Download at in Font

Drawer DataMatrix in Font Download at

Note: Only authoritative name servers can give authoritative answers, because their queries are not temporary,

For a taste of reverse lookups, try to run dig x 127.0.0.1. It shows an authoritative answer because of the final zone entry in our current configuration, and there is no other name server that could have a better answer to where localhost is than our own.

It is common today for your ISP to have its own DNS ready for your use. To add a little more speed to your DNS, we will lighten the load on your server by handing whatever we can to the ISP s DNS. Their servers in return will retrieve our name server s queries and give the results back to us. This is advantageous because forcing our local server to do Internet-wide queries every time will be costly in bandwidth and time. Why not just request them from your ISP s DNS server, which is dedicated for that purpose We will do this in this section. Assume that you have two name servers owned by your ISP. These have the IP addresses 202.125.123.45 and 202.125.123.46. With these addresses, you can now forward requests to them and retrieve the answer without having your name server do all the hard work. All we have to do is to add the following in our named.conf inside the options clause: forward first; forwarders { 202.125.123.45; 202.125.123.46; }; Otherwise, it won t work. The forward first command tells your name server to talk to the name servers declared in the forwarders command and only do the query itself if that fails. Each name server in the forwarders command is asked sequentially if the first is unavailable. Only when all of the forwarders are unavailable will your own name server do the query.

BIND lets us have redundancy on our name servers through the use of slave name servers. Slave name servers are used to have a backup of the running main name servers in your network. In case the main name server or master DNS server crashes, users can switch to the slave name server to get information from your domain. This is possible because while the slave name server is running, it grabs a copy of the available zones on short intervals. The copy process is also known as the zone transfer because the main name server s zone is transferred to the slave name server for backup. To have a slave name server running in your network that performs a zone transfer on a master name server with an IP address of 192.168.1.1 for the apress.com domain, add the lines shown in Listing 11-14 at the bottom. Listing 11-14. The Slave Name Server Configuration For the apress.com Domain zone "apress.com" {

type slave; file "slaves/db.apress.com"; masters {192.168.1.1;}; }; In this zone entry, we can see that the type is slave and it references a master name server that has the IP address 192.168.1.1. This will tell the slave DNS on which master DNS to do zone transfers.

Note: Zone transfer is a type of DNS transaction where zone data from one DNS server is being copied by

another DNS server. The actual contents of the zone file of a domain in the primary DNS are copied by the secondary DNS.

Whenever the slave DNS server performs a zone transfer, it will save the information in the file called db.apress.com within the /var/named/chroot/var/named/slaves directory. That file will be created on successful zone transfers. However, if you don t see any file related to the master name server and you know it is running, it is likely that the master DNS server does not allow zone transfers. You can check whether the zone transfer has been refused by the master server in the messages file in /var/log. If that happens, you have to ask permission from their DNS administrator to allow you to gather information from them. If you want to allow your own master name server to permit slave machines to perform zone transfers from it, you can use the allow-transfer command inside the zone entry. The arguments are similar to the masters command. For example, suppose you are administering a name server for Apress named ns1.apress.com, and you have another name server called ns2.apress.com as a backup with the IP address 202.124.124.67. You have configured ns2.apress.com as a slave for ns1.apress.com, and the final thing you need to do is to use the allow-transfer command to let ns2.apress.com perform a zone transfer of ns1.apress.com s zones. To do that, you will use allow-transfer like this: allow-transfer { 202.124.124.67; };