DNS and Bind

Name Translations

As we have discussed, all networked computers have many unique identities. The fully-qualified hostname, IP address, and MAC address are all used to communicate with an individual host. Routers use IP addresses, ethernet uses MAC addresses, and humans like to use hostnames.

If humans want to use hostnames and routers need IP addresses, we have to be able to convert from one to the other. In the Good Old Days of Unix we used a configuration file (of course). The /etc/hosts file contains the IP address and the hostname of each host you wanted to communicate with. This still works, but you have a real problem with scalability. Trying to discover the IP address of a remote host was non-trivial. There are, however, better ways.

When a site wants to connect to the internet, they request a class A/B/C network address and a domain name from the (an) Internet Naming Authority. The InterNIC used to be the only authority, but now there are over 75 authorities available. The Authority assigns a domain name and a network number. The requestor has the responsibility of dividing up the namespace and assigning hostnames and subdomains within the allocated namespace.

Domain Name System (DNS)

DNS is a global solution to managing and communicating name/address translations. The DNS namespace is a tree of domains in the same sense that Unix/Linux filesystems use a directory tree. The root of the tree is the root domain. The second level domains (.edu, .com, .gov, .us, .ca, etc.) are managed centrally. From there down, the tree branches off in many directions.

When a host (client) requests a hostname-to-IP conversion, it is described as resolving a hostname. The process proceeds as follows:

The client (say linux.eece.maine.edu) asks a specific DNS server (say 130.111.113.42) to resolve an unknown hostname (say myhost.marketing.east.bigco.com).

If the initial DNS server can resolve the hostname directly, it responds to the client. The client then communicates directly with the appropriate host using the IP address obtained from the DNS server.

If the initial DNS server cannot resolve the hostname, it will query the next level DNS server (130.111.32.11).

The request continues to be passed up the tree until
- some DNS server can resolve the query, or
- some DNS server knows about the requested domain (bigco.com) and can direct the query to an appropriate DNS server, or
- the request gets to the root of the DNS tree. The root server will respond with the IP address for a DNS server that knows about the appropriate secondary server (.edu, .com, etc.) and refer the request.

Requests then proceed down the tree toward the appropriate domain until the authoritative DNS server is contacted. The reply is then relayed back to the client host.

The client then communicates directly using the IP address.

Berkeley Internet Name Domain (BIND) System

All clients are configured to use one or more DNS servers using the /etc/resolv.conf file. This file can contain a number of directives including nameserver, domain, search, sortlist and a number of options. (Try the man resolver command for more information.) The only directive you really need is one nameserver entry listing the IP address of a DNS server. Multiple nameserver directives can be used.

BIND servers run the named daemon to answer DNS queries. Older BIND servers were divided into primary, secondary, and caching servers. As of BIND 8.x the servers are known as master, slave or stub, and hint servers. All hosts are BIND clients. A master server is authoritative for it's assigned domain. A slave server maintains a copy of the master server's database which is updated periodically. A stub server contains a limited version of the slave server data. A hint server supplies information necessary to contact one of the root servers if all else fails. More detail is contained in the BIND handout.

This is a portion of a sample /var/named/hosts.db configuration file:


$origin eece.maine.edu.
@            IN      SOA     dns.eece.maine.edu.  postmaster.eece.maine.edu. 
                 (2000083170  ; serial number
                        7200  ; refresh
                         600  ; retry
                      604800  ; expire
                       86400) ; minimum

                        IN      NS      rainier.eece.maine.edu.
                        IN      MX      0 rainier.eece.maine.edu.
                        IN      A       130.111.113.34

marple                  IN      A       130.111.113.1
holmes                  IN      A       130.111.113.2
watson                  IN      A       130.111.113.3
poirot                  IN      A       130.111.113.4
$origin caps.maine.edu.
gw-orono                IN      A       130.111.113.10
$origin eece.maine.edu.
hp228                   IN      A       130.111.113.11

This example contains a Start of Authority (SOA) record, a Name Server (NS) record, a Mail eXchange (MX) record, and a number of Address (A) records. A records are used to map a host.domain name to an IP addresses. Some files contain Cannonical NAME (CNAME) records for host aliases.

This is a portion of a sample /var/named/hosts.rev configuration file:


@            IN      SOA     dns.eece.maine.edu.  postmaster.eece.maine.edu. 
                 (2000083170  ; serial number
                        7200  ; refresh
                         600  ; retry
                      604800  ; expire
                       86400) ; minimum

             IN      NS      rainier.eece.maine.edu.

1       IN      PTR     marple.eece.maine.edu.
2       IN      PTR     holmes.eece.maine.edu.
3       IN      PTR     watson.eece.maine.edu.
4       IN      PTR     poirot.eece.maine.edu.
10      IN      PTR     gw-orono.caps.maine.edu.
11      IN      PTR     hp228.eece.maine.edu.

This example contains a Start of Authority (SOA) record, a Name Server (NS) record, and PoinTeR (PTR) records. PTR records are used to map an IP address to a host.domain name.

DNS Tools

Once you have set up DNS services for your network, how do you test the installation? The first tool in the toolkit is the nslookup command. This tool has been around for a long time and we use it often. The form nslookup host.domain.net will query the default DNS server for the IP address of host.domain.net. nslookup with no arguments enters interactive mode. Here you can do reverse queries, select a different DNS server, list hosts within a domain, or get information about a domain. Type exit or Control-D to exit nslookup. Here is an example of a reverse query:


tesla:~> nslookup
Default Server:  rainier.eece.maine.edu
Address:  130.111.113.34

> set type=ptr
> 1.2.111.130.in-addr.arpa.
Server:  rainier.eece.maine.edu
Address:  130.111.113.34

Non-authoritative answer:
1.2.111.130.in-addr.arpa        name = maine.maine.edu

Authoritative answers can be found from:
111.130.in-addr.arpa    nameserver = NAMEO.CAPS.maine.edu
111.130.in-addr.arpa    nameserver = NAMEP.CAPS.maine.edu
NAMEO.CAPS.maine.edu    internet address = 130.111.32.11
NAMEP.CAPS.maine.edu    internet address = 130.111.130.7
> exit

The dnsquery command is available under Linux. It is designed to be a replacement for the older nstest, nsquery, and nslookup commands. Here is an example:


tesla:~> dnsquery maine.edu.
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22261
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 2, ADDITIONAL: 2
;;      maine.edu, type = ANY, class = IN
maine.edu.              39m33s IN NS    NAMEO.CAPS.maine.edu.
maine.edu.              39m33s IN NS    NAMEP.CAPS.maine.edu.
maine.edu.              5h33m16s IN A   130.111.2.1
maine.edu.              9h14m28s IN SOA  named.CAPS.maine.edu.
kerry.maine.edu. (
                                        11285           ; serial
                                        1H              ; refresh
                                        10M             ; retry
                                        2W              ; expiry
                                        1D )            ; minimum

maine.edu.              39m33s IN NS    NAMEO.CAPS.maine.edu.
maine.edu.              39m33s IN NS    NAMEP.CAPS.maine.edu.
NAMEO.CAPS.maine.edu.   17h31m59s IN A  130.111.32.11
NAMEP.CAPS.maine.edu.   7h40m36s IN A   130.111.130.7