucho.edu.

gauss.maths.groucho.edu. IN A 149.76.4.23

;

; Theoretical Physics (subnet 12)

niels IN A 149.76.12.1

IN A 149.76.1.12

name server IN CNAME niels

otto IN A 149.76.12.2

quark IN A 149.76.12.4

down IN A 149.76.12.5

strange IN A 149.76.12.6

…

; Collider Lab. (subnet 14)

boson IN A 149.76.14.1

muon IN A 149.76.14.7

bogon IN A 149.76.14.12

…

Apart from the A and CNAME records, you can see a special record at the top of the file, stretching several lines. This is the SOA resource record signaling the Start of Authority , which holds general information on the zone the server is authoritative for. The SOA record comprises, for instance, the default time to live for all records.

Note that all names in the sample file that do not end with a dot should be interpreted relative to the physics.groucho.edu domain. The special name ( @ ) used in the SOA record refers to the domain name by itself.

We have seen earlier that the name servers for the groucho.edu domain somehow have to know about the physics zone so that they can point queries to their name servers. This is usually achieved by a pair of records: the NS record that gives the server's FQDN, and an A record that associates an address with that name. Since these records are what holds the namespace together, they are frequently called glue records . They are the only instances of records in which a parent zone actually holds information on hosts in the subordinate zone. The glue records pointing to the name servers for physics.groucho.edu are shown in Example 6.5.

Example 6.5: An Excerpt from the named.hosts File for GMU

; Zone data for the groucho.edu zone.

@ IN SOA vax12.gcc.groucho.edu. joe.vax12.gcc.groucho.edu. {

1999070100; serial no

360000; refresh

3600; retry

3600000; expire

3600; default ttl

}

…

;

; Glue records for the physics.groucho.edu zone

physics IN NS niels.physics.groucho.edu.

IN NS gauss.maths.groucho.edu.

niels.physics IN A 149.76.12.1

gauss.maths IN A 149.76.4.23

…

Finding the IP address belonging to a host is certainly the most common use for the Domain Name System, but sometimes you'll want to find the canonical hostname corresponding to an address. Finding this hostname is called reverse mapping , and is used by several network services to verify a client's identity. When using a single hosts file, reverse lookups simply involve searching the file for a host that owns the IP address in question. With DNS, an exhaustive search of the namespace is out of the question. Instead, a special domain, in-addr.arpa , has been created that contains the IP addresses of all hosts in a reversed dotted quad notation. For instance, an IP address of 149.76.12.4 corresponds to the name 4.12.76.149.in-addr.arpa . The resource-record type linking these names to their canonical hostnames is PTR.

Creating a zone of authority usually means that its administrators have full control over how they assign addresses to names. Since they usually have one or more IP networks or subnets at their hands, there's a one-to-many mapping between DNS zones and IP networks. The Physics department, for instance, comprises the subnets 149.76.8.0 , 149.76.12.0 , and 149.76.14.0 .

Consequently, new zones in the in-addr.arpa domain have to be created along with the physics zone, and delegated to the network administrators at the department: 8.76.149.in-addr.arpa , 12.76.149.in-addr.arpa , and 14.76.149.in-addr.arpa . Otherwise, installing a new host at the Collider Lab would require them to contact their parent domain to have the new address entered into their in-addr.arpa zone file.

The zone database for subnet 12 is shown in Example 6.6. The corresponding glue records in the database of their parent zone are shown in Example 6.7.

Example 6.6: An Excerpt from the named.rev File for Subnet 12

; the 12.76.149.in-addr.arpa domain.

@ IN SOA niels.physics.groucho.edu. janet.niels.physics.groucho.edu. {

1999090200 360000 3600 3600000 3600

}

2 IN PTR otto.physics.groucho.edu.

4 IN PTR quark.physics.groucho.edu.

5 IN PTR down.physics.groucho.edu.

6 IN PTR strange.physics.groucho.edu.

Example 6.7: An Excerpt from the named.rev File for Network 149.76

; the 76.149.in-addr.arpa domain.

@ IN SOA vax12.gcc.groucho.edu. joe.vax12.gcc.groucho.edu. {

1999070100 360000 3600 3600000 3600

}

…

; subnet 4: Mathematics Dept.

1.4 IN PTR sophus.maths.groucho.edu.

17.4 IN PTR erdos.maths.groucho.edu.

23.4 IN PTR gauss.maths.groucho.edu

…

; subnet 12: Physics Dept, separate zone

12 IN NS niels.physics.groucho.edu.

IN NS gauss.maths.groucho.edu.

niels.physics.groucho.edu. IN A 149.76.12.1

gauss.maths.groucho.edu. IN A 149.76.4.23

…

in-addr.arpa system zones can only be created as supersets of IP networks. An even more severe restriction is that these networks' netmasks have to be on byte boundaries. All subnets at Groucho Marx University have a netmask of 255.255.255.0 , hence an in-addr.arpa zone could be created for each subnet. However, if the netmask were 255.255.255.128 instead, creating zones for the subnet 149.76.12.128 would be impossible, because there's no way to tell DNS that the 12.76.149.in-addr.arpa domain has been split into two zones of authority, with hostnames ranging from 1 through 127 , and 128 through 255 , respectively.

named (pronounced name-dee ) provides DNS on most Unix machines. It is a server program originally developed for BSD to provide name service to clients, and possibly to other name servers. BIND Version 4 was around for some time and appeared in most Linux distributions. The new release, Version 8, has been introduced in most Linux distributions, and is a big change from previous versions. [42] BIND 4.9 was developed by Paul Vixie, paul@vix.com, but BIND is now maintained by the Internet Software Consortium, bind-bugs@isc.org. It has many new features, such as support for DNS dynamic updates, DNS change notifications, much improved performance, and a new configuration file syntax. Please check the documentation contained in the source distribution for details.

This section requires some understanding of the way DNS works. If the following discussion is all Greek to you, you may want to reread the section "How DNS Works".