Next
Previous
Contents
5. A simple domain.How to set up your own domain.
5.1 But first some dry theoryFirst of all: you read all the stuff before here right? You have to.
Before we really start this section I'm going to serve you some
theory on and an example of how DNS works. And you're going to read it because
it's good for you. If you don't want to you should at least skim it very
quickly. Stop skimming when you get to what should go in your
DNS is a hierarchical, tree structured, system. The top is written
`
When looking for a machine the query proceeds recursively into the hierarchy
starting at the root. If you want to find the address of
This is a referral. It is giving us an "Authority section" only, no "Answer section". Our own nameserver refers us to a nameserver. Pick one at random:
It refers us to MIT.EDU servers at once. Again pick one at random:
This time we got a "ANSWER SECTION", and an answer for our question. The
"AUTHORITY SECTION" contains information about which servers to ask about
So starting at
In the tree analogue each ``
A much less talked about, but just as important domain is
5.2 Our own domainNow to define our own domain. We're going to make the domain
One more thing before we start: Not all characters are allowed in host names.
We're restricted to the characters of the English alphabet: a-z, and numbers 0-9
and the character '-' (dash). Keep to those characters. Upper and lower-case
characters are the same for DNS, so
We've already started this part with this line in
zone "0.0.127.in-addr.arpa" {
type master;
file "pz/127.0.0";
};
Please note the lack of `
$TTL 3D
@ IN SOA ns.linux.bogus. hostmaster.linux.bogus. (
1 ; Serial
8H ; Refresh
2H ; Retry
4W ; Expire
1D) ; Minimum TTL
NS ns.linux.bogus.
1 PTR localhost.
Please note the `
This `zone file' contains 3 `resource records' (RRs): A SOA RR. A NS RR and a PTR RR. SOA is short for Start Of Authority. The `@' is a special notation meaning the origin, and since the `domain' column for this file says 0.0.127.in-addr.arpa the first line really means
NS is the Name Server RR. There is no '@' at the start of this line; it is implicit since the previous line started with a '@'. Saves some typing that. So the NS line could also be written
It tells DNS what machine is the name server of the domain
And finally the PTR (Domain Name Pointer) record says that the host at
address 1 in the subnet
The SOA record is the preamble to all zone files, and there should
be exactly one in each zone file. It describes the zone, where it comes from (a
machine called
Now restart your named (the command is
So it manages to get
zone "linux.bogus" {
notify no;
type master;
file "pz/linux.bogus";
};
Note again the lack of ending `
In the
;
; Zone file for linux.bogus
;
; The full zone file
;
$TTL 3D
@ IN SOA ns.linux.bogus. hostmaster.linux.bogus. (
199802151 ; serial, todays date + todays serial #
8H ; refresh, seconds
2H ; retry, seconds
4W ; expire, seconds
1D ) ; minimum, seconds
;
NS ns ; Inet Address of name server
MX 10 mail.linux.bogus ; Primary Mail Exchanger
MX 20 mail.friend.bogus. ; Secondary Mail Exchanger
;
localhost A 127.0.0.1
ns A 192.168.196.2
mail A 192.168.196.4
Two things must be noted about the SOA record.
There is one new RR type in this file, the MX, or Mail eXchanger RR. It tells
mail systems where to send mail that is addressed to
Restart named by running
Upon careful examination you will discover a bug. The line
is all wrong. It should be
I deliberately made a mistake so you could learn from it :-) Looking in the zone file we find this line:
It is missing a period. Or has a 'linux.bogus' too many. If a machine name
does not end in a period in a zone file the origin is added to its end causing
the double
MX 10 mail.linux.bogus. ; Primary Mail Exchanger or
MX 10 mail ; Primary Mail Exchanger is correct. I prefer the latter form, it's less to type. There are some BIND
experts that disagree, and some that agree with this. In a zone file the domain
should either be written out and ended with a `
I must stress that in the named.conf file there should not be
`
So having made my point here is the new zone file, with some extra information in it as well:
;
; Zone file for linux.bogus
;
; The full zone file
;
$TTL 3D
@ IN SOA ns.linux.bogus. hostmaster.linux.bogus. (
199802151 ; serial, todays date + todays serial #
8H ; refresh, seconds
2H ; retry, seconds
4W ; expire, seconds
1D ) ; minimum, seconds
;
TXT "Linux.Bogus, your DNS consultants"
NS ns ; Inet Address of name server
NS ns.friend.bogus.
MX 10 mail ; Primary Mail Exchanger
MX 20 mail.friend.bogus. ; Secondary Mail Exchanger
localhost A 127.0.0.1
gw A 192.168.196.1
HINFO "Cisco" "IOS"
TXT "The router"
ns A 192.168.196.2
MX 10 mail
MX 20 mail.friend.bogus.
HINFO "Pentium" "Linux 2.0"
www CNAME ns
donald A 192.168.196.3
MX 10 mail
MX 20 mail.friend.bogus.
HINFO "i486" "Linux 2.0"
TXT "DEK"
mail A 192.168.196.4
MX 10 mail
MX 20 mail.friend.bogus.
HINFO "386sx" "Linux 1.2"
ftp A 192.168.196.5
MX 10 mail
MX 20 mail.friend.bogus.
HINFO "P6" "Linux 2.1.86"
There are a number of new RRs here: HINFO (Host INFOrmation) has two parts; it's a good habit to quote each. The first part is the hardware or CPU on the machine, and the second part the software or OS on the machine. The machine called 'ns' has a Pentium CPU and runs Linux 2.0. CNAME (Canonical NAME) is a way to give each machine several names. So www is an alias for ns.
CNAME record usage is a bit controversial. But it's safe to follow the rule that a MX, CNAME or SOA record should never refer to a CNAME record, they should only refer to something with an A record, so it is inadvisable to have
foobar CNAME www ; NO! but correct to have
foobar CNAME ns ; Yes!
It's also safe to assume that a CNAME is not a legal host name for an e-mail
address:
www A 192.168.196.2
A number of the arch-BIND-wizards, recommend not using CNAME at all. But the discussion of why or why not is beyond the scope of this HOWTO.
But as you see, this HOWTO and many sites do not follow this rule.
Load the new database by running
That's good. As you see it looks a lot like the zone file itself. Let's check
what it says for
In other words, the real name of
Now we're halfway.
5.3 The reverse zoneNow programs can convert the names in linux.bogus to addresses which they can connect to. But also required is a reverse zone, one making DNS able to convert from an address to a name. This name is used by a lot of servers of different kinds (FTP, IRC, WWW and others) to decide if they want to talk to you or not, and if so, maybe even how much priority you should be given. For full access to all services on the Internet a reverse zone is required.
Put this in
zone "196.168.192.in-addr.arpa" {
notify no;
type master;
file "pz/192.168.196";
};
This is exactly as with the
$TTL 3D
@ IN SOA ns.linux.bogus. hostmaster.linux.bogus. (
199802151 ; Serial, todays date + todays serial
8H ; Refresh
2H ; Retry
4W ; Expire
1D) ; Minimum TTL
NS ns.linux.bogus.
1 PTR gw.linux.bogus.
2 PTR ns.linux.bogus.
3 PTR donald.linux.bogus.
4 PTR mail.linux.bogus.
5 PTR ftp.linux.bogus.
Now you restart your named (
$ dig -x 192.168.196.4 +pfmin ;; res options: init recurs defnam dnsrch ;; got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8764 ;; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1 ;; QUERY SECTION: ;; 4.196.168.192.in-addr.arpa, type = ANY, class = IN ;; ANSWER SECTION: 4.196.168.192.in-addr.arpa. 3D IN PTR mail.linux.bogus.
so, it looks OK, dump the whole thing to examine that too:
dig -x 192.168.196 AXFR
; <<>> DiG 8.2 <<>> -x AXFR
$ORIGIN 196.168.192.in-addr.arpa.
@ 3D IN SOA ns.linux.bogus. hostmaster.linux.bogus. (
199802151 ; serial
8H ; refresh
2H ; retry
4W ; expiry
1D ) ; minimum
3D IN NS ns.linux.bogus.
4 3D IN PTR mail.linux.bogus.
2 3D IN PTR ns.linux.bogus.
5 3D IN PTR ftp.linux.bogus.
3 3D IN PTR donald.linux.bogus.
1 3D IN PTR gw.linux.bogus.
@ 3D IN SOA ns.linux.bogus. hostmaster.linux.bogus. (
199802151 ; serial
8H ; refresh
2H ; retry
4W ; expiry
1D ) ; minimum
;; Received 8 answers (8 records).
;; FROM: lookfar to SERVER: 127.0.0.1
;; WHEN: Sat Dec 16 01:44:03 2000
Looks good! If your output didn't look like that look for error-messages in your syslog, I explained how to do that in the first section under the heading Starting named
5.4 Words of cautionThere are some things I should add here. The IP numbers used in the examples
above are taken from one of the blocks of 'private nets', i.e., they are not
allowed to be used publicly on the Internet. So they are safe to use in an
example in a HOWTO. The second thing is the
And, of course, this domain is highly bogus, and so are all the addresses in it. For a real example of a real-life domain see the next main-section.
5.5 Why reverse lookups don't work.There are a couple of ``gotchas'' that normally are avoided with name lookups that are often seen when setting up reverse zones. Before you go on you need reverse lookups of your machines working on your own nameserver. If it isn't go back and fix it before continuing.
I will discuss two failures of reverse lookups as seen from outside your network:
The reverse zone isn't delegated.When you ask a service provider for a network-address range and a domain name the domain name is normally delegated as a matter of course. A delegation is the glue NS record that helps you get from one nameserver to another as explained in the dry theory section above. You read that, right? If your reverse zone doesn't work go back and read it. Now.
The reverse zone also needs to be delegated. If you got the
You've got a classless subnetThis is a somewhat advanced topic, but classless subnets are very common these days and you probably have one if you're a small company.
A classless subnet is what keeps the Internet going these days. Some years ago there was much ado about the shortage of IP numbers. The smart people in IETF (the Internet Engineering Task Force, they keep the Internet working) stuck their heads together and solved the problem. At a price. The price is that you'll get less than a ``C'' subnet and some things may break. Please see Ask Mr. DNS at for an good explanation of this and how to handle it.
Did you read it? I'm not going to explain it so please read it.
The first part of the problem is that your ISP must understand the technique described by Mr. DNS. Not all small ISPs have a working understanding of this. If so you might have to explain to them and be persistent. But be sure you understand it first ;-). They will then set up a nice reverse zone at their server which you can examine for correctness with dig.
The second and last part of the problem is that you must understand the technique. If you're unsure go back and read about it again. Then you can set up your own classless reverse zone as described by Mr. DNS.
There is another trap lurking here. Old resolvers will not be able
to follow the
Some ISPs will offer other ways to handle this, like Web based forms for you to input your reverse-mappings in or other automagical systems.
5.6 Slave serversOnce you have set up your zones correctly on the master servers you need to set up at least one slave server. Slave servers are needed for robustness. If your master goes down the people out there on the net will still be able to get information about your domain from the slave. A slave should be as long away from you as possible. Your master and slave should share as few as possible of these: Power supply, LAN, ISP, city and country. If all of these things are different for your master and slave you've found a really good slave.
A slave is simply a nameserver that copies zone files from a master. You set it up like this:
zone "linux.bogus" {
type slave;
file "sz/linux.bogus";
masters { 192.168.196.2; };
};
A mechanism called zone-transfer is used to copy the data. The zone transfer is controlled by your SOA record:
@ IN SOA ns.linux.bogus. hostmaster.linux.bogus. (
199802151 ; serial, todays date + todays serial #
8H ; refresh, seconds
2H ; retry, seconds
4W ; expire, seconds
1D ) ; minimum, seconds
A zone is only transferred if the serial number on the master is larger than on the slave. Every refresh interval the slave will check if the master has been updated. If the check fails (because the master is unavailable) it will retry the check every retry interval. If it continues to fail as long as the expire interval the slave will remove the zone from it's filesystem and no longer be a server for it.
Next Previous Contents |