Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Here's how I'm currently setting up my zones in bind:

[user@host ~]$ cat /etc/bind/named.conf.local
zone "test.com" {
   type master;
   file "/etc/bind/zones/test.com.db";
   };

zone "0.168.192-in-addr.arpa" {
   type master;
   file "/etc/bind/zones/rev.0.168.192.in-addr.arpa";
   };

[user@host ~]$ cat /etc/bind/zones/test.com.db
test.com.   IN SOA   ns1.test.com.  admin.example.com. (
   2006081401
   28800
   3600
   604800
   38400
)

test.com.   IN NS ns1.test.com.
www         IN A  192.168.0.2

[user@host ~]$ cat /etc/bind/zones/rev.0.168.192.in-addr.arpa
@  IN SOA   ns1.test.com. admin.example.com. (
   2006081401;
   28800;
   604800;
   604800;
   86400
)

   IN NS    ns1.test.com.
1  IN PTR   test.com

I'm wondering though, do I need to create the reverse zone?

I SSH'd into my old VPS, that used WebHost Manager to configure Bind, and saw that no reverse zones were created. Are they required? Can I omit them?

share|improve this question

4 Answers 4

A reverse zone is much like any another zone except that it happens to be cut from the in-addr.arpa space. If there's a delegation to your name servers, then yes you likely do want to serve those entries or you'll have issues with things like mail blacklists and so forth.

It's fairly likely that your host is managing the reverse entries for the IP addresses you're allocated in which case they'll likely have created generic entries for you so that you won't need to host the entries yourself. You can check what the existing entries are (if any) by running:

dig -x 192.0.32.10

Substituting 192.0.32.10 for whatever is appropriate. It's good practice to have the reverse entry for an IP address match the primary forward entry for that IP. ie: the A record www.example.com points to 192.0.32.10 and the PTR record 10.32.0.192.in-addr.arpa. points to www.example.com.

share|improve this answer

You can safely omit them in almost all cases. However, many programs will attempt to query reverse DNS and will work better (usually as less error/warning messages) with it fully implemented.

share|improve this answer
    
Could you elaborate on many programs will attempt to query reverse DNS and will work better (usually as less error/warning messages) with it fully implemented? I was fully prepared to omit the reverse zones until I got to that sentence xD –  Ted Jul 27 '10 at 1:05
1  
@Ted For example, checking for a reverse DNS on an email origin is one of the first anti-spam checks that's done. Not an issue if you're not running a mail server. –  Mark Henderson Jul 27 '10 at 1:22
1  
SSH throws "Possible Break-In Attempt" messages when there's no r-dns, e-mail as Farseeker said, X11 connections, some FTP servers; most stuff that handles security in the connection. It's fairly rare for r-dns to be required, and lots of people get by without them (mail is a bit of a special case, as many spam filters toss e-mail without a matching r-dns entry). –  Chris S Jul 27 '10 at 4:07

Do I need to create reverse zone files for my domains?

Do you own or are you responsible for your IP address space? Do you have a least a /24 network of public addresses?

If you have public address space then you should probably setup a reverse zone. If you only have a few address from your ISP then you can ask your ISP to do a rfc2317 delegation to you and then do your own reverse DNS. If your ISP doesn't want to do th en then you are probably stuck with making requests to them to update your reverse DNS records. Which may be easier to deal with anyway if you only have a few addresses.

share|improve this answer

Your example above shows reverse DNS for the 192.168.0.0 subnet. This is not a public IP address range, i.e. this must be for your local network. Unless you are doing some really bizarre stuff on your private network, you won't need this. OTOH, it's possibly good training, in case you ever need to set up reverse DNS for your public IP range (if you have such a thing). If your Internet connection is a simple, 1-address-only, ADSL connection, then you won't even have a choice, and in case you DO need reverse DNS on that (e.g. for a mail server), you will have to ask your ISP to do that for you.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.