Login or Register to Ask a Question and Join Our Community

Sponsored Content
Full Discussion: DNS Cache-Only Config Advice
Special Forums IP Networking DNS Cache-Only Config Advice Post 302356460 by danny.hudson on Friday 25th of September 2009 03:35:51 PM
Old 09-25-2009
DNS Cache-Only Config Advice
Hi Chaps and Chappettes,

I've had a short period of time recently to learn and implement DNS cache-only in our organisation. Trouble is, according to my tcpdumps, the amount of traffic on port 53 has increased. This is of course the exact opposit of the desired effect. Would y'all mind looking over my config?

FYI, the machine is an Exim MTA handling mail traffic. There are 2 internal and 2 external DNS servers as well as this machine. resolv.conf is pointed to local. Stuff I dig appears in the cache dump. I'm not sure if I should have the zone specified as there is no zonefile on this machine, but it did seem to get the internal traffic going again.

RHEL 5 2.6.18-128.1.6.el5PAE
BIND 9.3.4-10.P1.el5

Many, many thanks for any help.

named.conf:
Code:
options {
  forwarders { ip_of_external_1; ip_of_external_2; };
  forward first;
  directory "/var/named" ;
  dump-file "dump/named_dump.db";
  allow-query { any; };
  allow-recursion { any; };
  allow-transfer { none; };
  allow-notify { none; };
  listen-on-v6 { none; };
  recursive-clients 3500;
  version none;
  zone-statistics yes;
  notify no;
  auth-nxdomain no;
  };

logging{
  channel simple_log {
    file "named.log" versions 3 size 5m;
    severity dynamic;
    print-time yes;
    print-severity yes;
    print-category yes;
  };
  category default{
    simple_log;
  };
  category lame-servers {
    null;
  };
};

zone "orgname.com" {
        type forward;
        forwarders { ip_of_internal_1; 2ip_of_internal_2; ip_of_internal_1_service_ip; ip_of_internal_2_service_ip; };
};

zone "0.0.127.in-addr.arpa" {
        type master;
        file "db.127.0.0";
};

db.127.0.0:
Code:
$TTL 345600
@               IN      SOA     localhost. root.localhost.      (
                                00      ; Serial
                                86400   ; Refresh
                                7200    ; Retry
                                2592000 ; Expire
                                345600) ; Minimum

                IN      NS      localhost.
1               IN      PTR     localhost.

 

7 More Discussions You Might Find Interesting

1. Solaris

DHCP DNS Config

I'm running Solaris 9 and I need my box to request it's DNS servers off a DHCP server - can I do this? (1 Reply)
Discussion started by: Jdogg
1 Replies

2. Ubuntu

Linux Redhat ES 4.0 - DNS Config Issues

Hello all, I've a very strange thing hapenning in my Sys, I've configured the IP, DNS eveything for my internat connection, but Im only able to browse Redhat.com websites. I cant open anyother site!!! :eek: Im sure the internet is configured 'coz it displays the list of avail updates for... (11 Replies)
Discussion started by: AbhijithS
11 Replies

3. Cybersecurity

Dns cache poisoning upgrade to bind9.5.0p2

Hi again guys, It seems this is a global thing affecting all the DNS bind versions prior to July 28 2008. I have my work cut out for me very soon, I see at least a handful of servers in my list that either need to patching or upgrading. How many of you guys are affected? Anybody successfully... (4 Replies)
Discussion started by: sparcguy
4 Replies

4. Red Hat

Path of the DNS Cache file

We have a DNS server that is only using as a cache DNS of parent server. I wonder where it the cache file that it created from parent DNS? Please tell me where will be the cache file? (0 Replies)
Discussion started by: abhilashkrishn
0 Replies

5. Solaris

DNS Cache Problem-Urgent !!!!!!

I have DNS Server running in solaris 10 . There is website called exaple.com ,whcih was hosted in this dns server with IP 1.2.3.4 ,now we deleted the DNS entry of that website from our DNS Server (db.exmaple.com is deleted from named.conf ) and it is hosted with some other name server with IP... (1 Reply)
Discussion started by: sandeep.tk
1 Replies

6. IP Networking

How to add intranet sites to DNS cache?

Hi all, I'm hosting a site for my team in my LAN, for which my team mates should type my hosting server IP address in the web browser, example: http://192.168.134.213:78/testteam/ This is really hectic to type the ip address always, is there anyway where i can create a site name mapping to... (7 Replies)
Discussion started by: Arun_Linux
7 Replies

7. IP Networking

DNS config preventing mail delivery

Hi Please can you help on this: the Net Admins decided to use DNS to resolve names, so this is preventing mail being delivered when using commands like date | mailx -s "test" abc.xyz@asdf.xx.yy. What we were asked was to edit /etc/resolv.confand add 3 entries, in all servers (10 Replies)
Discussion started by: fretagi
10 Replies

LEARN ABOUT OPENDARWIN

named.conf

NAMED.CONF(5)                                                          BIND9                                                         NAMED.CONF(5)

NAME

       named.conf - configuration file for named

SYNOPSIS

       named.conf

DESCRIPTION

       named.conf is the configuration file for named. Statements are enclosed in braces and terminated with a semi-colon. Clauses in the
       statements are also semi-colon terminated. The usual comment styles are supported:

       C style: /* */

       C++ style: // to end of line

       Unix style: # to end of line

ACL

           acl string { address_match_element; ... };

KEY

           key domain_name {
                algorithm string;
                secret string;
           };

MASTERS

           masters string [ port integer ] {
                ( masters | ipv4_address [port integer] |
                ipv6_address [port integer] ) [ key string ]; ...
           };

SERVER

           server ( ipv4_address[/prefixlen] | ipv6_address[/prefixlen] ) {
                bogus boolean;
                edns boolean;
                edns-udp-size integer;
                max-udp-size integer;
                provide-ixfr boolean;
                request-ixfr boolean;
                keys server_key;
                transfers integer;
                transfer-format ( many-answers | one-answer );
                transfer-source ( ipv4_address | * )
                     [ port ( integer | * ) ];
                transfer-source-v6 ( ipv6_address | * )
                     [ port ( integer | * ) ];
                support-ixfr boolean; // obsolete
           };

TRUSTED-KEYS
           trusted-keys {
                domain_name flags protocol algorithm key; ...
           };

MANAGED-KEYS
           managed-keys {
                domain_name initial-key flags protocol algorithm key; ...
           };

CONTROLS

           controls {
                inet ( ipv4_address | ipv6_address | * )
                     [ port ( integer | * ) ]
                     allow { address_match_element; ... }
                     [ keys { string; ... } ];
                unix unsupported; // not implemented
           };

LOGGING

           logging {
                channel string {
                     file log_file;
                     syslog optional_facility;
                     null;
                     stderr;
                     severity log_severity;
                     print-time boolean;
                     print-severity boolean;
                     print-category boolean;
                };
                category string { string; ... };
           };

LWRES

           lwres {
                listen-on [ port integer ] {
                     ( ipv4_address | ipv6_address ) [ port integer ]; ...
                };
                view string optional_class;
                search { string; ... };
                ndots integer;
           };

OPTIONS

           options {
                avoid-v4-udp-ports { port; ... };
                avoid-v6-udp-ports { port; ... };
                blackhole { address_match_element; ... };
                coresize size;
                datasize size;
                directory quoted_string;
                dump-file quoted_string;
                files size;
                heartbeat-interval integer;
                host-statistics boolean; // not implemented
                host-statistics-max number; // not implemented
                hostname ( quoted_string | none );
                interface-interval integer;
                listen-on [ port integer ] { address_match_element; ... };
                listen-on-v6 [ port integer ] { address_match_element; ... };
                match-mapped-addresses boolean;
                memstatistics-file quoted_string;
                pid-file ( quoted_string | none );
                port integer;
                querylog boolean;
                recursing-file quoted_string;
                reserved-sockets integer;
                random-device quoted_string;
                recursive-clients integer;
                serial-query-rate integer;
                server-id ( quoted_string | none |;
                stacksize size;
                statistics-file quoted_string;
                statistics-interval integer; // not yet implemented
                tcp-clients integer;
                tcp-listen-queue integer;
                tkey-dhkey quoted_string integer;
                tkey-gssapi-credential quoted_string;
                tkey-gssapi-keytab quoted_string;
                tkey-domain quoted_string;
                transfers-per-ns integer;
                transfers-in integer;
                transfers-out integer;
                use-ixfr boolean;
                version ( quoted_string | none );
                allow-recursion { address_match_element; ... };
                allow-recursion-on { address_match_element; ... };
                sortlist { address_match_element; ... };
                topology { address_match_element; ... }; // not implemented
                auth-nxdomain boolean; // default changed
                minimal-responses boolean;
                recursion boolean;
                rrset-order {
                     [ class string ] [ type string ]
                     [ name quoted_string ] string string; ...
                };
                provide-ixfr boolean;
                request-ixfr boolean;
                rfc2308-type1 boolean; // not yet implemented
                additional-from-auth boolean;
                additional-from-cache boolean;
                query-source ( ( ipv4_address | * ) | [ address ( ipv4_address | * ) ] ) [ port ( integer | * ) ];
                query-source-v6 ( ( ipv6_address | * ) | [ address ( ipv6_address | * ) ] ) [ port ( integer | * ) ];
                use-queryport-pool boolean;
                queryport-pool-ports integer;
                queryport-pool-updateinterval integer;
                cleaning-interval integer;
                resolver-query-timeout integer;
                min-roots integer; // not implemented
                lame-ttl integer;
                max-ncache-ttl integer;
                max-cache-ttl integer;
                transfer-format ( many-answers | one-answer );
                max-cache-size size;
                max-acache-size size;
                clients-per-query number;
                max-clients-per-query number;
                check-names ( master | slave | response )
                     ( fail | warn | ignore );
                check-mx ( fail | warn | ignore );
                check-integrity boolean;
                check-mx-cname ( fail | warn | ignore );
                check-srv-cname ( fail | warn | ignore );
                cache-file quoted_string; // test option
                suppress-initial-notify boolean; // not yet implemented
                preferred-glue string;
                dual-stack-servers [ port integer ] {
                     ( quoted_string [port integer] |
                     ipv4_address [port integer] |
                     ipv6_address [port integer] ); ...
                };
                edns-udp-size integer;
                max-udp-size integer;
                root-delegation-only [ exclude { quoted_string; ... } ];
                disable-algorithms string { string; ... };
                dnssec-enable boolean;
                dnssec-validation boolean;
                dnssec-lookaside ( auto | no | domain trust-anchor domain );
                dnssec-must-be-secure string boolean;
                dnssec-accept-expired boolean;
                dns64-server string;
                dns64-contact string;
                dns64 prefix {
                     clients { <replacable>acl</replacable>; };
                     exclude { <replacable>acl</replacable>; };
                     mapped { <replacable>acl</replacable>; };
                     break-dnssec boolean;
                     recursive-only boolean;
                     suffix ipv6_address;
                };
                empty-server string;
                empty-contact string;
                empty-zones-enable boolean;
                disable-empty-zone string;
                dialup dialuptype;
                ixfr-from-differences ixfrdiff;
                allow-query { address_match_element; ... };
                allow-query-on { address_match_element; ... };
                allow-query-cache { address_match_element; ... };
                allow-query-cache-on { address_match_element; ... };
                allow-transfer { address_match_element; ... };
                allow-update { address_match_element; ... };
                allow-update-forwarding { address_match_element; ... };
                update-check-ksk boolean;
                dnssec-dnskey-kskonly boolean;
                masterfile-format ( text | raw );
                notify notifytype;
                notify-source ( ipv4_address | * ) [ port ( integer | * ) ];
                notify-source-v6 ( ipv6_address | * ) [ port ( integer | * ) ];
                notify-delay seconds;
                notify-to-soa boolean;
                also-notify [ port integer ] { ( ipv4_address | ipv6_address )
                     [ port integer ]; ... };
                allow-notify { address_match_element; ... };
                forward ( first | only );
                forwarders [ port integer ] {
                     ( ipv4_address | ipv6_address ) [ port integer ]; ...
                };
                max-journal-size size_no_default;
                max-transfer-time-in integer;
                max-transfer-time-out integer;
                max-transfer-idle-in integer;
                max-transfer-idle-out integer;
                max-retry-time integer;
                min-retry-time integer;
                max-refresh-time integer;
                min-refresh-time integer;
                multi-master boolean;
                sig-validity-interval integer;
                sig-re-signing-interval integer;
                sig-signing-nodes integer;
                sig-signing-signatures integer;
                sig-signing-type integer;
                transfer-source ( ipv4_address | * )
                     [ port ( integer | * ) ];
                transfer-source-v6 ( ipv6_address | * )
                     [ port ( integer | * ) ];
                alt-transfer-source ( ipv4_address | * )
                     [ port ( integer | * ) ];
                alt-transfer-source-v6 ( ipv6_address | * )
                     [ port ( integer | * ) ];
                use-alt-transfer-source boolean;
                zone-statistics boolean;
                key-directory quoted_string;
                managed-keys-directory quoted_string;
                auto-dnssec allow|maintain|create|off;
                try-tcp-refresh boolean;
                zero-no-soa-ttl boolean;
                zero-no-soa-ttl-cache boolean;
                dnssec-secure-to-insecure boolean;
                deny-answer-addresses {
                     address_match_list
                } [ except-from { namelist } ];
                deny-answer-aliases {
                     namelist
                } [ except-from { namelist } ];
                nsec3-test-zone boolean;  // testing only
                allow-v6-synthesis { address_match_element; ... }; // obsolete
                deallocate-on-exit boolean; // obsolete
                fake-iquery boolean; // obsolete
                fetch-glue boolean; // obsolete
                has-old-clients boolean; // obsolete
                maintain-ixfr-base boolean; // obsolete
                max-ixfr-log-size size; // obsolete
                multiple-cnames boolean; // obsolete
                named-xfer quoted_string; // obsolete
                serial-queries integer; // obsolete
                treat-cr-as-space boolean; // obsolete
                use-id-pool boolean; // obsolete
           };

VIEW

           view string optional_class {
                match-clients { address_match_element; ... };
                match-destinations { address_match_element; ... };
                match-recursive-only boolean;
                key string {
                     algorithm string;
                     secret string;
                };
                zone string optional_class {
                     ...
                };
                server ( ipv4_address[/prefixlen] | ipv6_address[/prefixlen] ) {
                     ...
                };
                trusted-keys {
                     string integer integer integer quoted_string;
                     [...]
                };
                allow-recursion { address_match_element; ... };
                allow-recursion-on { address_match_element; ... };
                sortlist { address_match_element; ... };
                topology { address_match_element; ... }; // not implemented
                auth-nxdomain boolean; // default changed
                minimal-responses boolean;
                recursion boolean;
                rrset-order {
                     [ class string ] [ type string ]
                     [ name quoted_string ] string string; ...
                };
                provide-ixfr boolean;
                request-ixfr boolean;
                rfc2308-type1 boolean; // not yet implemented
                additional-from-auth boolean;
                additional-from-cache boolean;
                query-source ( ( ipv4_address | * ) | [ address ( ipv4_address | * ) ] ) [ port ( integer | * ) ];
                query-source-v6 ( ( ipv6_address | * ) | [ address ( ipv6_address | * ) ] ) [ port ( integer | * ) ];
                use-queryport-pool boolean;
                queryport-pool-ports integer;
                queryport-pool-updateinterval integer;
                cleaning-interval integer;
                resolver-query-timeout integer;
                min-roots integer; // not implemented
                lame-ttl integer;
                max-ncache-ttl integer;
                max-cache-ttl integer;
                transfer-format ( many-answers | one-answer );
                max-cache-size size;
                max-acache-size size;
                clients-per-query number;
                max-clients-per-query number;
                check-names ( master | slave | response )
                     ( fail | warn | ignore );
                check-mx ( fail | warn | ignore );
                check-integrity boolean;
                check-mx-cname ( fail | warn | ignore );
                check-srv-cname ( fail | warn | ignore );
                cache-file quoted_string; // test option
                suppress-initial-notify boolean; // not yet implemented
                preferred-glue string;
                dual-stack-servers [ port integer ] {
                     ( quoted_string [port integer] |
                     ipv4_address [port integer] |
                     ipv6_address [port integer] ); ...
                };
                edns-udp-size integer;
                max-udp-size integer;
                root-delegation-only [ exclude { quoted_string; ... } ];
                disable-algorithms string { string; ... };
                dnssec-enable boolean;
                dnssec-validation boolean;
                dnssec-lookaside ( auto | no | domain trust-anchor domain );
                dnssec-must-be-secure string boolean;
                dnssec-accept-expired boolean;
                dns64-server string;
                dns64-contact string;
                dns64 prefix {
                     clients { <replacable>acl</replacable>; };
                     exclude { <replacable>acl</replacable>; };
                     mapped { <replacable>acl</replacable>; };
                     break-dnssec boolean;
                     recursive-only boolean;
                     suffix ipv6_address;
                };
                empty-server string;
                empty-contact string;
                empty-zones-enable boolean;
                disable-empty-zone string;
                dialup dialuptype;
                ixfr-from-differences ixfrdiff;
                allow-query { address_match_element; ... };
                allow-query-on { address_match_element; ... };
                allow-query-cache { address_match_element; ... };
                allow-query-cache-on { address_match_element; ... };
                allow-transfer { address_match_element; ... };
                allow-update { address_match_element; ... };
                allow-update-forwarding { address_match_element; ... };
                update-check-ksk boolean;
                dnssec-dnskey-kskonly boolean;
                masterfile-format ( text | raw );
                notify notifytype;
                notify-source ( ipv4_address | * ) [ port ( integer | * ) ];
                notify-source-v6 ( ipv6_address | * ) [ port ( integer | * ) ];
                notify-delay seconds;
                notify-to-soa boolean;
                also-notify [ port integer ] { ( ipv4_address | ipv6_address )
                     [ port integer ]; ... };
                allow-notify { address_match_element; ... };
                forward ( first | only );
                forwarders [ port integer ] {
                     ( ipv4_address | ipv6_address ) [ port integer ]; ...
                };
                max-journal-size size_no_default;
                max-transfer-time-in integer;
                max-transfer-time-out integer;
                max-transfer-idle-in integer;
                max-transfer-idle-out integer;
                max-retry-time integer;
                min-retry-time integer;
                max-refresh-time integer;
                min-refresh-time integer;
                multi-master boolean;
                sig-validity-interval integer;
                transfer-source ( ipv4_address | * )
                     [ port ( integer | * ) ];
                transfer-source-v6 ( ipv6_address | * )
                     [ port ( integer | * ) ];
                alt-transfer-source ( ipv4_address | * )
                     [ port ( integer | * ) ];
                alt-transfer-source-v6 ( ipv6_address | * )
                     [ port ( integer | * ) ];
                use-alt-transfer-source boolean;
                zone-statistics boolean;
                try-tcp-refresh boolean;
                key-directory quoted_string;
                zero-no-soa-ttl boolean;
                zero-no-soa-ttl-cache boolean;
                dnssec-secure-to-insecure boolean;
                allow-v6-synthesis { address_match_element; ... }; // obsolete
                fetch-glue boolean; // obsolete
                maintain-ixfr-base boolean; // obsolete
                max-ixfr-log-size size; // obsolete
           };

ZONE

           zone string optional_class {
                type ( master | slave | stub | hint |
                     forward | delegation-only );
                file quoted_string;
                masters [ port integer ] {
                     ( masters |
                     ipv4_address [port integer] |
                     ipv6_address [ port integer ] ) [ key string ]; ...
                };
                database string;
                delegation-only boolean;
                check-names ( fail | warn | ignore );
                check-mx ( fail | warn | ignore );
                check-integrity boolean;
                check-mx-cname ( fail | warn | ignore );
                check-srv-cname ( fail | warn | ignore );
                dialup dialuptype;
                ixfr-from-differences boolean;
                journal quoted_string;
                zero-no-soa-ttl boolean;
                dnssec-secure-to-insecure boolean;
                allow-query { address_match_element; ... };
                allow-query-on { address_match_element; ... };
                allow-transfer { address_match_element; ... };
                allow-update { address_match_element; ... };
                allow-update-forwarding { address_match_element; ... };
                update-policy local |  {
                     ( grant | deny ) string
                     ( name | subdomain | wildcard | self | selfsub | selfwild |
                             krb5-self | ms-self | krb5-subdomain | ms-subdomain |
                       tcp-self | zonesub | 6to4-self ) string
                     rrtypelist;
                     [...]
                };
                update-check-ksk boolean;
                dnssec-dnskey-kskonly boolean;
                masterfile-format ( text | raw );
                notify notifytype;
                notify-source ( ipv4_address | * ) [ port ( integer | * ) ];
                notify-source-v6 ( ipv6_address | * ) [ port ( integer | * ) ];
                notify-delay seconds;
                notify-to-soa boolean;
                also-notify [ port integer ] { ( ipv4_address | ipv6_address )
                     [ port integer ]; ... };
                allow-notify { address_match_element; ... };
                forward ( first | only );
                forwarders [ port integer ] {
                     ( ipv4_address | ipv6_address ) [ port integer ]; ...
                };
                max-journal-size size_no_default;
                max-transfer-time-in integer;
                max-transfer-time-out integer;
                max-transfer-idle-in integer;
                max-transfer-idle-out integer;
                max-retry-time integer;
                min-retry-time integer;
                max-refresh-time integer;
                min-refresh-time integer;
                multi-master boolean;
                sig-validity-interval integer;
                transfer-source ( ipv4_address | * )
                     [ port ( integer | * ) ];
                transfer-source-v6 ( ipv6_address | * )
                     [ port ( integer | * ) ];
                alt-transfer-source ( ipv4_address | * )
                     [ port ( integer | * ) ];
                alt-transfer-source-v6 ( ipv6_address | * )
                     [ port ( integer | * ) ];
                use-alt-transfer-source boolean;
                zone-statistics boolean;
                try-tcp-refresh boolean;
                key-directory quoted_string;
                nsec3-test-zone boolean;  // testing only
                ixfr-base quoted_string; // obsolete
                ixfr-tmp-file quoted_string; // obsolete
                maintain-ixfr-base boolean; // obsolete
                max-ixfr-log-size size; // obsolete
                pubkey integer integer integer quoted_string; // obsolete
           };

FILES

       /etc/named.conf

SEE ALSO

       named(8), named-checkconf(8), rndc(8), BIND 9 Administrator Reference Manual.

COPYRIGHT

       Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")

BIND9                                                              Aug 13, 2004                                                      NAMED.CONF(5)
All times are GMT -4. The time now is 07:26 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy