asda?‰PNG  IHDR ? f ??C1 sRGB ??é gAMA ±? üa pHYs ? ??o¨d GIDATx^íüL”÷e÷Y?a?("Bh?_ò???￠§?q5k?*:t0A-o??￥]VkJ￠M??f?±8\k2íll￡1]q?ù???T BIND 9 Administrator Reference Manual
BIND 9 Administrator Reference Manual
Next

BIND 9 Administrator Reference Manual

BIND Version 9.11.36

Copyright 2000-2021 Internet Systems Consortium, Inc. ("ISC")

Table of Contents

1. Introduction
Scope of Document
Organization of This Document
Conventions Used in This Document
The Domain Name System (DNS)
DNS Fundamentals
Domains and Domain Names
Zones
Authoritative Name Servers
Caching Name Servers
Name Servers in Multiple Roles
2. BIND Resource Requirements
Hardware requirements
CPU Requirements
Memory Requirements
Name Server-Intensive Environment Issues
Supported Operating Systems
3. Name Server Configuration
Sample Configurations
A Caching-only Name Server
An Authoritative-only Name Server
Load Balancing
Name Server Operations
Tools for Use With the Name Server Daemon
Signals
4. Advanced DNS Features
Notify
Dynamic Update
The Journal File
Incremental Zone Transfers (IXFR)
Split DNS
Example Split DNS Setup
TSIG
Generating a Shared Key
Loading a New Key
Instructing the Server to Use a Key
TSIG-Based Access Control
Errors
TKEY
SIG(0)
DNSSEC
Generating Keys
Signing the Zone
Configuring Servers for DNSSEC
DNSSEC, Dynamic Zones, and Automatic Signing
Converting from insecure to secure
Dynamic DNS Update Method
Fully Automatic Zone Signing
Private Type Records
DNSKEY Rollovers
Dynamic DNS Update Method
Automatic Key Rollovers
NSEC3PARAM Rollovers via UPDATE
Converting From NSEC to NSEC3
Converting From NSEC3 to NSEC
Converting From Secure to Insecure
Periodic Re-signing
NSEC3 and OPTOUT
Dynamic Trust Anchor Management
Validating Resolver
Authoritative Server
PKCS#11 (Cryptoki) Support
Prerequisites
Native PKCS#11
OpenSSL-based PKCS#11
PKCS#11 Tools
Using the HSM
Specifying the engine on the command line
Running named with automatic zone re-signing
DLZ (Dynamically Loadable Zones)
Configuring DLZ
Sample DLZ Driver
Dynamic Database (DynDB)
Configuring DynDB
Sample DynDB Module
Catalog Zones
Principle of Operation
Configuring Catalog Zones
Catalog Zone Format
IPv6 Support in BIND 9
Address Lookups Using AAAA Records
Address-to-Name Lookups Using Nibble Format
5. The BIND 9 Lightweight Resolver
The Lightweight Resolver Library
Running a Resolver Daemon
6. BIND 9 Configuration Reference
Configuration File Elements
Address Match Lists
Comment Syntax
Configuration File Grammar
acl Statement Grammar
acl Statement Definition and Usage
controls Statement Grammar
controls Statement Definition and Usage
include Statement Grammar
include Statement Definition and Usage
key Statement Grammar
key Statement Definition and Usage
logging Statement Grammar
logging Statement Definition and Usage
lwres Statement Grammar
lwres Statement Definition and Usage
masters Statement Grammar
masters Statement Definition and Usage
options Statement Grammar
options Statement Definition and Usage
server Statement Grammar
server Statement Definition and Usage
statistics-channels Statement Grammar
statistics-channels Statement Definition and Usage
trusted-keys Statement Grammar
trusted-keys Statement Definition and Usage
managed-keys Statement Grammar
managed-keys Statement Definition and Usage
view Statement Grammar
view Statement Definition and Usage
zone Statement Grammar
zone Statement Definition and Usage
Zone File
Types of Resource Records and When to Use Them
Discussion of MX Records
Setting TTLs
Inverse Mapping in IPv4
Other Zone File Directives
BIND Primary File Extension: the $GENERATE Directive
Additional File Formats
BIND 9 Statistics
The Statistics File
Statistics Counters
7. BIND 9 Security Considerations
Access Control Lists
Chroot and Setuid
The chroot Environment
Using the setuid Function
Dynamic Update Security
8. Troubleshooting
Common Problems
It's Not Working; How Can I Figure Out What's Wrong?
Incrementing and Changing the Serial Number
Where Can I Get Help?
A. Release Notes
Release Notes for BIND Version 9.11.36
Introduction
Download
License Change
Notes for BIND 9.11.36
Notes for BIND 9.11.35
Notes for BIND 9.11.34
Notes for BIND 9.11.33
Notes for BIND 9.11.32
Notes for BIND 9.11.31
Notes for BIND 9.11.30
Notes for BIND 9.11.29
Notes for BIND 9.11.28
Notes for BIND 9.11.27
Notes for BIND 9.11.26
Notes for BIND 9.11.25
Notes for BIND 9.11.24
Notes for BIND 9.11.23
Notes for BIND 9.11.22
Notes for BIND 9.11.21
Notes for BIND 9.11.20
Notes for BIND 9.11.19
Notes for BIND 9.11.18
Notes for BIND 9.11.17
Notes for BIND 9.11.16
Notes for BIND 9.11.15
Notes for BIND 9.11.14
Notes for BIND 9.11.13
Notes for BIND 9.11.12
Notes for BIND 9.11.11
Notes for BIND 9.11.10
Notes for BIND 9.11.9
Notes for BIND 9.11.8
Notes for BIND 9.11.7
Notes for BIND 9.11.6
Notes for BIND 9.11.5
Notes for BIND 9.11.4
Notes for BIND 9.11.3
Notes for BIND 9.11.2
Notes for BIND 9.11.1
Notes for BIND 9.11.0
End of Life
Thank You
B. A Brief History of the DNS and BIND
C. General DNS Reference Information
IPv6 addresses (AAAA)
Bibliography (and Suggested Reading)
Requests for Comments (RFCs)
Internet Drafts
Other Documents About BIND
D. BIND 9 DNS Library Support
BIND 9 DNS Library Support
Installation
Known Defects/Restrictions
The dns.conf File
Sample Applications
Library References
I. Manual pages
arpaname — translate IP addresses to the corresponding ARPA names
ddns-confgen — ddns key generation tool
delv — DNS lookup and validation utility
dig — DNS lookup utility
dnssec-checkds — DNSSEC delegation consistency checking tool
dnssec-coverage — checks future DNSKEY coverage for a zone
dnssec-dsfromkey — DNSSEC DS RR generation tool
dnssec-importkey — import DNSKEY records from external systems so they can be managed
dnssec-keyfromlabel — DNSSEC key generation tool
dnssec-keygen — DNSSEC key generation tool
dnssec-keymgr — Ensures correct DNSKEY coverage for a zone based on a defined policy
dnssec-revoke — set the REVOKED bit on a DNSSEC key
dnssec-settime — set the key timing metadata for a DNSSEC key
dnssec-signzone — DNSSEC zone signing tool
dnssec-verify — DNSSEC zone verification tool
dnstap-read — print dnstap data in human-readable form
genrandom — generate a file containing random data
host — DNS lookup utility
isc-hmac-fixup — fixes HMAC keys generated by older versions of BIND
lwresd — lightweight resolver daemon
mdig — DNS pipelined lookup utility
named-checkconf — named configuration file syntax checking tool
named-checkzone — zone file validity checking or converting tool
named-journalprint — print zone journal in human-readable form
named-nzd2nzf — Convert an NZD database to NZF text format
named-rrchecker — syntax checker for individual DNS resource records
named.conf — configuration file for named
named — Internet domain name server
nsec3hash — generate NSEC3 hash
nslookup — query Internet name servers interactively
nsupdate — Dynamic DNS update utility
pkcs11-destroy — destroy PKCS#11 objects
pkcs11-keygen — generate keys on a PKCS#11 device
pkcs11-list — list PKCS#11 objects
pkcs11-tokens — list PKCS#11 available tokens
rndc-confgen — rndc key generation tool
rndc.conf — rndc configuration file
rndc — name server control utility
Next
Chapter1.Introduction

BIND 9.11.36 (Extended Support Version)