BIND configuration


BIND (the Berkeley Internet Name Domain server) is the most widely used DNS server software on the Internet, partly through being the first to fully implement the DNS protocols. It has its own colorful history of security issues, rather like Sendmail.

In general BIND works a lot like other service daemons. It binds to TCP and UDP port 53 and waits for incoming requests. BIND can be configured to do recursive queries or local caching on behalf of DNS clients. A utility called rndc can be used to send certain administrative commands to a running BIND server such as triggering reloads of zone files or the master configuration, stopping the server, or to perform debugging operations.

BIND is also vastly configurable, also like Sendmail, but with a somewhat less horrifying configuration syntax. The master configuration file in BIND is named.conf, which specifies various global options and lists the various zone database files that it should serve. The general configuration syntax is C-like.

Here is an example zone definition from named.conf:

zone "ilab.cs.uoregon.edu" {
        type master;
        file "/etc/bind/db.ilab";
        allow-transfer {
                128.223.4.9;
                128.223.6.9;
        };
};

This specifies that this server is a primary for the zone ilab.cs.uoregon.edu, indicates the location of the zone data file, and specifies which other servers are allowed to download the zone file (normally the IP addresses of secondary name servers).

The zone files used by BIND containing the information it should serve are in a traditional format (which dig emulates in its output). In general records use the format

[domain name] [TTL] class RR-type data

Multiple RRs can be associated with a given domain (a notable exception is that CNAMEs cannot be combined with other RR types); whitespace-indented lines omitting the domain name field but containing the other fields are associated with the most recently specified domain name.

TTL is an optional numeric field specifying a non-default time-to-live for this record.

class is almost always IN for Internet data.

RR-type is one of the resource record type symbols (i.e. A, CNAME, etc.) discussed previously, and the remaining part of the line is type-dependent data.

Next ->


Steve VanDevender
Last modified: Tue Dec 6 15:00:53 PST 2005