10.6. Domain Name Servers (DNS)
10.6.1. Principle and Mechanism
The Domain Name Service (DNS) is a fundamental component of the Internet: it maps host names to IP addresses (and vice-versa), which allows the use of www.debian.org
instead of 82.195.75.97
.
DNS records are organized in zones; each zone matches either a domain (or a subdomain) or an IP address range (since IP addresses are generally allocated in consecutive ranges). A primary server is authoritative on the contents of a zone; secondary servers, usually hosted on separate machines, provide regularly refreshed copies of the primary zone.
Each zone can contain records of various kinds (Resource Records):
CNAME
: alias (
canonical name).
MX
:
mail exchange, an email server. This information is used by other email servers to find where to send email addressed to a given address. Each MX record has a priority. The highest-priority server (with the lowest number) is tried first (see sidebar
BACK TO BASICS SMTP); other servers are contacted in order of decreasing priority if the first one does not reply.
PTR
: mapping of an IP address to a name. Such a record is stored in a “reverse DNS” zone named after the IP address range. For example,
1.168.192.in-addr.arpa
is the zone containing the reverse mapping for all addresses in the
192.168.1.0/24
range.
NS
: maps a name to a name server. Each domain must have at least one NS record. These records point at a DNS server that can answer queries concerning this domain; they usually point at the primary and secondary servers for the domain. These records also allow DNS delegation; for instance, the
falcot.com
zone can include an NS record for
internal.falcot.com
, which means that the
internal.falcot.com
zone is handled by another server. Of course, this server must declare an
internal.falcot.com
zone.
The reference name server, Bind, was developed and is maintained by ISC (Internet Software Consortium). It is provided in Debian by the bind9 package. Version 9 brings two major changes compared to previous versions. First, the DNS server can now run under an unprivileged user, so that a security vulnerability in the server does not grant root privileges to the attacker (as was seen repeatedly with versions 8.x).
Furthermore, Bind supports the DNSSEC standard for signing (and therefore authenticating) DNS records, which allows blocking any spoofing of this data during man-in-the-middle attacks.
Configuration files for bind
, irrespective of version, have the same structure.
The Falcot administrators created a primary falcot.com
zone to store information related to this domain, and a 168.192.in-addr.arpa
zone for reverse mapping of IP addresses in the local networks.
The following configuration excerpts, taken from the Falcot files, can serve as starting points to configure a DNS server:
Example 10.11. Excerpt of /etc/bind/named.conf.local
zone "falcot.com" {
type master;
file "/etc/bind/db.falcot.com";
allow-query { any; };
allow-transfer {
195.20.105.149/32 ; // ns0.xname.org
193.23.158.13/32 ; // ns1.xname.org
};
};
zone "internal.falcot.com" {
type master;
file "/etc/bind/db.internal.falcot.com";
allow-query { 192.168.0.0/16; };
};
zone "168.192.in-addr.arpa" {
type master;
file "/etc/bind/db.192.168";
allow-query { 192.168.0.0/16; };
};
Example 10.12. Excerpt of /etc/bind/db.falcot.com
; falcot.com Zone
; admin.falcot.com. => zone contact: admin@falcot.com
$TTL 604800
@ IN SOA falcot.com. admin.falcot.com. (
20040121 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
;
; The @ refers to the zone name ("falcot.com" here)
; or to $ORIGIN if that directive has been used
;
@ IN NS ns
@ IN NS ns0.xname.org.
interne IN NS 192.168.0.2
@ IN A 212.94.201.10
@ IN MX 5 mail
@ IN MX 10 mail2
ns IN A 212.94.201.10
mail IN A 212.94.201.10
mail2 IN A 212.94.201.11
www IN A 212.94.201.11
dns IN CNAME ns
Example 10.13. Excerpt of /etc/bind/db.192.168
; Reverse zone for 192.168.0.0/16
; admin.falcot.com. => zone contact: admin@falcot.com
$TTL 604800
@ IN SOA ns.interne.falcot.com. admin.falcot.com. (
20040121 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
IN NS ns.interne.falcot.com.
; 192.168.0.1 -> arrakis
1.0 IN PTR arrakis.interne.falcot.com.
; 192.168.0.2 -> neptune
2.0 IN PTR neptune.interne.falcot.com.
; 192.168.3.1 -> pau
1.3 IN PTR pau.interne.falcot.com.