Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Why are the reverse Zone files in Bind split by octets instead of subnets?

This is what I would expect to see:


host# ls /path/to/zone/files
share|improve this question
up vote 1 down vote accepted

A query for will be for a record at, which isn't under the zone. This is also why you can't have a reverse DNS delegation for a subnet smaller than /24, either; there's no ability or logic in the DNS standard to "split" the delegations for these zones into smaller chunks.

DNS serves name data; it has no special logic built around serving data for subnets, so the standard for reverse zones conforms to the "DNS-looking" format of the dot-separated numbers.

share|improve this answer
You can have a reverse DNS delegation for a subnet smaller than /24. – Mark Wagner Jun 24 '11 at 17:46
@embobo Fair point, but it's just a CNAME workaround. There's very little support out there among RIRs (ARIN's policy here) or ISPs (at least, the ISPs that I've worked with), so it's most often not a viable option. But, point taken and +1 to your answer; it's important to mention in the context of this question. – Shane Madden Jun 24 '11 at 18:05
I guess I'm not understanding why the query couldn't find under any more/less then it could find It seems very arbitrary. – frogstarr78 Jun 24 '11 at 20:43
@frogstarr78 When looking for, it looks for a DNS record at, which is outside of the scope of the hierarchy that a zone for can accommodate. – Shane Madden Jun 26 '11 at 2:03

It is easiest to split on octect boundaries but see RFC2317 for "classless IN-ADDR.ARPA delegation."

share|improve this answer
Easier in what way? It seems easier to me to split zone files by their appropriate subnets. I must still be missing some detail about the reverse lookup "transaction". – frogstarr78 Jun 24 '11 at 21:00
...Ah, I just got it. It's because of the hierarchal nature of DNS. Correct? The 209 tree couldn't be expected to be found in the 208 tree, without some mechanism to "span the node". – frogstarr78 Jun 24 '11 at 21:05
@frogstarr78 Exactly; from its perspective it's just another name, and the text hierarchy is all it knows; it's analogous to getting it to look for "" in a zone for "". What @embobo's pointing to allows for delegations to occur in a more granular way, for instance to split up the /25s you referenced, but whoever's doing the delegating would still need to put the 172.0.209.x information in the direct path: in or or – Shane Madden Jun 24 '11 at 21:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.