4

Are there any tools available to automatically detect (and optionally correct) CNAME chains in BIND zone files?

I am trying to clean up a rather large zone file (15,000+ resource records) so I'm looking for tools that can perform static analysis to detect common problems and help me move towards best practices.

4
  • maybe grep CNAME ?
    – Sandman4
    Jul 14, 2012 at 19:20
  • @Sandman4 grep is good for finding single CNAME entries, but I want to avoid doing a manual grep (or dig) for each of those 500 records to see if they chain to another CNAME.
    – Nic
    Jul 14, 2012 at 19:26
  • does bind's checkzone checks for CNAME chains ? - It does for MX and SRV, but can't see for CNAME...
    – Sandman4
    Jul 14, 2012 at 21:38
  • named-checkzone does not check for CNAME chains, because they are still technically valid, whereas MX records must point to an A record according to RFC2181.
    – Nic
    Jul 14, 2012 at 22:02

2 Answers 2

1

I have not seen anything that exists to do this. It looks like the sort of thing you'd just need to write a Perl (or Python, etc.) script for.

Easiest would just be to go through all of the lines and make a hash table of A records. Then go through the file and for each CNAME record, do a hash lookup for the A record. If it's not found, then flag that line as not being a valid CNAME entry.

It should be very straightforward.

0

I found a commercial program called DNS Expert from "Men & Mice" can thoroughly analyze a DNS zone using many predefined rules for standards compliance and best practices. One of those diagnostic rules allows it to detect CNAME chains.

However, it can only scan live servers with AXFR enabled. There doesn't appear to be any way to scan a zonefile that has been copied to the local harddrive. It hasn't been updated since 2006, but DNS hasn't changed in that time either. :-)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .