How To setup Caching DNS SERVER - PART II

Overview

As with our caching-only nameserver, we will see that BIND RPMS packaged by Red Hat® Enterprise Linux® and Fedora ease the process of configuring our master nameserver. Adding authoritative responsibility to the caching-only nameserver only requires us to add two more files and modify the existing named.conf file. For the purpose of this article we will assume the following:

• The BIND 9.x RPMS discussed in Part 1 are installed on the machine that will serve as a nameserver.
• Our internal network is in the 192.168.15.0/24 subnet. You will need to substitute your subnet if different.
• The master nameserver will only allow DNS queries from internal clients in the 192.168.15.0/24 subnet.
• The master nameserver will continue to forward any DNS requests it can't answer to your upstream ISP nameserver(s).
• We will use the domain linuxhowto.in as our internal domain name.

You might notice that we selected a mock top-level domain (sometimes referred as a TLD) named lan. Our internal domain name can be as creative as we wish since the domain is only known inside our home network. The naming convention for a public nameserver is not as relaxed, since we would need to follow certain rules that would allow our nameserver to respond to other nameservers requesting host information from around the world.

Zones

Nameservers store information about a domain namespace in files called zone data files. A zone data file contains all the resource records that describe the domain represented in the zone. The resource records further describe all the hosts in the zone. We will need to modify our existing named.conf to reference two zone files for our domain name:

• Forward zone definitions that map hostnames to IP addresses.
• Reverse zone definitions that map IP addresses to hostnames.

Open /var/named/chroot/etc/named.conf and add the following forward and reverse zone file directives:

# Forward Zone for linuxhowto.in domain

zone "hughes.lan" IN {

        type master;

        file "hughes.lan.zone";

};

# Reverse Zone for linuxhowto.in domain

zone "15.168.192.in-addr.arpa" IN {

        type master;

        file "192.168.15.zone";            

};

Both the forward and reverse zones contain the type master indicating that our nameserver is the master or primary nameserver for the linuxhowto.in domain. The file keyword indicates which zone file contains the resource records for the corresponding zone. Note that the reverse zone contains a special domain named in-addr-arpa. DNS uses this special domain to support IP to hostname mappings. Reverse lookups are backwards since the name is read from the leaf to the root (imagine a domain name as a tree structure) so the resultant domain name has the topmost element at the right-hand side. For a home network the reverse lookup zones can be considered optional but we will include them for completeness.

Included with the BIND RPMs is a root zone nameservers use when a query is unresolvable by any other configured zones. The root zone directive is named ".", has a type of hint and references a file named named.ca that contains a list of 13 root name servers located around the world. We will not directly use the root servers since we are forwarding any unresolvable queries to our ISP nameservers.

We need to modify the named.conf global options to allow our internal clients to query the nameserver. Modify the existing global options block to the following:

acl linuxhowto-in { 192.168.15.0/24; 127.0/8; };

options {

        directory "/var/named";

        allow-query { linuxhowto-lan; };

        forwarders { xxx.xxx.xxx.xxx; xxx.xxx.xxx.xxx; }; # ISP primary/secondary

        forward-only; # Rely completely on ISP for cache misses

};

The acl statement above sets up a range of IP addresses we can reference throughout the named.conf file. The allow-query specifies IP addresses of hosts that can query our nameserver. The forwarders statement tells our nameserver to forward any unresolvable queries to our upstream nameservers. The forward-only statement restricts our nameserver to only rely on our ISP nameservers and not contact other nameservers to find information that our ISP can not provide. It's very rare for a primary and secondary ISP nameserver to be down at the same time but you can comment forward-only if you want your nameserver to try the root nameservers when the upstream ISP nameservers cannot resolve a hostname.

Zone files

We are now ready to start defining our hostname mappings in the zone files we referenced in the named.conf configuration. Zone files need to be placed in the /var/named/chroot/var/named directory, have 644 permissions with an owner and group of named:

cd /var/named/chroot/var/named

touch linuxhowto.in.zone

chown named:named linuxhowto.in.zone

chmod 644 linuxhowto.in.zone

Let's take a look at an example zone file for the linuxhowto.in forward zone and then dive into the various parts: 

$TTL 1D

linuxhowto.in.             IN      SOA     cluster.linuxhowto.in. foo.bar.tld. (

                                200612060                 ; serial

                                2H                        ; refresh slaves

                                5M                        ; retry

                                1W                        ; expire

                                1M                        ; Negative TTL

                                )

@                       IN      NS      cluster.linuxhowto.in.

cluster.linuxhowto.in.       IN      A       192.168.15.10     ; RHEL server

fred.linuxhowto.in.        IN      A       192.168.15.1      ; router

scooby.linuxhowto.in.      IN      A       192.168.15.2      ; upstairs WAP

shaggy.linuxhowto.in.      IN      A       192.168.15.3      ; downstairs WAP

scooby-dum.linuxhowto.in.  IN      A       192.168.15.4      ; Fedora desktop

daphne.linuxhowto.in.      IN      A       192.168.15.5      ; network printer

mysterymachine          IN      A       192.168.15.6      ; mail server

scrappy                IN      A       192.168.15.7      ; Windows box

                                                       ; aliases

www                    IN      CNAME   cluster.linuxhowto.in. ; WWW server   

virtual                IN      CNAME   cluster             ; virtual WWW tests

mail                    IN      CNAME   mysterymachine    ; sendmail host

                                                       ; DHCP Clients

dhcp01.linuxhowto.in.      IN      A       192.168.15.100

dhcp02.linuxhowto.in.      IN      A       192.168.15.101

dhcp03.linuxhowto.in.      IN      A       192.168.15.102

dhcp04.linuxhowto.in.      IN      A       192.168.15.103

dhcp05.linuxhowto.in.      IN      A       192.168.15.104

@                       IN      MX  10  mail.linuxhowto.in.

The very first line in the linuxhowto.in.zone contains the TTL (Time To Live) value and is set to one day. TTL is used by nameservers to know how long to cache nameserver responses. This value would have more meaning if our nameserver was public and had other external nameservers depending on our domain information. Notice the 'D' in the TTL value stands for Day. Bind also uses 'W' for weeks, 'H' for hours, and 'M' for minutes.

The first resource record is the SOA (Start Of Authority) Record which indicates that this nameserver is the best authoritative resource for the linuxhowto.in domain. The IN stands for Internet Class and is optional. The first hostname after the SOA is the name of our master or primary nameserver. The second name, "foo.bar.tld.", is the email address for the person in charge of this zone. Notice the '@' is replaced with a '.' and also ends with a '.'. The third value is the serial number that indicates the current revision, typically in the YYYYMMDD format with a single digit at the end indicating the revision number for that day. The fourth, fifth, sixth, and seventh values can be ignored for the purposes of this article.

The NS record lists each authoritative nameserver for the current zone. Notice the first '@' character in this line. The '@' character is a short-hand way to reference the domain, linuxhowto.in, that was referenced in the named.conf configuration file for this zone.

The next block of A records contains our hostname to address mappings. The CNAME records act as aliases to previously defined A records. Notice how fully qualified domains end with a '.'. If the '.' is omitted then the domain, linuxhowto.in, is appended to the hostname. In our example the hostname, scrappy, will become scrappy.linuxhowto.in

If you want to reference an internal mail server, then add a MX record that specifies a mail exchanger. The MX value "10" in our example indicates the preference value (number between 0 and 65535) for this mail exchanger's priority. Clients try the highest priorty exchanger first.

The reverse zone file, 192.168.15.zone, is similar to our forward zone but contains PTR records instead of A records:

$TTL 1D

@       IN      SOA     cluster.linuxhowto.in. foo.bar.tld. (

200612060       ; serial

2H              ; refresh slaves

5M              ; retry

1W              ; expire

1M              ; Negative TTL

)

        IN      NS      cluster.linuxhowto.in.

10      IN      PTR     cluster.linuxhowto.in.

1       IN      PTR     fred.linuxhowto.in.

2       IN      PTR     scooby.linuxhowto.in.

3       IN      PTR     shaggy.linuxhowto.in.

4       IN      PTR     scooby-dum.linuxhowto.in.

5       IN      PTR     daphne.linuxhowto.in.

6       IN      PTR     mysterymachine.linuxhowto.in.

7       IN      PTR     scrappy.linuxhowto.in.

100     IN      PTR     dhcp01.linuxhowto.in.

101     IN      PTR     dhcp02.linuxhowto.in.

102     IN      PTR     dhcp03.linuxhowto.in.

103     IN      PTR     dhcp04.linuxhowto.in.

104     IN      PTR     dhcp05.linuxhowto.in.

Testing

Save your zone files, make sure you have the correct permissions and check the syntax using named-checkzone:

 named-checkzone linuxhowto.inlinuxhowto.in.zone

 named-checkzone 15.168.192.in-addr.arpa 192.168.15.zone

Correct any syntax errors reported by named-checkzone.

Restart the nameserver:

service named restart

Browse through the tail of the /var/log/messages file and confirm the domain loaded successfully.

Make the following DNS queries (substituting your domain):
dig scooby.linuxhowto.in
dig -x 192.168.15.2
Your output should be similar to the following:

.

.

.

;; QUESTION SECTION:

;scooby.linuxhowto.in.             IN      A

;; ANSWER SECTION:

scooby.linuxhowto.in.      86400   IN      A       192.168.15.2

;; AUTHORITY SECTION:

linuxhowto.in.             86400   IN      NS      cluster.linuxhowto.in.

;; ADDITIONAL SECTION:

cluster.linuxhowto.in.       86400   IN      A       192.168.15.10

.

.

.

Continue to test each host you added to the zone file and then enjoy your new master nameserver.