Copyright © 2000-2003 Internet Software Consortium.
--------------------------------------------------------------------------------
+-----------------------------------------------------------------------
-Q: Why doesn't -u work on Linux 2.2.x when I build with --enable-threads?
+1. Compilation and Installation Questions
-A: Linux threads do not fully implement the Posix threads (pthreads) standard. In
- particular, setuid() operates only on the current thread, not the full process.
- Because of this limitation, BIND 9 cannot use setuid() on Linux as it can on
- all other supported platforms. setuid() cannot be called before creating
- threads, since the server does not start listening on reserved ports until
- after threads have started.
+Q: I'm trying to compile BIND 9, and "make" is failing due to files not
+ being found. Why?
- In the 2.2.18 or 2.3.99-pre3 and newer kernels, the ability to preserve
- capabilities across a setuid() call is present. This allows BIND 9 to call
- setuid() early, while retaining the ability to bind reserved ports. This is a
- Linux-specific hack.
+A: Using a parallel or distributed "make" to build BIND 9 is not
+ supported, and doesn't work. If you are using one of these, use normal
+ make or gmake instead.
- On a 2.2 kernel, BIND 9 does drop many root privileges, so it should be less of
- a security risk than a root process that has not dropped privileges.
+Q: Isn't "make install" supposed to generate a default named.conf?
- If Linux threads ever work correctly, this restriction will go away.
+A: Short Answer: No.
- Configuring BIND9 with the --disable-threads option (the default) causes a
- non-threaded version to be built, which will allow -u to be used.
+ Long Answer: There really isn't a default configuration which fits any
+ site perfectly. There are lots of decisions that need to be made and
+ there is no consensus on what the defaults should be. For example
+ FreeBSD uses /etc/namedb as the location where the configuration files
+ for named are stored. Others use /var/named.
-Q: Why do I get the following errors:
+ What addresses to listen on? For a laptop on the move a lot you may
+ only want to listen on the loop back interfaces.
- general: errno2result.c:109: unexpected error:
- general: unable to convert errno to isc_result: 14: Bad address
- client: UDP client handler shutting down due to fatal receive error: unexpected error
+ Who do you offer recursive service to? Is there are firewall to
+ consider? If so is it stateless or stateful. Are you directly on the
+ Internet? Are you on a private network? Are you on a NAT'd network? The
+ answers to all these questions change how you configure even a caching
+ name server.
-A: This is the result of a Linux kernel bug.
+2. Configuration and Setup Questions
- See: http://marc.theaimsgroup.com/?l=linux-netdev&m=113081708031466&w=2
-
-Q: Why does named log the warning message "no TTL specified - using SOA MINTTL
- instead"?
+Q: Why does named log the warning message "no TTL specified - using SOA
+ MINTTL instead"?
-A: Your zone file is illegal according to RFC1035. It must either have a line
- like:
+A: Your zone file is illegal according to RFC1035. It must either have a
+ line like:
$TTL 86400
- at the beginning, or the first record in it must have a TTL field, like the
- "84600" in this example:
+ at the beginning, or the first record in it must have a TTL field, like
+ the "84600" in this example:
example.com. 86400 IN SOA ns hostmaster ( 1 3600 1800 1814400 3600 )
-Q: Why do I see 5 (or more) copies of named on Linux?
-
-A: Linux threads each show up as a process under ps. The approximate number of
- threads running is n+4, where n is the number of CPUs. Note that the amount of
- memory used is not cumulative; if each process is using 10M of memory, only a
- total of 10M is used.
-
- Newer versions of Linux's ps command hide the individual threads and require -L
- to display them.
-
-Q: Why does BIND 9 log "permission denied" errors accessing its configuration
- files or zones on my Linux system even though it is running as root?
+Q: Why do I get errors like "dns_zone_load: zone foo/IN: loading master
+ file bar: ran out of space"?
-A: On Linux, BIND 9 drops most of its root privileges on startup. This including
- the privilege to open files owned by other users. Therefore, if the server is
- running as root, the configuration files and zone files should also be owned by
- root.
-
-Q: Why do I get errors like "dns_zone_load: zone foo/IN: loading master file bar:
- ran out of space"?
-
-A: This is often caused by TXT records with missing close quotes. Check that all
- TXT records containing quoted strings have both open and close quotes.
-
-Q: How do I produce a usable core file from a multi-threaded named on Linux?
-
-A: If the Linux kernel is 2.4.7 or newer, multi-threaded core dumps are usable
- (that is, the correct thread is dumped). Otherwise, if using a 2.2 kernel,
- apply the kernel patch found in contrib/linux/coredump-patch and rebuild the
- kernel. This patch will cause multi-threaded programs to dump the correct
- thread.
+A: This is often caused by TXT records with missing close quotes. Check
+ that all TXT records containing quoted strings have both open and close
+ quotes.
Q: How do I restrict people from looking up the server version?
-A: Put a "version" option containing something other than the real version in the
- "options" section of named.conf. Note doing this will not prevent attacks and
- may impede people trying to diagnose problems with your server. Also it is
- possible to "fingerprint" nameservers to determine their version.
+A: Put a "version" option containing something other than the real version
+ in the "options" section of named.conf. Note doing this will not
+ prevent attacks and may impede people trying to diagnose problems with
+ your server. Also it is possible to "fingerprint" nameservers to
+ determine their version.
Q: How do I restrict only remote users from looking up the server version?
-A: The following view statement will intercept lookups as the internal view that
- holds the version information will be matched last. The caveats of the previous
- answer still apply, of course.
+A: The following view statement will intercept lookups as the internal
+ view that holds the version information will be matched last. The
+ caveats of the previous answer still apply, of course.
view "chaos" chaos {
match-clients { <those to be refused>; };
};
};
-Q: What do "no source of entropy found" or "could not open entropy source foo"
- mean?
-
-A: The server requires a source of entropy to perform certain operations, mostly
- DNSSEC related. These messages indicate that you have no source of entropy. On
- systems with /dev/random or an equivalent, it is used by default. A source of
- entropy can also be defined using the random-device option in named.conf.
-
-Q: I installed BIND 9 and restarted named, but it's still BIND 8. Why?
-
-A: BIND 9 is installed under /usr/local by default. BIND 8 is often installed
- under /usr. Check that the correct named is running.
-
-Q: I'm trying to use TSIG to authenticate dynamic updates or zone transfers. I'm
- sure I have the keys set up correctly, but the server is rejecting the TSIG.
- Why?
-
-A: This may be a clock skew problem. Check that the the clocks on the client and
- server are properly synchronised (e.g., using ntp).
-
-Q: I'm trying to compile BIND 9, and "make" is failing due to files not being
- found. Why?
+Q: What do "no source of entropy found" or "could not open entropy source
+ foo" mean?
-A: Using a parallel or distributed "make" to build BIND 9 is not supported, and
- doesn't work. If you are using one of these, use normal make or gmake instead.
+A: The server requires a source of entropy to perform certain operations,
+ mostly DNSSEC related. These messages indicate that you have no source
+ of entropy. On systems with /dev/random or an equivalent, it is used by
+ default. A source of entropy can also be defined using the
+ random-device option in named.conf.
-Q: I have a BIND 9 master and a BIND 8.2.3 slave, and the master is logging error
- messages like "notify to 10.0.0.1#53 failed: unexpected end of input". What's
- wrong?
+Q: I'm trying to use TSIG to authenticate dynamic updates or zone
+ transfers. I'm sure I have the keys set up correctly, but the server is
+ rejecting the TSIG. Why?
-A: This error message is caused by a known bug in BIND 8.2.3 and is fixed in BIND
- 8.2.4. It can be safely ignored - the notify has been acted on by the slave
- despite the error message.
-
-Q: I keep getting log messages like the following. Why?
-
- Dec 4 23:47:59 client 10.0.0.1#1355: updating zone 'example.com/IN': update
- failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
-
-A: DNS updates allow the update request to test to see if certain conditions are
- met prior to proceeding with the update. The message above is saying that
- conditions were not met and the update is not proceeding. See doc/rfc/
- rfc2136.txt for more details on prerequisites.
-
-Q: I keep getting log messages like the following. Why?
-
- Jun 21 12:00:00.000 client 10.0.0.1#1234: update denied
-
-A: Someone is trying to update your DNS data using the RFC2136 Dynamic Update
- protocol. Windows 2000 machines have a habit of sending dynamic update requests
- to DNS servers without being specifically configured to do so. If the update
- requests are coming from a Windows 2000 machine, see http://
- support.microsoft.com/support/kb/articles/q246/8/04.asp for information about
- how to turn them off.
+A: This may be a clock skew problem. Check that the the clocks on the
+ client and server are properly synchronised (e.g., using ntp).
Q: I see a log message like the following. Why?
couldn't open pid file '/var/run/named.pid': Permission denied
-A: You are most likely running named as a non-root user, and that user does not
- have permission to write in /var/run. The common ways of fixing this are to
- create a /var/run/named directory owned by the named user and set pid-file to "
- /var/run/named/named.pid", or set pid-file to "named.pid", which will put the
- file in the directory specified by the directory option (which, in this case,
- must be writable by the named user).
-
-Q: When I do a "dig . ns", many of the A records for the root servers are missing.
- Why?
-
-A: This is normal and harmless. It is a somewhat confusing side effect of the way
- BIND 9 does RFC2181 trust ranking and of the efforts BIND 9 makes to avoid
- promoting glue into answers.
+A: You are most likely running named as a non-root user, and that user
+ does not have permission to write in /var/run. The common ways of
+ fixing this are to create a /var/run/named directory owned by the named
+ user and set pid-file to "/var/run/named/named.pid", or set pid-file to
+ "named.pid", which will put the file in the directory specified by the
+ directory option (which, in this case, must be writable by the named
+ user).
- When BIND 9 first starts up and primes its cache, it receives the root server
- addresses as additional data in an authoritative response from a root server,
- and these records are eligible for inclusion as additional data in responses.
- Subsequently it receives a subset of the root server addresses as additional
- data in a non-authoritative (referral) response from a root server. This causes
- the addresses to now be considered non-authoritative (glue) data, which is not
- eligible for inclusion in responses.
+Q: I can query the nameserver from the nameserver but not from other
+ machines. Why?
- The server does have a complete set of root server addresses cached at all
- times, it just may not include all of them as additional data, depending on
- whether they were last received as answers or as glue. You can always look up
- the addresses with explicit queries like "dig a.root-servers.net A".
+A: This is usually the result of the firewall configuration stopping the
+ queries and / or the replies.
-Q: Zone transfers from my BIND 9 master to my Windows 2000 slave fail. Why?
+Q: How can I make a server a slave for both an internal and an external
+ view at the same time? When I tried, both views on the slave were
+ transferred from the same view on the master.
-A: This may be caused by a bug in the Windows 2000 DNS server where DNS messages
- larger than 16K are not handled properly. This can be worked around by setting
- the option "transfer-format one-answer;". Also check whether your zone contains
- domain names with embedded spaces or other special characters, like "John\
- 032Doe\213s\032Computer", since such names have been known to cause Windows
- 2000 slaves to incorrectly reject the zone.
-
-Q: Why don't my zones reload when I do an "rndc reload" or SIGHUP?
-
-A: A zone can be updated either by editing zone files and reloading the server or
- by dynamic update, but not both. If you have enabled dynamic update for a zone
- using the "allow-update" option, you are not supposed to edit the zone file by
- hand, and the server will not attempt to reload it.
-
-Q: I can query the nameserver from the nameserver but not from other machines.
- Why?
-
-A: This is usually the result of the firewall configuration stopping the queries
- and / or the replies.
-
-Q: How can I make a server a slave for both an internal and an external view at
- the same time? When I tried, both views on the slave were transferred from the
- same view on the master.
-
-A: You will need to give the master and slave multiple IP addresses and use those
- to make sure you reach the correct view on the other machine.
+A: You will need to give the master and slave multiple IP addresses and
+ use those to make sure you reach the correct view on the other machine.
Master: 10.0.1.1 (internal), 10.0.1.2 (external, IP alias)
internal:
transfer-source 10.0.1.4;
query-source address 10.0.1.4;
- You put the external address on the alias so that all the other dns clients on
- these boxes see the internal view by default.
+ You put the external address on the alias so that all the other dns
+ clients on these boxes see the internal view by default.
A: BIND 9.3 and later: Use TSIG to select the appropriate view.
...
};
-Q: I have FreeBSD 4.x and "rndc-confgen -a" just sits there.
-
-A: /dev/random is not configured. Use rndcontrol(8) to tell the kernel to use
- certain interrupts as a source of random events. You can make this permanent by
- setting rand_irqs in /etc/rc.conf.
+Q: I get error messages like "multiple RRs of singleton type" and "CNAME
+ and other data" when transferring a zone. What does this mean?
- /etc/rc.conf
- rand_irqs="3 14 15"
-
- See also http://people.freebsd.org/~dougb/randomness.html
-
-Q: Why is named listening on UDP port other than 53?
-
-A: Named uses a system selected port to make queries of other nameservers. This
- behaviour can be overridden by using query-source to lock down the port and/or
- address. See also notify-source and transfer-source.
-
-Q: I get error messages like "multiple RRs of singleton type" and "CNAME and other
- data" when transferring a zone. What does this mean?
-
-A: These indicate a malformed master zone. You can identify the exact records
- involved by transferring the zone using dig then running named-checkzone on it.
+A: These indicate a malformed master zone. You can identify the exact
+ records involved by transferring the zone using dig then running
+ named-checkzone on it.
dig axfr example.com @master-server > tmp
named-checkzone example.com tmp
- A CNAME record cannot exist with the same name as another record except for the
- DNSSEC records which prove its existence (NSEC).
-
- RFC 1034, Section 3.6.2: "If a CNAME RR is present at a node, no other data
- should be present; this ensures that the data for a canonical name and its
- aliases cannot be different. This rule also insures that a cached CNAME can be
- used without checking with an authoritative server for other RR types."
-
-Q: I get error messages like "named.conf:99: unexpected end of input" where 99 is
- the last line of named.conf.
-
-A: Some text editors (notepad and wordpad) fail to put a line title indication
- (e.g. CR/LF) on the last line of a text file. This can be fixed by "adding" a
- blank line to the end of the file. Named expects to see EOF immediately after
- EOL and treats text files where this is not met as truncated.
-
-Q: I get warning messages like "zone example.com/IN: refresh: failure trying
- master 1.2.3.4#53: timed out".
-
-A: Check that you can make UDP queries from the slave to the master
+ A CNAME record cannot exist with the same name as another record except
+ for the DNSSEC records which prove its existence (NSEC).
- dig +norec example.com soa @1.2.3.4
+ RFC 1034, Section 3.6.2: "If a CNAME RR is present at a node, no other
+ data should be present; this ensures that the data for a canonical name
+ and its aliases cannot be different. This rule also insures that a
+ cached CNAME can be used without checking with an authoritative server
+ for other RR types."
- You could be generating queries faster than the slave can cope with. Lower the
- serial query rate.
+Q: I get error messages like "named.conf:99: unexpected end of input"
+ where 99 is the last line of named.conf.
- serial-query-rate 5; // default 20
+A: Some text editors (notepad and wordpad) fail to put a line title
+ indication (e.g. CR/LF) on the last line of a text file. This can be
+ fixed by "adding" a blank line to the end of the file. Named expects to
+ see EOF immediately after EOL and treats text files where this is not
+ met as truncated.
Q: How do I share a dynamic zone between multiple views?
-A: You choose one view to be master and the second a slave and transfer the zone
- between views.
+A: You choose one view to be master and the second a slave and transfer
+ the zone between views.
Master 10.0.1.1:
key "external" {
};
view "internal" {
- match-clients { !external; 10.0.1/24; };
+ match-clients { !key external; 10.0.1/24; };
server 10.0.1.1 {
/* Deliver notify messages to external view. */
keys { external; };
};
view "external" {
- match-clients { external; any; };
+ match-clients { key external; any; };
zone "example.com" {
type slave;
file "external/example.db";
};
};
-Q: I get a error message like "zone wireless.ietf56.ietf.org/IN: loading master
- file primaries/wireless.ietf56.ietf.org: no owner".
+Q: I get a error message like "zone wireless.ietf56.ietf.org/IN: loading
+ master file primaries/wireless.ietf56.ietf.org: no owner".
-A: This error is produced when a line in the master file contains leading white
- space (tab/space) but the is no current record owner name to inherit the name
- from. Usually this is the result of putting white space before a comment.
- Forgetting the "@" for the SOA record or indenting the master file.
+A: This error is produced when a line in the master file contains leading
+ white space (tab/space) but the is no current record owner name to
+ inherit the name from. Usually this is the result of putting white
+ space before a comment, forgetting the "@" for the SOA record, or
+ indenting the master file.
Q: Why are my logs in GMT (UTC).
-A: You are running chrooted (-t) and have not supplied local timezone information
- in the chroot area.
+A: You are running chrooted (-t) and have not supplied local timezone
+ information in the chroot area.
FreeBSD: /etc/localtime
Solaris: /etc/TIMEZONE and /usr/share/lib/zoneinfo
See also tzset(3) and zic(8).
-Q: I get the error message "named: capset failed: Operation not permitted" when
- starting named.
-
-A: The capability module, part of "Linux Security Modules/LSM", has not been
- loaded into the kernel. See insmod(8).
-
-Q: I get "rndc: connect failed: connection refused" when I try to run rndc.
+Q: I get "rndc: connect failed: connection refused" when I try to run
+ rndc.
A: This is usually a configuration error.
- First ensure that named is running and no errors are being reported at startup
- (/var/log/messages or equivalent). Running "named -g <usual arguments>" from a
- title can help at this point.
-
- Secondly ensure that named is configured to use rndc either by "rndc-confgen
- -a", rndc-confgen or manually. The Administrators Reference manual has details
- on how to do this.
-
- Old versions of rndc-confgen used localhost rather than 127.0.0.1 in /etc/
- rndc.conf for the default server. Update /etc/rndc.conf if necessary so that
- the default server listed in /etc/rndc.conf matches the addresses used in
- named.conf. "localhost" has two address (127.0.0.1 and ::1).
-
- If you use "rndc-confgen -a" and named is running with -t or -u ensure that /
- etc/rndc.conf has the correct ownership and that a copy is in the chroot area.
- You can do this by re-running "rndc-confgen -a" with appropriate -t and -u
- arguments.
-
-Q: I don't get RRSIG's returned when I use "dig +dnssec".
-
-A: You need to ensure DNSSEC is enabled (dnssec-enable yes;).
-
-Q: I get "Error 1067" when starting named under Windows.
+ First ensure that named is running and no errors are being reported at
+ startup (/var/log/messages or equivalent). Running "named -g <usual
+ arguments>" from a title can help at this point.
-A: This is the service manager saying that named exited. You need to examine the
- Application log in the EventViewer to find out why.
+ Secondly ensure that named is configured to use rndc either by
+ "rndc-confgen -a", rndc-confgen or manually. The Administrators
+ Reference manual has details on how to do this.
- Common causes are that you failed to create "named.conf" (usually "C:\windows\
- dns\etc\named.conf") or failed to specify the directory in named.conf.
+ Old versions of rndc-confgen used localhost rather than 127.0.0.1 in /
+ etc/rndc.conf for the default server. Update /etc/rndc.conf if
+ necessary so that the default server listed in /etc/rndc.conf matches
+ the addresses used in named.conf. "localhost" has two address
+ (127.0.0.1 and ::1).
- options {
- Directory "C:\windows\dns\etc";
- };
+ If you use "rndc-confgen -a" and named is running with -t or -u ensure
+ that /etc/rndc.conf has the correct ownership and that a copy is in the
+ chroot area. You can do this by re-running "rndc-confgen -a" with
+ appropriate -t and -u arguments.
Q: I get "transfer of 'example.net/IN' from 192.168.4.12#53: failed while
receiving responses: permission denied" error messages.
-A: These indicate a filesystem permission error preventing named creating /
- renaming the temporary file. These will usually also have other associated
- error messages like
+A: These indicate a filesystem permission error preventing named creating
+ / renaming the temporary file. These will usually also have other
+ associated error messages like
"dumping master file: sl/tmp-XXXX5il3sQ: open: permission denied"
- Named needs write permission on the directory containing the file. Named writes
- the new cache file to a temporary file then renames it to the name specified in
- named.conf to ensure that the contents are always complete. This is to prevent
- named loading a partial zone in the event of power failure or similar
- interrupting the write of the master file.
+ Named needs write permission on the directory containing the file.
+ Named writes the new cache file to a temporary file then renames it to
+ the name specified in named.conf to ensure that the contents are always
+ complete. This is to prevent named loading a partial zone in the event
+ of power failure or similar interrupting the write of the master file.
- Note file names are relative to the directory specified in options and any
- chroot directory ([<chroot dir>/][<options dir>]).
+ Note file names are relative to the directory specified in options and
+ any chroot directory ([<chroot dir>/][<options dir>]).
- If named is invoked as "named -t /chroot/DNS" with the following named.conf
- then "/chroot/DNS/var/named/sl" needs to be writable by the user named is
- running as.
+ If named is invoked as "named -t /chroot/DNS" with the following
+ named.conf then "/chroot/DNS/var/named/sl" needs to be writable by the
+ user named is running as.
options {
directory "/var/named";
masters { 192.168.4.12; };
};
-Q: How do I integrate BIND 9 and Solaris SMF
+Q: I want to forward all DNS queries from my caching nameserver to another
+ server. But there are some domains which have to be served locally, via
+ rbldnsd.
-A: Sun has a blog entry describing how to do this.
+ How do I achieve this ?
- http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris
+A: options {
+ forward only;
+ forwarders { <ip.of.primary.nameserver>; };
+ };
+
+ zone "sbl-xbl.spamhaus.org" {
+ type forward; forward only;
+ forwarders { <ip.of.rbldns.server> port 530; };
+ };
+
+ zone "list.dsbl.org" {
+ type forward; forward only;
+ forwarders { <ip.of.rbldns.server> port 530; };
+ };
+
+
+3. General Questions
+
+Q: I keep getting log messages like the following. Why?
+
+ Dec 4 23:47:59 client 10.0.0.1#1355: updating zone 'example.com/IN':
+ update failed: 'RRset exists (value dependent)' prerequisite not
+ satisfied (NXRRSET)
+
+A: DNS updates allow the update request to test to see if certain
+ conditions are met prior to proceeding with the update. The message
+ above is saying that conditions were not met and the update is not
+ proceeding. See doc/rfc/rfc2136.txt for more details on prerequisites.
+
+Q: I keep getting log messages like the following. Why?
+
+ Jun 21 12:00:00.000 client 10.0.0.1#1234: update denied
+
+A: Someone is trying to update your DNS data using the RFC2136 Dynamic
+ Update protocol. Windows 2000 machines have a habit of sending dynamic
+ update requests to DNS servers without being specifically configured to
+ do so. If the update requests are coming from a Windows 2000 machine,
+ see http://support.microsoft.com/support/kb/articles/q246/8/04.asp for
+ information about how to turn them off.
+
+Q: When I do a "dig . ns", many of the A records for the root servers are
+ missing. Why?
+
+A: This is normal and harmless. It is a somewhat confusing side effect of
+ the way BIND 9 does RFC2181 trust ranking and of the efforts BIND 9
+ makes to avoid promoting glue into answers.
+
+ When BIND 9 first starts up and primes its cache, it receives the root
+ server addresses as additional data in an authoritative response from a
+ root server, and these records are eligible for inclusion as additional
+ data in responses. Subsequently it receives a subset of the root server
+ addresses as additional data in a non-authoritative (referral) response
+ from a root server. This causes the addresses to now be considered
+ non-authoritative (glue) data, which is not eligible for inclusion in
+ responses.
+
+ The server does have a complete set of root server addresses cached at
+ all times, it just may not include all of them as additional data,
+ depending on whether they were last received as answers or as glue. You
+ can always look up the addresses with explicit queries like "dig
+ a.root-servers.net A".
+
+Q: Why don't my zones reload when I do an "rndc reload" or SIGHUP?
+
+A: A zone can be updated either by editing zone files and reloading the
+ server or by dynamic update, but not both. If you have enabled dynamic
+ update for a zone using the "allow-update" option, you are not supposed
+ to edit the zone file by hand, and the server will not attempt to
+ reload it.
+
+Q: Why is named listening on UDP port other than 53?
+
+A: Named uses a system selected port to make queries of other nameservers.
+ This behaviour can be overridden by using query-source to lock down the
+ port and/or address. See also notify-source and transfer-source.
+
+Q: I get warning messages like "zone example.com/IN: refresh: failure
+ trying master 1.2.3.4#53: timed out".
+
+A: Check that you can make UDP queries from the slave to the master
+
+ dig +norec example.com soa @1.2.3.4
+
+ You could be generating queries faster than the slave can cope with.
+ Lower the serial query rate.
+
+ serial-query-rate 5; // default 20
+
+Q: I don't get RRSIG's returned when I use "dig +dnssec".
+
+A: You need to ensure DNSSEC is enabled (dnssec-enable yes;).
Q: Can a NS record refer to a CNAME.
-A: No. The rules for glue (copies of the *address* records in the parent zones)
- and additional section processing do not allow it to work.
+A: No. The rules for glue (copies of the *address* records in the parent
+ zones) and additional section processing do not allow it to work.
- You would have to add both the CNAME and address records (A/AAAA) as glue to
- the parent zone and have CNAMEs be followed when doing additional section
- processing to make it work. No nameserver implementation supports either of
- these requirements.
+ You would have to add both the CNAME and address records (A/AAAA) as
+ glue to the parent zone and have CNAMEs be followed when doing
+ additional section processing to make it work. No nameserver
+ implementation supports either of these requirements.
-Q: What does "RFC 1918 response from Internet for 0.0.0.10.IN-ADDR.ARPA" mean?
+Q: What does "RFC 1918 response from Internet for 0.0.0.10.IN-ADDR.ARPA"
+ mean?
-A: If the IN-ADDR.ARPA name covered refers to a internal address space you are
- using then you have failed to follow RFC 1918 usage rules and are leaking
- queries to the Internet. You should establish your own zones for these
- addresses to prevent you querying the Internet's name servers for these
- addresses. Please see http://as112.net/ for details of the problems you are
- causing and the counter measures that have had to be deployed.
+A: If the IN-ADDR.ARPA name covered refers to a internal address space you
+ are using then you have failed to follow RFC 1918 usage rules and are
+ leaking queries to the Internet. You should establish your own zones
+ for these addresses to prevent you querying the Internet's name servers
+ for these addresses. Please see http://as112.net/ for details of the
+ problems you are causing and the counter measures that have had to be
+ deployed.
- If you are not using these private addresses then a client has queried for
- them. You can just ignore the messages, get the offending client to stop
- sending you these messages as they are most probably leaking them or setup your
- own zones empty zones to serve answers to these queries.
+ If you are not using these private addresses then a client has queried
+ for them. You can just ignore the messages, get the offending client to
+ stop sending you these messages as they are most probably leaking them
+ or setup your own zones empty zones to serve answers to these queries.
zone "10.IN-ADDR.ARPA" {
type master;
Future versions of named are likely to do this automatically.
+Q: Will named be affected by the 2007 changes to daylight savings rules in
+ the US.
+
+A: No, so long as the machines internal clock (as reported by "date -u")
+ remains at UTC. The only visible change if you fail to upgrade your OS,
+ if you are in a affected area, will be that log messages will be a hour
+ out during the period where the old rules do not match the new rules.
+
+ For most OS's this change just means that you need to update the
+ conversion rules from UTC to local time. Normally this involves
+ updating a file in /etc (which sets the default timezone for the
+ machine) and possibly a directory which has all the conversion rules
+ for the world (e.g. /usr/share/zoneinfo). When updating the OS do not
+ forget to update any chroot areas as well. See your OS's documentation
+ for more details.
+
+ The local timezone conversion rules can also be done on a individual
+ basis by setting the TZ environment variable appropriately. See your
+ OS's documentation for more details.
+
+4. Operating-System Specific Questions
+
+4.1. Linux
+
+Q: Why do I get the following errors:
+
+ general: errno2result.c:109: unexpected error:
+ general: unable to convert errno to isc_result: 14: Bad address
+ client: UDP client handler shutting down due to fatal receive error: unexpected error
+
+A: This is the result of a Linux kernel bug.
+
+ See: http://marc.theaimsgroup.com/?l=linux-netdev&m=113081708031466&w=2
+
+Q: Why do I see 5 (or more) copies of named on Linux?
+
+A: Linux threads each show up as a process under ps. The approximate
+ number of threads running is n+4, where n is the number of CPUs. Note
+ that the amount of memory used is not cumulative; if each process is
+ using 10M of memory, only a total of 10M is used.
+
+ Newer versions of Linux's ps command hide the individual threads and
+ require -L to display them.
+
+Q: Why does BIND 9 log "permission denied" errors accessing its
+ configuration files or zones on my Linux system even though it is
+ running as root?
+
+A: On Linux, BIND 9 drops most of its root privileges on startup. This
+ including the privilege to open files owned by other users. Therefore,
+ if the server is running as root, the configuration files and zone
+ files should also be owned by root.
+
+Q: I get the error message "named: capset failed: Operation not permitted"
+ when starting named.
+
+A: The capability module, part of "Linux Security Modules/LSM", has not
+ been loaded into the kernel. See insmod(8).
+
Q: I'm running BIND on Red Hat Enterprise Linux or Fedora Core -
Why can't named update slave zone database files?
- Why can't named create DDNS journal files or update the master zones from
- journals?
+ Why can't named create DDNS journal files or update the master zones
+ from journals?
Why can't named create custom log files?
A: Red Hat Security Enhanced Linux (SELinux) policy security protections :
- Red Hat have adopted the National Security Agency's SELinux security policy (
- see http://www.nsa.gov/selinux ) and recommendations for BIND security , which
- are more secure than running named in a chroot and make use of the bind-chroot
- environment unnecessary .
+ Red Hat have adopted the National Security Agency's SELinux security
+ policy ( see http://www.nsa.gov/selinux ) and recommendations for BIND
+ security , which are more secure than running named in a chroot and
+ make use of the bind-chroot environment unnecessary .
- By default, named is not allowed by the SELinux policy to write, create or
- delete any files EXCEPT in these directories:
+ By default, named is not allowed by the SELinux policy to write, create
+ or delete any files EXCEPT in these directories:
$ROOTDIR/var/named/slaves
$ROOTDIR/var/named/data
$ROOTDIR/var/tmp
- where $ROOTDIR may be set in /etc/sysconfig/named if bind-chroot is installed.
+ where $ROOTDIR may be set in /etc/sysconfig/named if bind-chroot is
+ installed.
- The SELinux policy particularly does NOT allow named to modify the $ROOTDIR/var
- /named directory, the default location for master zone database files.
+ The SELinux policy particularly does NOT allow named to modify the
+ $ROOTDIR/var/named directory, the default location for master zone
+ database files.
- SELinux policy overrules file access permissions - so even if all the files
- under /var/named have ownership named:named and mode rw-rw-r--, named will
- still not be able to write or create files except in the directories above,
- with SELinux in Enforcing mode.
+ SELinux policy overrules file access permissions - so even if all the
+ files under /var/named have ownership named:named and mode rw-rw-r--,
+ named will still not be able to write or create files except in the
+ directories above, with SELinux in Enforcing mode.
- So, to allow named to update slave or DDNS zone files, it is best to locate
- them in $ROOTDIR/var/named/slaves, with named.conf zone statements such as:
+ So, to allow named to update slave or DDNS zone files, it is best to
+ locate them in $ROOTDIR/var/named/slaves, with named.conf zone
+ statements such as:
zone "slave.zone." IN {
type slave;
};
- To allow named to create its cache dump and statistics files, for example, you
- could use named.conf options statements such as:
+ To allow named to create its cache dump and statistics files, for
+ example, you could use named.conf options statements such as:
options {
...
};
- You can also tell SELinux to allow named to update any zone database files, by
- setting the SELinux tunable boolean parameter 'named_write_master_zones=1',
- using the system-config-securitylevel GUI, using the 'setsebool' command, or in
- /etc/selinux/targeted/booleans.
+ You can also tell SELinux to allow named to update any zone database
+ files, by setting the SELinux tunable boolean parameter
+ 'named_write_master_zones=1', using the system-config-securitylevel
+ GUI, using the 'setsebool' command, or in /etc/selinux/targeted/
+ booleans.
You can disable SELinux protection for named entirely by setting the
'named_disable_trans=1' SELinux tunable boolean parameter.
named_cache_t: for files modifiable by named - $ROOTDIR/var/{tmp,named/{slaves,data}}
- If you want to retain use of the SELinux policy for named, and put named files
- in different locations, you can do so by changing the context of the custom
- file locations .
+ If you want to retain use of the SELinux policy for named, and put
+ named files in different locations, you can do so by changing the
+ context of the custom file locations .
- To create a custom configuration file location, e.g. '/root/named.conf', to use
- with the 'named -c' option, do:
+ To create a custom configuration file location, e.g. '/root/
+ named.conf', to use with the 'named -c' option, do:
# chcon system_u:object_r:named_conf_t /root/named.conf
- To create a custom modifiable named data location, e.g. '/var/log/named' for a
- log file, do:
+ To create a custom modifiable named data location, e.g. '/var/log/
+ named' for a log file, do:
# chcon system_u:object_r:named_cache_t /var/log/named
# chcon system_u:object_r:named_zone_t /root/zones/{.,*}
- See these man-pages for more information : selinux(8), named_selinux(8), chcon
- (1), setsebool(8)
-
-Q: I want to forward all DNS queries from my caching nameserver to another server.
- But there are some domains which have to be served locally, via rbldnsd.
-
- How do I achieve this ?
-
-A: options {
- forward only;
- forwarders { <ip.of.primary.nameserver>; };
- };
-
- zone "sbl-xbl.spamhaus.org" {
- type forward; forward only;
- forwarders { <ip.of.rbldns.server> port 530; };
- };
-
- zone "list.dsbl.org" {
- type forward; forward only;
- forwarders { <ip.of.rbldns.server> port 530; };
- };
-
-
-Q: Will named be affected by the 2007 changes to daylight savings rules in the US.
-
-A: No, so long as the machines internal clock (as reported by "date -u") remains
- at UTC. The only visible change if you fail to upgrade your OS, if you are in a
- affected area, will be that log messages will be a hour out during the period
- where the old rules do not match the new rules.
-
- For most OS's this change just means that you need to update the conversion
- rules from UTC to local time. Normally this involves updating a file in /etc
- (which sets the default timezone for the machine) and possibly a directory
- which has all the conversion rules for the world (e.g. /usr/share/zoneinfo).
- When updating the OS do not forget to update any chroot areas as well. See your
- OS's documentation for more details.
-
- The local timezone conversion rules can also be done on a individual basis by
- setting the TZ environment variable appropriately. See your OS's documentation
- for more details.
+ See these man-pages for more information : selinux(8), named_selinux
+ (8), chcon(1), setsebool(8)
-Q: Why do we get the following warning at run time:
+4.2. Windows
- kernel: process `named' is using obsolete setsockopt SO_BSDCOMPAT
-
-A: The early Linux kernels broke sendto() by having it return that a ICMP
- unreachable had be received for non connected UDP sockets. This made non
- connected UDP sockets work like connected UDP socket which is fine when you are
- only talking to one destination. Named however talks to multiple destinations
- and it caused problems.
+Q: Zone transfers from my BIND 9 master to my Windows 2000 slave fail.
+ Why?
- Rather than fix sendto() to just have BSD behaviour they added SO_BSDCOMPAT to
- turn BSD behaviour on/off on a per socket basis.
+A: This may be caused by a bug in the Windows 2000 DNS server where DNS
+ messages larger than 16K are not handled properly. This can be worked
+ around by setting the option "transfer-format one-answer;". Also check
+ whether your zone contains domain names with embedded spaces or other
+ special characters, like "John\032Doe\213s\032Computer", since such
+ names have been known to cause Windows 2000 slaves to incorrectly
+ reject the zone.
- Later they decided to make BSD behaviour the default and to aggressively track
- down applications that used SO_BSDCOMPAT by issuing a warning. This is the sort
- of things vendors do in alpha/beta stages of a release so that their code is
- clean. They then turn the warning *off* for release code.
+Q: I get "Error 1067" when starting named under Windows.
- We still have customers that have kernels that require SO_BSDCOMPAT to operate.
- We therefore cannot remove the setsockopt(SO_BSDCOMPAT) call.
+A: This is the service manager saying that named exited. You need to
+ examine the Application log in the EventViewer to find out why.
- Now most/all portable applications that use SO_BSDCOMPAT use it conditionally
- manner so just removing SO_BSDCOMPAT from the header file would be safe as long
- as the binary was not to be moved between systems. BIND's use is conditional.
+ Common causes are that you failed to create "named.conf" (usually "C:\
+ windows\dns\etc\named.conf") or failed to specify the directory in
+ named.conf.
- In short, the Linux developers should either, remove the #define for
- SO_BSDCOMPAT, and/or remove the warning.
+ options {
+ Directory "C:\windows\dns\etc";
+ };
-Q: Isn't "make install" supposed to generate a default named.conf?
+4.3. FreeBSD
-A: Short Answer: No.
+Q: I have FreeBSD 4.x and "rndc-confgen -a" just sits there.
- Long Answer: There really isn't a default configuration which fits any site
- perfectly. There are lots of decisions that need to be made and there is no
- consensus on what the defaults should be. For example FreeBSD uses /etc/namedb
- as the location where the configuration files for named are stored. Others use
- /var/named.
+A: /dev/random is not configured. Use rndcontrol(8) to tell the kernel to
+ use certain interrupts as a source of random events. You can make this
+ permanent by setting rand_irqs in /etc/rc.conf.
- What addresses to listen on? For a laptop on the move a lot you may only want
- to listen on the loop back interfaces.
+ /etc/rc.conf
+ rand_irqs="3 14 15"
- Who do you offer recursive service to? Is there are firewall to consider? If so
- is it stateless or stateful. Are you directly on the Internet? Are you on a
- private network? Are you on a NAT'd network? The answers to all these questions
- change how you configure even a caching name server.
+ See also http://people.freebsd.org/~dougb/randomness.html
-Q: Is it possible to configure BIND to redirect "anything.domain.com" to
- "domain.com/anything"?
+4.4. Solaris
-A: No. This mapping needs to be done in the HTTP server using the "Host:
- anything.domain.com" header from HTTP 1.1. See your HTTP server documentation
- for how to do this.
+Q: How do I integrate BIND 9 and Solaris SMF
- You can however use wildcard records to map all the hostnames to the same
- addresses. e.g.
+A: Sun has a blog entry describing how to do this.
- * A 192.0.2.10
- * AAAA 2001:DB8:0:0:8:800:200C:417A
+ http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris
- Copyright (C) 2004-2007 Internet Systems Consortium, Inc. ("ISC")
- Copyright (C) 2000-2003 Internet Software Consortium.
-
- - Permission to use, copy, modify, and/or distribute this software for any
+ - Permission to use, copy, modify, and distribute this software for any
- purpose with or without fee is hereby granted, provided that the above
- copyright notice and this permission notice appear in all copies.
-
- PERFORMANCE OF THIS SOFTWARE.
-->
-<!-- $Id: FAQ.xml,v 1.20 2007/06/29 02:26:20 marka Exp $ -->
+<!-- $Id: FAQ.xml,v 1.21 2007/09/03 00:36:53 marka Exp $ -->
<article class="faq">
<title>Frequently Asked Questions about BIND 9</title>
</copyright>
</articleinfo>
<qandaset defaultlabel='qanda'>
+
+ <qandadiv><title>Compilation and Installation Questions</title>
+
<qandaentry>
<question>
<para>
- Why doesn't -u work on Linux 2.2.x when I build with
- --enable-threads?
+ I'm trying to compile BIND 9, and "make" is failing due to
+ files not being found. Why?
</para>
</question>
<answer>
<para>
- Linux threads do not fully implement the Posix threads
- (pthreads) standard. In particular, setuid() operates only
- on the current thread, not the full process. Because of
- this limitation, BIND 9 cannot use setuid() on Linux as it
- can on all other supported platforms. setuid() cannot be
- called before creating threads, since the server does not
- start listening on reserved ports until after threads have
- started.
- </para>
- <para>
- In the 2.2.18 or 2.3.99-pre3 and newer kernels, the ability
- to preserve capabilities across a setuid() call is present.
- This allows BIND 9 to call setuid() early, while retaining
- the ability to bind reserved ports. This is a Linux-specific
- hack.
- </para>
- <para>
- On a 2.2 kernel, BIND 9 does drop many root privileges, so
- it should be less of a security risk than a root process
- that has not dropped privileges.
- </para>
- <para>
- If Linux threads ever work correctly, this restriction will
- go away.
- </para>
- <para>
- Configuring BIND9 with the --disable-threads option (the
- default) causes a non-threaded version to be built, which
- will allow -u to be used.
+ Using a parallel or distributed "make" to build BIND 9 is
+ not supported, and doesn't work. If you are using one of
+ these, use normal make or gmake instead.
</para>
</answer>
</qandaentry>
-
+
<qandaentry>
<question>
<para>
- Why do I get the following errors:
-<programlisting>general: errno2result.c:109: unexpected error:
-general: unable to convert errno to isc_result: 14: Bad address
-client: UDP client handler shutting down due to fatal receive error: unexpected error</programlisting>
+ Isn't "make install" supposed to generate a default named.conf?
</para>
</question>
<answer>
<para>
- This is the result of a Linux kernel bug.
+ Short Answer: No.
</para>
<para>
- See:
- <ulink url="http://marc.theaimsgroup.com/?l=linux-netdev&m=113081708031466&w=2">http://marc.theaimsgroup.com/?l=linux-netdev&m=113081708031466&w=2</ulink>
+ Long Answer: There really isn't a default configuration which fits
+ any site perfectly. There are lots of decisions that need to
+ be made and there is no consensus on what the defaults should be.
+ For example FreeBSD uses /etc/namedb as the location where the
+ configuration files for named are stored. Others use /var/named.
+ </para>
+ <para>
+ What addresses to listen on? For a laptop on the move a lot
+ you may only want to listen on the loop back interfaces.
+ </para>
+ <para>
+ Who do you offer recursive service to? Is there are firewall
+ to consider? If so is it stateless or stateful. Are you
+ directly on the Internet? Are you on a private network? Are
+ you on a NAT'd network? The answers
+ to all these questions change how you configure even a
+ caching name server.
</para>
</answer>
</qandaentry>
+
+ </qandadiv> <!-- Compilation and Installation Questions -->
+
+ <qandadiv><title>Configuration and Setup Questions</title>
<qandaentry>
+ <!-- configuration, log -->
<question>
<para>
Why does named log the warning message <quote>no TTL specified -
</informalexample>
</answer>
</qandaentry>
-
- <qandaentry>
- <question>
- <para>
- Why do I see 5 (or more) copies of named on Linux?
- </para>
- </question>
- <answer>
- <para>
- Linux threads each show up as a process under ps. The
- approximate number of threads running is n+4, where n is
- the number of CPUs. Note that the amount of memory used
- is not cumulative; if each process is using 10M of memory,
- only a total of 10M is used.
- </para>
- <para>
- Newer versions of Linux's ps command hide the individual threads
- and require -L to display them.
- </para>
- </answer>
- </qandaentry>
-
- <qandaentry>
- <question>
- <para>
- Why does BIND 9 log <quote>permission denied</quote> errors accessing
- its configuration files or zones on my Linux system even
- though it is running as root?
- </para>
- </question>
- <answer>
- <para>
- On Linux, BIND 9 drops most of its root privileges on
- startup. This including the privilege to open files owned
- by other users. Therefore, if the server is running as
- root, the configuration files and zone files should also
- be owned by root.
- </para>
- </answer>
- </qandaentry>
-
+
<qandaentry>
+ <!-- configuration -->
<question>
<para>
Why do I get errors like <quote>dns_zone_load: zone foo/IN: loading
</qandaentry>
<qandaentry>
- <question>
- <para>
- How do I produce a usable core file from a multi-threaded
- named on Linux?
- </para>
- </question>
- <answer>
- <para>
- If the Linux kernel is 2.4.7 or newer, multi-threaded core
- dumps are usable (that is, the correct thread is dumped).
- Otherwise, if using a 2.2 kernel, apply the kernel patch
- found in contrib/linux/coredump-patch and rebuild the kernel.
- This patch will cause multi-threaded programs to dump the
- correct thread.
- </para>
- </answer>
- </qandaentry>
-
- <qandaentry>
+ <!-- security -->
<question>
<para>
How do I restrict people from looking up the server version?
</qandaentry>
<qandaentry>
+ <!-- security -->
<question>
<para>
How do I restrict only remote users from looking up the
</qandaentry>
<qandaentry>
+ <!-- configuration -->
<question>
<para>
What do <quote>no source of entropy found</quote> or <quote>could not
</qandaentry>
<qandaentry>
- <question>
- <para>
- I installed BIND 9 and restarted named, but it's still BIND 8. Why?
- </para>
- </question>
- <answer>
- <para>
- BIND 9 is installed under /usr/local by default. BIND 8
- is often installed under /usr. Check that the correct named
- is running.
- </para>
- </answer>
- </qandaentry>
-
- <qandaentry>
+ <!-- configuration -->
<question>
<para>
I'm trying to use TSIG to authenticate dynamic updates or
</answer>
</qandaentry>
- <qandaentry>
- <question>
- <para>
- I'm trying to compile BIND 9, and "make" is failing due to
- files not being found. Why?
- </para>
- </question>
- <answer>
- <para>
- Using a parallel or distributed "make" to build BIND 9 is
- not supported, and doesn't work. If you are using one of
- these, use normal make or gmake instead.
- </para>
- </answer>
- </qandaentry>
-
- <qandaentry>
- <question>
- <para>
- I have a BIND 9 master and a BIND 8.2.3 slave, and the
- master is logging error messages like <quote>notify to 10.0.0.1#53
- failed: unexpected end of input</quote>. What's wrong?
- </para>
- </question>
- <answer>
- <para>
- This error message is caused by a known bug in BIND 8.2.3
- and is fixed in BIND 8.2.4. It can be safely ignored - the
- notify has been acted on by the slave despite the error
- message.
- </para>
- </answer>
- </qandaentry>
-
- <qandaentry>
- <question>
- <para>
- I keep getting log messages like the following. Why?
- </para>
- <para>
- Dec 4 23:47:59 client 10.0.0.1#1355: updating zone
- 'example.com/IN': update failed: 'RRset exists (value
- dependent)' prerequisite not satisfied (NXRRSET)
- </para>
- </question>
- <answer>
- <para>
- DNS updates allow the update request to test to see if
- certain conditions are met prior to proceeding with the
- update. The message above is saying that conditions were
- not met and the update is not proceeding. See doc/rfc/rfc2136.txt
- for more details on prerequisites.
- </para>
- </answer>
- </qandaentry>
-
- <qandaentry>
- <question>
- <para>
- I keep getting log messages like the following. Why?
- </para>
- <para>
- Jun 21 12:00:00.000 client 10.0.0.1#1234: update denied
- </para>
- </question>
- <answer>
- <para>
- Someone is trying to update your DNS data using the RFC2136
- Dynamic Update protocol. Windows 2000 machines have a habit
- of sending dynamic update requests to DNS servers without
- being specifically configured to do so. If the update
- requests are coming from a Windows 2000 machine, see
- <ulink
- url="http://support.microsoft.com/support/kb/articles/q246/8/04.asp">
- http://support.microsoft.com/support/kb/articles/q246/8/04.asp
- </ulink>
- for information about how to turn them off.
- </para>
- </answer>
- </qandaentry>
-
<qandaentry>
<question>
<para>
</para>
</answer>
</qandaentry>
-
- <qandaentry>
- <question>
- <para>
- When I do a "dig . ns", many of the A records for the root
- servers are missing. Why?
- </para>
- </question>
- <answer>
- <para>
- This is normal and harmless. It is a somewhat confusing
- side effect of the way BIND 9 does RFC2181 trust ranking
- and of the efforts BIND 9 makes to avoid promoting glue
- into answers.
- </para>
- <para>
- When BIND 9 first starts up and primes its cache, it receives
- the root server addresses as additional data in an authoritative
- response from a root server, and these records are eligible
- for inclusion as additional data in responses. Subsequently
- it receives a subset of the root server addresses as
- additional data in a non-authoritative (referral) response
- from a root server. This causes the addresses to now be
- considered non-authoritative (glue) data, which is not
- eligible for inclusion in responses.
- </para>
- <para>
- The server does have a complete set of root server addresses
- cached at all times, it just may not include all of them
- as additional data, depending on whether they were last
- received as answers or as glue. You can always look up the
- addresses with explicit queries like "dig a.root-servers.net A".
- </para>
- </answer>
- </qandaentry>
-
- <qandaentry>
- <question>
- <para>
- Zone transfers from my BIND 9 master to my Windows 2000
- slave fail. Why?
- </para>
- </question>
- <answer>
- <para>
- This may be caused by a bug in the Windows 2000 DNS server
- where DNS messages larger than 16K are not handled properly.
- This can be worked around by setting the option "transfer-format
- one-answer;". Also check whether your zone contains domain
- names with embedded spaces or other special characters,
- like "John\032Doe\213s\032Computer", since such names have
- been known to cause Windows 2000 slaves to incorrectly
- reject the zone.
- </para>
- </answer>
- </qandaentry>
-
- <qandaentry>
- <question>
- <para>
- Why don't my zones reload when I do an "rndc reload" or SIGHUP?
- </para>
- </question>
- <answer>
- <para>
- A zone can be updated either by editing zone files and
- reloading the server or by dynamic update, but not both.
- If you have enabled dynamic update for a zone using the
- "allow-update" option, you are not supposed to edit the
- zone file by hand, and the server will not attempt to reload
- it.
- </para>
- </answer>
- </qandaentry>
-
+
<qandaentry>
<question>
<para>
</para>
</answer>
</qandaentry>
-
+
<qandaentry>
<question>
<para>
</informalexample>
</answer>
</qandaentry>
-
- <qandaentry>
- <question>
- <para>
- I have FreeBSD 4.x and "rndc-confgen -a" just sits there.
- </para>
- </question>
- <answer>
- <para>
- /dev/random is not configured. Use rndcontrol(8) to tell
- the kernel to use certain interrupts as a source of random
- events. You can make this permanent by setting rand_irqs
- in /etc/rc.conf.
- </para>
- <informalexample>
- <programlisting>
-/etc/rc.conf
-rand_irqs="3 14 15"</programlisting>
- </informalexample>
- <para>
- See also
- <ulink url="http://people.freebsd.org/~dougb/randomness.html">
- http://people.freebsd.org/~dougb/randomness.html
- </ulink>
- </para>
- </answer>
- </qandaentry>
-
- <qandaentry>
- <question>
- <para>
- Why is named listening on UDP port other than 53?
- </para>
- </question>
- <answer>
- <para>
- Named uses a system selected port to make queries of other
- nameservers. This behaviour can be overridden by using
- query-source to lock down the port and/or address. See
- also notify-source and transfer-source.
- </para>
- </answer>
- </qandaentry>
-
+
<qandaentry>
<question>
<para>
</para>
</answer>
</qandaentry>
-
+
<qandaentry>
<question>
<para>
I get error messages like <quote>named.conf:99: unexpected end
- of input</quote> where 99 is the last line of named.conf.
- </para>
- </question>
- <answer>
- <para>
- Some text editors (notepad and wordpad) fail to put a line
- title indication (e.g. CR/LF) on the last line of a
- text file. This can be fixed by "adding" a blank line to
- the end of the file. Named expects to see EOF immediately
- after EOL and treats text files where this is not met as
- truncated.
- </para>
- </answer>
- </qandaentry>
-
- <qandaentry>
- <question>
- <para>
- I get warning messages like <quote>zone example.com/IN: refresh:
- failure trying master 1.2.3.4#53: timed out</quote>.
+ of input</quote> where 99 is the last line of named.conf.
</para>
</question>
<answer>
<para>
- Check that you can make UDP queries from the slave to the master
- </para>
- <informalexample>
- <programlisting>
-dig +norec example.com soa @1.2.3.4</programlisting>
- </informalexample>
- <para>
- You could be generating queries faster than the slave can
- cope with. Lower the serial query rate.
+ Some text editors (notepad and wordpad) fail to put a line
+ title indication (e.g. CR/LF) on the last line of a
+ text file. This can be fixed by "adding" a blank line to
+ the end of the file. Named expects to see EOF immediately
+ after EOL and treats text files where this is not met as
+ truncated.
</para>
- <informalexample>
- <programlisting>
-serial-query-rate 5; // default 20</programlisting>
- </informalexample>
</answer>
</qandaentry>
-
+
<qandaentry>
<question>
<para>
};
view "internal" {
- match-clients { !external; 10.0.1/24; };
+ match-clients { !key external; 10.0.1/24; };
server 10.0.1.1 {
/* Deliver notify messages to external view. */
keys { external; };
};
view "external" {
- match-clients { external; any; };
+ match-clients { key external; any; };
zone "example.com" {
type slave;
file "external/example.db";
This error is produced when a line in the master file
contains leading white space (tab/space) but the is no
current record owner name to inherit the name from. Usually
- this is the result of putting white space before a comment.
- Forgetting the "@" for the SOA record or indenting the master
+ this is the result of putting white space before a comment,
+ forgetting the "@" for the SOA record, or indenting the master
file.
</para>
</answer>
</para>
</answer>
</qandaentry>
-
- <qandaentry>
- <question>
- <para>
- I get the error message <quote>named: capset failed: Operation
- not permitted</quote> when starting named.
- </para>
- </question>
- <answer>
- <para>
- The capability module, part of "Linux Security Modules/LSM",
- has not been loaded into the kernel. See insmod(8).
- </para>
- </answer>
- </qandaentry>
-
+
<qandaentry>
<question>
<para>
</para>
</answer>
</qandaentry>
-
- <qandaentry>
- <question>
- <para>
- I don't get RRSIG's returned when I use "dig +dnssec".
- </para>
- </question>
- <answer>
- <para>
- You need to ensure DNSSEC is enabled (dnssec-enable yes;).
- </para>
- </answer>
- </qandaentry>
-
- <qandaentry>
- <question>
- <para>
- I get <quote>Error 1067</quote> when starting named under Windows.
- </para>
- </question>
- <answer>
- <para>
- This is the service manager saying that named exited. You
- need to examine the Application log in the EventViewer to
- find out why.
- </para>
- <para>
- Common causes are that you failed to create "named.conf"
- (usually "C:\windows\dns\etc\named.conf") or failed to
- specify the directory in named.conf.
- </para>
- <informalexample>
- <programlisting>
-options {
- Directory "C:\windows\dns\etc";
-};</programlisting>
- </informalexample>
- </answer>
- </qandaentry>
-
+
<qandaentry>
<question>
<para>
</informalexample>
</answer>
</qandaentry>
+
+ <qandaentry>
+ <question>
+ <para>
+ I want to forward all DNS queries from my caching nameserver to
+ another server. But there are some domains which have to be
+ served locally, via rbldnsd.
+ </para>
+ <para>
+ How do I achieve this ?
+ </para>
+ </question>
+ <answer>
+ <programlisting>
+options {
+ forward only;
+ forwarders { <ip.of.primary.nameserver>; };
+};
+
+zone "sbl-xbl.spamhaus.org" {
+ type forward; forward only;
+ forwarders { <ip.of.rbldns.server> port 530; };
+};
+zone "list.dsbl.org" {
+ type forward; forward only;
+ forwarders { <ip.of.rbldns.server> port 530; };
+};
+ </programlisting>
+ </answer>
+ </qandaentry>
+
+ </qandadiv> <!-- Configuration and Setup Questions -->
+
+ <qandadiv><title>General Questions</title>
+
<qandaentry>
<question>
<para>
- How do I integrate BIND 9 and Solaris SMF
+ I keep getting log messages like the following. Why?
+ </para>
+ <para>
+ Dec 4 23:47:59 client 10.0.0.1#1355: updating zone
+ 'example.com/IN': update failed: 'RRset exists (value
+ dependent)' prerequisite not satisfied (NXRRSET)
+ </para>
+ </question>
+ <answer>
+ <para>
+ DNS updates allow the update request to test to see if
+ certain conditions are met prior to proceeding with the
+ update. The message above is saying that conditions were
+ not met and the update is not proceeding. See doc/rfc/rfc2136.txt
+ for more details on prerequisites.
+ </para>
+ </answer>
+ </qandaentry>
+
+ <qandaentry>
+ <question>
+ <para>
+ I keep getting log messages like the following. Why?
+ </para>
+ <para>
+ Jun 21 12:00:00.000 client 10.0.0.1#1234: update denied
+ </para>
+ </question>
+ <answer>
+ <para>
+ Someone is trying to update your DNS data using the RFC2136
+ Dynamic Update protocol. Windows 2000 machines have a habit
+ of sending dynamic update requests to DNS servers without
+ being specifically configured to do so. If the update
+ requests are coming from a Windows 2000 machine, see
+ <ulink
+ url="http://support.microsoft.com/support/kb/articles/q246/8/04.asp">
+ http://support.microsoft.com/support/kb/articles/q246/8/04.asp
+ </ulink>
+ for information about how to turn them off.
+ </para>
+ </answer>
+ </qandaentry>
+
+ <qandaentry>
+ <question>
+ <para>
+ When I do a "dig . ns", many of the A records for the root
+ servers are missing. Why?
+ </para>
+ </question>
+ <answer>
+ <para>
+ This is normal and harmless. It is a somewhat confusing
+ side effect of the way BIND 9 does RFC2181 trust ranking
+ and of the efforts BIND 9 makes to avoid promoting glue
+ into answers.
+ </para>
+ <para>
+ When BIND 9 first starts up and primes its cache, it receives
+ the root server addresses as additional data in an authoritative
+ response from a root server, and these records are eligible
+ for inclusion as additional data in responses. Subsequently
+ it receives a subset of the root server addresses as
+ additional data in a non-authoritative (referral) response
+ from a root server. This causes the addresses to now be
+ considered non-authoritative (glue) data, which is not
+ eligible for inclusion in responses.
+ </para>
+ <para>
+ The server does have a complete set of root server addresses
+ cached at all times, it just may not include all of them
+ as additional data, depending on whether they were last
+ received as answers or as glue. You can always look up the
+ addresses with explicit queries like "dig a.root-servers.net A".
+ </para>
+ </answer>
+ </qandaentry>
+
+ <qandaentry>
+ <question>
+ <para>
+ Why don't my zones reload when I do an "rndc reload" or SIGHUP?
+ </para>
+ </question>
+ <answer>
+ <para>
+ A zone can be updated either by editing zone files and
+ reloading the server or by dynamic update, but not both.
+ If you have enabled dynamic update for a zone using the
+ "allow-update" option, you are not supposed to edit the
+ zone file by hand, and the server will not attempt to reload
+ it.
+ </para>
+ </answer>
+ </qandaentry>
+
+ <qandaentry>
+ <question>
+ <para>
+ Why is named listening on UDP port other than 53?
+ </para>
+ </question>
+ <answer>
+ <para>
+ Named uses a system selected port to make queries of other
+ nameservers. This behaviour can be overridden by using
+ query-source to lock down the port and/or address. See
+ also notify-source and transfer-source.
+ </para>
+ </answer>
+ </qandaentry>
+
+ <qandaentry>
+ <question>
+ <para>
+ I get warning messages like <quote>zone example.com/IN: refresh:
+ failure trying master 1.2.3.4#53: timed out</quote>.
+ </para>
+ </question>
+ <answer>
+ <para>
+ Check that you can make UDP queries from the slave to the master
+ </para>
+ <informalexample>
+ <programlisting>
+dig +norec example.com soa @1.2.3.4</programlisting>
+ </informalexample>
+ <para>
+ You could be generating queries faster than the slave can
+ cope with. Lower the serial query rate.
+ </para>
+ <informalexample>
+ <programlisting>
+serial-query-rate 5; // default 20</programlisting>
+ </informalexample>
+ </answer>
+ </qandaentry>
+
+ <qandaentry>
+ <question>
+ <para>
+ I don't get RRSIG's returned when I use "dig +dnssec".
</para>
</question>
<answer>
<para>
- Sun has a blog entry describing how to do this.
- </para>
- <para>
- <ulink
- url="http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris">
- http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris
- </ulink>
+ You need to ensure DNSSEC is enabled (dnssec-enable yes;).
</para>
</answer>
</qandaentry>
-
+
<qandaentry>
<question>
<para>
</para>
</answer>
</qandaentry>
+
+ <qandaentry>
+ <question>
+ <para>
+ Will named be affected by the 2007 changes to daylight savings
+ rules in the US.
+ </para>
+ </question>
+ <answer>
+ <para>
+ No, so long as the machines internal clock (as reported
+ by "date -u") remains at UTC. The only visible change
+ if you fail to upgrade your OS, if you are in a affected
+ area, will be that log messages will be a hour out during
+ the period where the old rules do not match the new rules.
+ </para>
+ <para>
+ For most OS's this change just means that you need to
+ update the conversion rules from UTC to local time.
+ Normally this involves updating a file in /etc (which
+ sets the default timezone for the machine) and possibly
+ a directory which has all the conversion rules for the
+ world (e.g. /usr/share/zoneinfo). When updating the OS
+ do not forget to update any chroot areas as well.
+ See your OS's documentation for more details.
+ </para>
+ <para>
+ The local timezone conversion rules can also be done on
+ a individual basis by setting the TZ environment variable
+ appropriately. See your OS's documentation for more
+ details.
+ </para>
+ </answer>
+ </qandaentry>
+
+ </qandadiv> <!-- General Questions -->
+
+ <qandadiv><title>Operating-System Specific Questions</title>
+
+ <qandadiv><title>Linux</title>
+
+ <qandaentry>
+ <question>
+ <para>
+ Why do I get the following errors:
+<programlisting>general: errno2result.c:109: unexpected error:
+general: unable to convert errno to isc_result: 14: Bad address
+client: UDP client handler shutting down due to fatal receive error: unexpected error</programlisting>
+ </para>
+ </question>
+ <answer>
+ <para>
+ This is the result of a Linux kernel bug.
+ </para>
+ <para>
+ See:
+ <ulink url="http://marc.theaimsgroup.com/?l=linux-netdev&m=113081708031466&w=2">http://marc.theaimsgroup.com/?l=linux-netdev&m=113081708031466&w=2</ulink>
+ </para>
+ </answer>
+ </qandaentry>
+ <qandaentry>
+ <question>
+ <para>
+ Why do I see 5 (or more) copies of named on Linux?
+ </para>
+ </question>
+ <answer>
+ <para>
+ Linux threads each show up as a process under ps. The
+ approximate number of threads running is n+4, where n is
+ the number of CPUs. Note that the amount of memory used
+ is not cumulative; if each process is using 10M of memory,
+ only a total of 10M is used.
+ </para>
+ <para>
+ Newer versions of Linux's ps command hide the individual threads
+ and require -L to display them.
+ </para>
+ </answer>
+ </qandaentry>
+
+ <qandaentry>
+ <question>
+ <para>
+ Why does BIND 9 log <quote>permission denied</quote> errors accessing
+ its configuration files or zones on my Linux system even
+ though it is running as root?
+ </para>
+ </question>
+ <answer>
+ <para>
+ On Linux, BIND 9 drops most of its root privileges on
+ startup. This including the privilege to open files owned
+ by other users. Therefore, if the server is running as
+ root, the configuration files and zone files should also
+ be owned by root.
+ </para>
+ </answer>
+ </qandaentry>
+
+ <qandaentry>
+ <question>
+ <para>
+ I get the error message <quote>named: capset failed: Operation
+ not permitted</quote> when starting named.
+ </para>
+ </question>
+ <answer>
+ <para>
+ The capability module, part of "Linux Security Modules/LSM",
+ has not been loaded into the kernel. See insmod(8).
+ </para>
+ </answer>
+ </qandaentry>
+
<qandaentry>
<question>
<para>
</para>
</answer>
</qandaentry>
-
- <qandaentry>
- <question>
- <para>
- I want to forward all DNS queries from my caching nameserver to
- another server. But there are some domains which have to be
- served locally, via rbldnsd.
- </para>
- <para>
- How do I achieve this ?
- </para>
- </question>
- <answer>
- <programlisting>
-options {
- forward only;
- forwarders { <ip.of.primary.nameserver>; };
-};
-
-zone "sbl-xbl.spamhaus.org" {
- type forward; forward only;
- forwarders { <ip.of.rbldns.server> port 530; };
-};
-
-zone "list.dsbl.org" {
- type forward; forward only;
- forwarders { <ip.of.rbldns.server> port 530; };
-};
- </programlisting>
- </answer>
- </qandaentry>
-
+
+ </qandadiv> <!-- Linux -->
+
+ <qandadiv><title>Windows</title>
+
<qandaentry>
<question>
<para>
- Will named be affected by the 2007 changes to daylight savings
- rules in the US.
+ Zone transfers from my BIND 9 master to my Windows 2000
+ slave fail. Why?
</para>
</question>
<answer>
<para>
- No, so long as the machines internal clock (as reported
- by "date -u") remains at UTC. The only visible change
- if you fail to upgrade your OS, if you are in a affected
- area, will be that log messages will be a hour out during
- the period where the old rules do not match the new rules.
- </para>
- <para>
- For most OS's this change just means that you need to
- update the conversion rules from UTC to local time.
- Normally this involves updating a file in /etc (which
- sets the default timezone for the machine) and possibly
- a directory which has all the conversion rules for the
- world (e.g. /usr/share/zoneinfo). When updating the OS
- do not forget to update any chroot areas as well.
- See your OS's documentation for more details.
- </para>
- <para>
- The local timezone conversion rules can also be done on
- a individual basis by setting the TZ environment variable
- appropriately. See your OS's documentation for more
- details.
+ This may be caused by a bug in the Windows 2000 DNS server
+ where DNS messages larger than 16K are not handled properly.
+ This can be worked around by setting the option "transfer-format
+ one-answer;". Also check whether your zone contains domain
+ names with embedded spaces or other special characters,
+ like "John\032Doe\213s\032Computer", since such names have
+ been known to cause Windows 2000 slaves to incorrectly
+ reject the zone.
</para>
</answer>
</qandaentry>
-
+
<qandaentry>
<question>
<para>
- Why do we get the following warning at run time:
-<programlisting>kernel: process `named' is using obsolete setsockopt SO_BSDCOMPAT</programlisting>
+ I get <quote>Error 1067</quote> when starting named under Windows.
</para>
</question>
<answer>
<para>
- The early Linux kernels broke sendto() by having it return
- that a ICMP unreachable had be received for non connected
- UDP sockets. This made non connected UDP sockets work like
- connected UDP socket which is fine when you are only talking
- to one destination. Named however talks to multiple
- destinations and it caused problems.
- </para>
- <para>
- Rather than fix sendto() to just have BSD behaviour they added
- SO_BSDCOMPAT to turn BSD behaviour on/off on a per socket basis.
- </para>
- <para>
- Later they decided to make BSD behaviour the default and
- to aggressively track down applications that used SO_BSDCOMPAT
- by issuing a warning. This is the sort of things vendors
- do in alpha/beta stages of a release so that their code is
- clean. They then turn the warning *off* for release code.
- </para>
- <para>
- We still have customers that have kernels that require
- SO_BSDCOMPAT to operate. We therefore cannot remove the
- setsockopt(SO_BSDCOMPAT) call.
- </para>
- <para>
- Now most/all portable applications that use SO_BSDCOMPAT use it
- conditionally manner so just removing SO_BSDCOMPAT from the
- header file would be safe as long as the binary was not to
- be moved between systems. BIND's use is conditional.
+ This is the service manager saying that named exited. You
+ need to examine the Application log in the EventViewer to
+ find out why.
</para>
<para>
- In short, the Linux developers should either, remove the #define for
- SO_BSDCOMPAT, and/or remove the warning.
+ Common causes are that you failed to create "named.conf"
+ (usually "C:\windows\dns\etc\named.conf") or failed to
+ specify the directory in named.conf.
</para>
+ <informalexample>
+ <programlisting>
+options {
+ Directory "C:\windows\dns\etc";
+};</programlisting>
+ </informalexample>
</answer>
</qandaentry>
-
+
+ </qandadiv> <!-- Windows -->
+
+ <qandadiv><title>FreeBSD</title>
+
<qandaentry>
<question>
<para>
- Isn't "make install" supposed to generate a default named.conf?
+ I have FreeBSD 4.x and "rndc-confgen -a" just sits there.
</para>
</question>
<answer>
<para>
- Short Answer: No.
- </para>
- <para>
- Long Answer: There really isn't a default configuration which fits
- any site perfectly. There are lots of decisions that need to
- be made and there is no consensus on what the defaults should be.
- For example FreeBSD uses /etc/namedb as the location where the
- configuration files for named are stored. Others use /var/named.
- </para>
- <para>
- What addresses to listen on? For a laptop on the move a lot
- you may only want to listen on the loop back interfaces.
+ /dev/random is not configured. Use rndcontrol(8) to tell
+ the kernel to use certain interrupts as a source of random
+ events. You can make this permanent by setting rand_irqs
+ in /etc/rc.conf.
</para>
+ <informalexample>
+ <programlisting>
+/etc/rc.conf
+rand_irqs="3 14 15"</programlisting>
+ </informalexample>
<para>
- Who do you offer recursive service to? Is there are firewall
- to consider? If so is it stateless or stateful. Are you
- directly on the Internet? Are you on a private network? Are
- you on a NAT'd network? The answers
- to all these questions change how you configure even a
- caching name server.
+ See also
+ <ulink url="http://people.freebsd.org/~dougb/randomness.html">
+ http://people.freebsd.org/~dougb/randomness.html
+ </ulink>
</para>
</answer>
</qandaentry>
-
+
+ </qandadiv> <!-- FreeBSD -->
+
+ <qandadiv><title>Solaris</title>
+
<qandaentry>
<question>
<para>
- Is it possible to configure BIND to redirect
- <quote>anything.domain.com</quote> to
- <quote>domain.com/anything</quote>?
+ How do I integrate BIND 9 and Solaris SMF
</para>
</question>
<answer>
<para>
- No. This mapping needs to be done in the HTTP server using the
- <quote>Host: anything.domain.com</quote> header from HTTP 1.1.
- See your HTTP server documentation for how to do this.
+ Sun has a blog entry describing how to do this.
</para>
<para>
- You can however use wildcard records to map all the hostnames
- to the same addresses. e.g.
-<programlisting>* A 192.0.2.10
-* AAAA 2001:DB8:0:0:8:800:200C:417A</programlisting>
+ <ulink
+ url="http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris">
+ http://blogs.sun.com/roller/page/anay/Weblog?catname=%2FSolaris
+ </ulink>
</para>
</answer>
</qandaentry>
-
+
+ </qandadiv>
+
+ </qandadiv> <!-- Operating-System Specific Questions -->
</qandaset>
</article>
projects / thirdparty / bind9.git / commitdiff
