1

If I have a master DNS that is not bind - can bind still slave to it? (ie does it use the DNS protocol or something else?).

Kind of related - but do people still do this or do they use some other form of data replication to keep DNS records in sync to the slaves (ie file/database copying)? I would like to have the slaves refreshed as fast as possible so I am thinking normal slaving with is expiry/poll based might not be optimal?

Improve this question

3 Answers 3

Reset to default
2

You're looking for DNS zone transfers. This mechaism copies DNS zones between DNS servers as either a complete transfer, or an incremental transfer of updated records (to save bandwidth and reduce update latency). DNS NOTIFY allows the master server to inform secondaries that updates are available. With NOTIFY, polling isn't necessary.

Virtually every DNS server implementation supports zone transfers. BIND will happily act as as secondary DNS server for any primary DNS server that can supply it with transfers of the DNS zone data.

Improve this answer
3
  • hmm... also looking at djbdns - I suppose it would as well.
    – Michael Neale
    Jan 21, 2010 at 0:06
  • I thought djb said rsync is the one method, and AXFR/IXFR isn't written for that.
    – Michael Graff
    Jan 21, 2010 at 4:45
  • You use axfrdns in the djbdns suite to perform zone transfers or otherwise answer dns requests over TCP.
    – chris
    Jan 21, 2010 at 12:01
0

Yes it can. We have exactly this set up. We are replicating a single zone from our Active Directory cluster.

Improve this answer
-3

You should consider using djbdns( http://cr.yp.to/djbdns.html ). It is one of the most secure and stable DNS servers available. It uses a local db file that can easily be synced using SCP. This is generally considered preferred over Zone transfers for security purposes(zone transfers are sent in plain text). The install can be a little difficult for beginners to compiling software but it is well worth it. Also there is a very nice web front end that has been developed for it: http://vegadns.sourceforge.net/

Improve this answer
10
  • The records in my Internet-facing DNS servers, at least, are supposed to be public knowledge. DNS queries are, after all, sent in plain text. IPSEC sounds like a smarter answer to me than using application-level tunneling for each and every protocol...
    – Evan Anderson
    Jan 21, 2010 at 0:11
  • Some of your DNS records you may not want to be public knowledge. If you read most penetration test/security books one of the first investigating steps is to attempt a zone transfer to find potential targets. Obviously you can block zone transfers by IP but I'd rather not let this info get out.
    – einstiien
    Jan 21, 2010 at 0:23
  • thanks yes, someone else recommended that. I have zone files, and found a script to convert them to djbdns format: qmail.jms1.net/djbdns
    – Michael Neale
    Jan 21, 2010 at 0:53
  • 3
    I'm well aware of the ol' "do a zone transfer to find potential targets", and my response to that would be "don't put those records in a public DNS server, then". DNS queries are plain-text. If you ever query for these "secret records" then they're not "secret" anymore. Hiding secrets in plain sight is silly. Assume your attacker can monitor all your DNS queries and responses.
    – Evan Anderson
    Jan 21, 2010 at 0:56
  • 1
    The published data is public but I don't want my dns "slave" servers to get updates from a spoofed address. That trust issue is avoided if I use ssh/rsync to synchronize the dns data between my dns servers.
    – chris
    Jan 21, 2010 at 1:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .