0

I am setting up a DNS(Bind) server and by default the /etc/named.conf has the following entries:

zone "." IN {
        type hint;
        file "named.root";
};

zone "localdomain." IN {
        type master;
        file "localdomain.zone";
        allow-update { none; };
};

zone "localhost." IN {
        type master;
        file "localhost.zone";
        allow-update { none; };
};

zone "255.in-addr.arpa." IN {
        type master;
        file "named.broadcast";
        allow-update { none; };
};

zone "0.in-addr.arpa." IN {
        type master;
        file "named.zero";
        allow-update { none; };
};

When I tried to start named, it fails because these 5 files (named.root, named.zero, named.broadcast, localhost.zone and localdomain.zone) does not exist anywhere on this server. So I removed these entries and named started fine and its running. DNS is working as expected. I did a bit of research and came to know that these files are used for resolving localhost domains. I checked couple of other DNS server and saw that these files basically has A and NS records pointed to the localhost. My questions are:

  • Is it okay if I keep running this DNS on our production environment without these files? What are the side-effects?

  • I have named.ca in the server, but no named.root. I checked another DNS server (where both these files exist) and saw that they have the same contents (records pointed to root nameservers. Am I okay with having only named.ca since it has the root nameserver entries? Is named.root a deprecated version of named.ca ?

  • I have no forwarders set up in named.conf, but external domains are all resolving fine. Should I still need some kind of forwarders? Some of our other older DNS server has the forwarder set up that points to rackspace where we have our servers.

  • @Braiam I know why named wasn't starting. My questions are different. I think your edit isn't reflecting the body of the question. – Sree Nov 6 '14 at 16:33
1

First of all, if your distribution supplied or installed a default named.conf file that references those zone files, they should definitely exist on your system. Maybe you should reinstall the package? (or did you install from source?)

If your DNS server is authoritative only

(You are talking about resolving external domains so I don't think this is the case.)

You absolutely don't need the "placeholder" zones "localhost", "localdomain", "0.in-addr.arpa", and "255.in-addr.arpa". They will never get queried.

I'm not sure about the root hints zone. I wonder if BIND might not still use it even in an authoritavive only configuration. I would err on the side of leaving it in.

If your DNS server has recursion enabled

You really need the root hints zone. BIND has built-in defaults, which is why it's still working for you even without it, but the root hints information does change from time to time, and the built-in hints can get out of date. Even though it's very unlikely that the root hints change so much that there is no longer any overlap between the built-in hints and the current root server locations and your server starts failing, you should still have a root hints file and keep it up to date on a (very) occasional basis.

As for the other placeholder zones, nothing will go wrong if you don't have them, but it means that if your server gets "garbage" queries for names under these domains, it will forward them to the Internet whereas with the placeholder zones it could have produced negative answers much more quickly.

root hints filename

Regarding your second question about the root hints filename, it doesn't matter whether you call the file named.root or named.ca or anything else, just as long as you reference it in named.conf using the correct filename. The root hints do not change very often, which is why you noticed another server has an identical copy.

As explained above, you should use the root hints file rather than relying on the compiled-in defaults.

Forwarders

You can configure forwarders if you want. It will keep a small amount of traffic off the root servers and directly it to your upstream servers instead, but this isn't a big deal for a handful of servers. The efforts of configuring forwarders, keeping them up to date, and the risk of having your server fail if the forwarders fail is usually not worth it. If you are managing hundreds or thousands of servers, or if your are creating a default configuration for use on end-user systems then I would definitely consider it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.