DNS & BIND 9 (Linuxhotel September 2026)

• what is your interest in DNS?
• what is your prior knowledge of DNS?
• what do you want to learn about DNS?

• User : user
• Password: DNSandBIND
• Root-Shell via sudo -s

• RFC 226 "STANDARDIZATION OF HOST MNEUMONICS" in 1971-09 was the first standardization of a naming convention for hosts on on the ARPANET.

• From 1970-1991 the Stanford Research Institution-Network Information Center was the information hub for the ARPANET including maintaining hosts.txt.
• The hosts.txt file
  • Contained IP addresses and names of all of the hosts on the Internet
  • Contained host information as well…
  • Produced twice per week and available via FTP
  • Changes, adds and deletes were sent via e-mail

• Problems with hosts.txt
  • Maintained by a single entity
  • Pulled (manually) from a single host
  • Namespace collisions
  • Consistency
• In 1983, it was determined that something had to be done

  	Davis Mills: RFC 799 (1981) - Internet Name Domains
  	Jon Postel & Zaw-Sing Su: RFC 819 (1982) - The Domain Naming Convention for Internet User Applications
  	Paul Mockapetris: RFC 882 & RFC 883 (1983) - DOMAIN NAMES - CONCEPTS and FACILITIES / DOMAIN NAMES - IMPLEMENTATION and SPECIFICATION

• RFC 882 was obsoleted by RFC 1034 (1987-11) and RFC 883 was obsoleted by RFC 1035 (1987-11)
  • RFC 1034: DOMAIN NAMES - CONCEPTS and FACILITIES
  • RFC 1035: DOMAIN NAMES - IMPLEMENTATION and SPECIFICATION (both: Paul Mockapetris)

• HOSTS.TXT was monolithic, one large file
• The DNS system is hierarchical
• parts of the name space are delegated to the owners of the name
• every owner controls the part of the name space she is owning
• every owner can sub-delegate downwards
• delegation goes from parent domain to child domain
• owner of parent domain can revoke delegation (and re-delegate to a different owner)

• The DNS delegation in the Internet has a specific structure. Other DNS systems (like the DNS used in mobile phone roaming, or local private DNS systems) can have different delegation rules
• RFC 920 defined the original structure of DNS delegation from the root zone

• DNS Query - what the client sends

• DNS Name Resolution

• DNS Resolver caching

• NXDOMAIN - the domain name does not exist.
• NOERROR/NODATA - the domain name exists, but not the RR type. AKA: NOERROR/NOANSWER.
• For NXDOMAIN and NOERROR/NODATA, the zone's SOA is returned in the authoritative section.
• The negative TTL is the minimum of SOA's TTL and the SOA's RDATA MIN field. (RFC 2308)
• BIND's default max-ncache-ttl is 10800 seconds (3 hrs).

• DNS Data is stored and sent in units of "DNS resource records" (or DNS RR)

• The fields of DNS resource records
  • owner: the domain name that owns the data. This is the index to the DNS database
  • TTL: the Time-to-Live, the time in seconds that this DNS data is guaranteed to be valid. This is used to timeout data in caches. It is also sometimes used by applications.
  • Class: The network infrastructure this data is useful in. In TCP/IP networks, this is typically IN for Internet protocol.
  • Type: The type of data, it can be A for IPv4 Address records, AAAA for IPv6 Addresses, TXT for free form text, NS for nameserver entries and many more
  • RData: record data, the data that is attached to the domain name. Depending on the type of record, the RData can have one to many fields
• we find DNS resource records
  • in DNS zone database files on authoritative DNS servers
  • in the caches of DNS resolver servers
  • in the output of a DNS query and troubleshooting tools
• on the wire, the data is transported in binary form (non readable for humans)
• DNS tools convert the DNS resource records from binary form into text form for human consumption

• A Resource Record Set (RRSet) is all RRs with identical: owner name, network class, TTL, and record type
• Each RR of a RRSet has different RDATA.
• A RRSet is not-explicit, and the RRs do not have to be contiguous in the zone file.
• All RRs in a RRSet are sent in a query response.
  • They may be returned in any order.
• The TTLs of all RRs in a RRSet must be identical.
  • Otherwise caching can lead to a single point of failure.
  • BIND enforces this by using the first seen TTL of the RRs.
• A valid DNS resource record set

• An invalid DNS resource record set (different TTLs, duplicate record data)

• A zone must have:
  • one SOA record
  • at least one NS record
• We’ll show all RRs in their complete form.

• A SOA RR defines configurations parameters for a zone.
• The owner name of a SOA RR matches the zone's name.
• The SOA must be the first RR in a zone file.
• The SOA is an internal RR that exists for DNS' own functionality.
• Four SOA RDATA fields are information for secondaries.
• One RDATA field is for resolvers.

dnslab.org. 86400 IN SOA (
   dns1.dnslab.org.            ; MNAME: primary server
   hostmaster.dnslab.org.      ; RNAME: responsible person
   2018061901                  ; SERIAL
   900                         ; REFRESH
   300                         ; RETRY
   604800                      ; EXPIRE
   900 )                       ; negTTL (officially:MINIMUM)

• A Day in the Life of two DNS Servers

• TTLs and the SOA timers can be entered as scaled values in most modern authoritative servers.
  • An integer value followed by:
    • s, for seconds
    • m, for minutes
    • h, for hours
    • d, for days
    • w, for weeks
• Example:

  1w2d5h3m20s =
    1 week + 2 days + 5 hours + 3 minutes + 20 seconds =
    795,800 seconds
  

SOURCE: https://www.ripe.net/ripe/meetings/ripe-55/presentations/koch-ripe203bis.pdf

"These recommendations are aimed at small and stable DNS zones. There are many legitimate reasons to use different values…"

• Comments in master file format begin with a semicolon (;) and extend to the end of the line.
• Example:

  ; important router addresses
  router1.example.com.  3600 IN A 192.0.2.1   ; gateway1
  router2.example.com.  3600 IN A 192.0.2.100 ; tunnel GW
  

• A RR must be written on one line.
• Records can be written over multiple lines using parentheses.
• The parentheses can be at any whitespace in the RR.
• The opening parenthesis must be on the first line.
• Example 1

  example.com.  86400  IN SOA  dns1.example.com. (
                           hostmaster.example.com.
                           2012111701  ; serial
                           86400       ; refresh
                           7200        ; retry
                           3600000     ; expire
                           3600 )      ; negTTL
  

• Example 2

  example.com. ( 86400  IN SOA  dns1.example.com.
                           hostmaster.example.com.
                           2012111701  ; serial
                           86400       ; refresh
                           7200        ; retry
                           3600000     ; expire
                           3600 )      ; negTTL
  

• Example 3

  example.com.  86400  IN SOA  ( dns1.example.com.
                           hostmaster.example.com.
                           2012111701 86400 7200
                           3600000 3600 )
  

• Example 4

  example.com.  86400  IN SOA ns1.test. admin.example. (
                      2012111701 86400 7200 3600000 3600 )
  

• BIND includes a tool to check a zone file for syntax errors and required missing data (e.g. no NS RR).
• It is recommended to always check a zone file and correct all errors before having named (re)load it.
• Syntax: named-checkzone <zonename> <filename>

  % named-checkzone example.com example.com.zonefile
  zone example.com/IN: loaded serial 2018072901  OK
  

• The NS record has two functions.
  • To define the authoritative servers for a zone.
  • To delegate to authoritative servers for a sub-domain.
• Like the SOA, the NS is an internal RR that exists for DNS' functionality.

• An A RR maps a domain name to an IPv4 address

  www.example.com.  86400 IN A 192.0.2.10
  

• One domain name can map to multiple A RRs.

  host.example.com.    3600 IN A 192.0.2.10
  host.example.com.    3600 IN A 10.0.10.2
  host.example.com.    3600 IN A 172.16.1.12
  

• The server returns all addresses (a RRSet).
• When a stub resolver returns multiple addresses to an application, the application should do something intelligent.
  • Many don’t :(

• The AAAA record maps a domain name to an IPv6 address

  www.example.com.  86400 IN AAAA 2001:db8:110:100:20:102f:ffeb:5380
  

• Many applications query for a AAAA RR before falling back to an A RR.
• When they get a response for the AAAA query, most will not try to lookup an IPv4 address.
• If the successfully resolved AAAA doesn't lead to an active server, an application will likely fail.
• So if a AAAA address exists, it must be available.
• The Happy Eyeball protocol addresses the problem when present: RFC 8305: Happy Eyeballs Version 2: Better Connectivity Using Concurrency

• The HTTPS record is a relativly new record. It's type number is 65 (aka TYPE65)
  • It has been first observed "in the wild" in Summer 2020
  • It is being used in the new Apple operating systems (iOS, iPadOS, macOS) since fall 2020
  • It is now the 3rd most queried DNS record in the Internet (after A and AAAA)
  • The HTTPS and SVCB records are discussed in RFC 9460 "Service binding and parameter specification via the DNS (DNS SVCB and HTTPS RRs)" https://datatracker.ietf.org/doc/html/rfc9460
• The HTTPS delivers connection information for an HTTPS service
  • IPv4-Addresses of the service
  • IPv6-Addresses of the server
  • The public key of the server to be used to initiate an encrypted TLS "client hello"
  • Protocol selection: HTTP/2 (TCP) or HTTP/3 (QUIC)
  • One or more DoH-Resolver for the service
• Example of a HTTPS Record for a service offering HTTP/2 and HTTP/3 (preferred)

example.com 3600 IN HTTPS 1 . alpn=”h3,h2”

• Example of a HTTPS Record for a service with both IPv4 and IPv6 Addresses

example.com 3600 IN HTTPS 1 . alpn=”h3,h2” ipv4hint=”192.0.2.1” ipv6hint=”2001:db8::1”

• Benefits of the HTTPS records
  • Browser don't need to request explicit IPv6 and IPv4 Addresses (faster connection)
  • The HTTPS Records is a signal to the web-browser to only allow TLS secured/encrypted connections for this domain name. This prevents downgrade attacks
  • With the HTTPS Record it is possible to create Domain-Alias definitions for whole zones (not possible with the CNAME Record)
• The BIND 9 DNS server and tools (dig, host) support the HTTPS record since version 9.16.21 (September 2021)