Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND, which is used on the majority of name servers on the Internet, provides a robust stable system upon which an organization's naming architecture can be built. This FAQ pertains to the ISC Open Source Distribution of BIND which was developed and maintained by Nominum, Inc. under contract to the Internet Software Consortium.
BIND is distributed in source form. You can find information and the current versions of BIND at http://www.isc.org/products/BIND/.
A list of ftp servers that mirror BIND and other ISC maintained Open
Source software can be found at
ftp://ftp.isc.org/isc/MIRRORS.
Go back to the FAQ index
Download the source to a empty directory. You can also download the
documentation and contributed bundles as well if you want.
Next, you need to unzip and untar the distribution bundle(s).
gunzip < bind-src.tar.gz | tar xf -
Next, you need to compile and install the software. See src/INSTALL for
instructions. Prior to installation backup the system as installation may
overwrite the old binaries; this is system dependent.
If you are converting from BIND 4, you will need to convert the
configuration file named.boot to the new syntax. A conversion program is
included.
named-bootconf < /etc/named.boot >
/etc/named.conf
Also, if you are converting from BIND 4 the system startup scripts will
need to be modified to look for /etc/named.conf rather than
/etc/named.boot.
Next, you need to stop the old named and start the new one.
kill -TERM < named PID >
ndc start
Check the system log (on most Unix systems, it is in /var/adm/messages
for errors) as the current version is less tolerant of errors than
earlier versions.
Go back to the FAQ index
The most recent BIND port to NT can be found in the 8.2.2p5 source
at ftp://ftp.isc.org/isc/bind/src/8.2.2-P5/bind-src.tar.gz.
You should be able to unzip/untar the 8.2.2p5 file using WinZip. Once
the source is unzipped, you'll find the NT port in the src/port/winnt
directory. You need Visual
C++ 6.0 to compile the NT port.
Go back to the FAQ index
Start at
http://www.isc.org/products/BIND/.
There is a mailing list available for BIND users. Subscribe using the form
at
http://www.isc.org/services/public/lists/bind-lists.html.
Before you post your question to the mailing list, please
check the mailing list archives to see if your question has already been
answered. The searchable archives for the bind-users mailing list are
available at
http://www.isc.org/ml-archives/bind-users/.
The bind-users mailing list is bidirectionally gatewayed to the moderated
Usenet newsgroup comp.protocols.dns.bind. You can search the
comp.protocols.dns.bind newsgroup at
http://www.deja.com/.
The BIND "bible" is DNS and BIND, Third Edition by Paul Albitz and Cricket Liu.
Go back to the FAQ index
The latest version of BIND addresses bugs and/or vulnerabilities found in previous versions.
Go back to the FAQ index
There are several ways to determine which version of BIND you are
using. Please note that some are specific to a particular operating
system, while others won't work with versions of BIND that are older than
4.9.5. We have indicated the limitations with the descriptions that
follow.
- The easiest way to tell the version number is to look for the message
that named puts in the system log file on startup. For example:
Jul 14 12:54:21 ns named[15677]: starting. named 8.2.2-P5
Jul 14 12:54:21 hostmaster@ns1.nominum.com:/usr/sbin/named
- The "-v" switch with named will display the version:
# named -v
named 8.2.2-P5 Thu Jul 20 17:19:57 PDT 2000
hostmaster@ns1.nominum.com:/usr/sbin/named
- The BIND name daemon control interface program can provide version
information when used with newer versions of BIND:
ndc status
- The Source Code Control System (SCCS) "what" command provides
identifying information on files.
what <your-path-to>/named
The following commands will work when checking a server running a
version of BIND that is 4.9.5 or greater. Both of these programs are
included in the BIND distribution.
- nslookup
# nslookup
Default Server: ns.yourco.bogus
Address: 333.333.333.333
> set class=chaos
> set type=txt
> version.bind
Server: ns.yourco.bogus
Address: 333.333.333.333
VERSION.BIND text = "8.2.2-P5"
>
- dig
dig version.bind txt chaos @ server name
or
dig @ server name txt chaos version.bind
Go back to the FAQ index
Since BIND 8.2, you need a $TTL directive to set the default TTL for the
zone. Add a '$TTL XXXXXX' directive prior to the SOA record for the zone.
(XXXXXX denotes the default TTL in seconds.)
Go back to the FAQ index
Hostnames can contain letters, numbers, and hyphens, and may not start
with a hyphen. Underscore (_) is not a valid character in a
hostname. While there are some DNS server software packages available that
allow underscore within published host names, most do not. Using a
domain or host name with an underscore will cause most name servers on the
Internet to stop recognizing the related host/IP address.
Go back to the FAQ index
This usually happens when there is an error detected in the zone
files. Check syslog 'messages' to verify the error.
Go back to the FAQ index
Whenever you make a change to your zone file, like when adding or changing
a host entry, you must also update the zone's SOA record's file version,
or "serial number" because the name servers retrieving information from
your server need to know there's been a modification. If the version
number hasn't been changed since the last query, no updates will
populate. Example below:
; foo.com.
$TTL 14400
@ IN SOA
someplace.foo.com. admin.foo.com. (
1 ; this file's version -- change
43200 ; refresh twice a day
1800 ; retry refresh every 15 minutes
604800 ; expire after 1000 hours (over week)
259200 ) ; minimum TTL of 3 day
Obviously the line with the 'file's version' that we want. The version
sequence can be anything; 1, 2, 3, 4, or 2001, 2002, 2003, etc. The only
limit is the version number can't be more than 10 digits long. In this
example, if you make any changes to the zone file, you need to change the
version number to '2'.
Go back to the FAQ index
There are no name server entries in the /etc/resolv.conf
Go back to the FAQ index
A "lame server" is a server that does not believe is it authoritative
for a domain which has been delegated to it. The "lame server" messages
can be useful if you have the lame server, or are a domain delegated
to the lame server.
If you would rather not see the "lame server" messages, you can
discard them using the logging statement:
logging {
category
lame-servers{ null; };
};
Go back to the FAQ index
BIND by default checks all records to ensure that only hostnames are used
where hostnames are expected to prevent accidental interoperability
problems.
Microsoft Windows 2000 uses a subzone called "_msdcs" to hold the Active
Directory data. While this subzone cannot clash with any legal hostname
it also makes it impossible to put hosts within this subzone without using
an illegal name. The use of such hostnames will be rejected, by default,
by BIND.
The Active Directory wants to have its "global catalog" server within
_msdcs (e.g. gc._msdcs.example.com) which will be rejected by default.
To work around this issue we recommend that the Active Directory be a
seperate zone (e.g. "_msdcs.example.com") configured to not check for
illegal hostnames. This should be reasonable as the Window 2000 servers
create this data and should not have interoperability problems with other
Windows 2000 machines wanting to access this data.
e.g.
zone "_msdcs.example.com" {
type master;
file "_msdcs.example.db";
check-names ignore;
allow-update { localnets; };
};
Go back to the FAQ index
A TSIG (or Transaction Signature) key provides a means to authenticate and verify the validity of DNS data
exchanged, using a secret key between a resolver and server or two servers.
Go back to the FAQ index
First you will need to generate a TSIG key (we will use tsig-key as
the key's file name) using the command:
dnskeygen -H 128 -h -n tsig-key.
This will generate key pair files:
'Ktsig-key.+157+00000.key' , which is an ASCI file that contains the
line:
tsig-key. IN KEY 513 3 157 awwLOtRfpGE+rRKF2+DEiw==
and
'Kvip-key.+157+00000.private' , which contains:
Private-key-format: v1.2
Algorithm: 157 (HMAC)
Key: awwLOtRfpGE+rRKF2+DEiw==
You'll need to take the base64 encoded key awwLOtRfpGE+rRKF2+DEiw==
and use it in configuring your servers named setting. For example:
key tsig-key. { algorithm hmac-md5; secret
"awwLOtRfpGE+rRKF2+DEiw=="; };
zone "ddns.dregis.com" {
...
...
allow-update { key tsig-key. ; };
}
Remember to restart named after that.
Then, you will need to copy both key files into a location on the client
system. (using /var/named/tsig as example). Finally, you need to run the
command:
nsupdate -k /var/named/tsig:tsig-key.
Go back to the FAQ index
The forwarder lines tell the server to forward all queries for which it doesn't
have authoritative or cached data to another name server.
Go back to the FAQ index
BIND 8.2.2-P7 incorrectly allowed the SOA record to continue onto the next line
without seeing a opening bracket '(' which indicates that the SOA record continues
over multiple lines. BIND 8.2.3 and BIND 9 correctly treat such records as broken.
The opening bracket has to be on the first line of the record.
For example
@ SOA ns1 root.ns1 (
2001012900 3600 1200 360000 7200 )
Go back to the FAQ index
Yes. The notifies are sent by slaves so that "slaves off slaves" receive
NOTIFY messages by default. If you have no "slaves off slaves" you may
disable the feature at the zone level by "notify no;".
Go back to the FAQ index
| 
