2

I'm pretty new to configuring BIND, and I'm having a few issues with the configuration I'm using. I've googled for going on a week now, and either I can't figure out the proper search terms to use, or I'm getting conflicting information. I'm wondering if any DNS gurus out there can glance through my configuration (pasted below) and see if there is A) an obvious solution to my two listed issues, and B) anything else you see that is configured incorrectly? I'm on CentOS 6.4 x64, and am using BIND 9.8.2. It should be obvious that I've substituted example.com for our real domain name in the text below.

Issues

  1. I'd like internal clients to be able to resolve example.com to www.example.com (our externally served web site). However, I am not clear on how to do this, when that is the root domain of my internal clients. Is this even possible? For now, I've just told employees that they must use www.example.com to access our external web site from inside our network.

The zone file for example.com looks like this:

$ORIGIN .
$TTL 600        ; 10 minutes
example.com     IN SOA  ns1.example.com. root.example.com. (
                                5          ; serial
                                604800     ; refresh (1 week)
                                86400      ; retry (1 day)
                                2419200    ; expire (4 weeks)
                                604800     ; minimum (1 week)
                                )
                        NS      ns1.example.com.
                        A       10.2.2.44
$TTL 3600       ; 1 hour
                        MX      1 ASPMX.L.GOOGLE.COM.
                        MX      5 ALT1.ASPMX.L.GOOGLE.COM.
                        MX      5 ALT2.ASPMX.L.GOOGLE.COM.
                        MX      10 ASPMX2.GOOGLEMAIL.COM.
                        MX      10 ASPMX3.GOOGLEMAIL.COM.
$ORIGIN example.com.
$TTL 600        ; 10 minutes
myserver                A       10.2.2.5
test                    A       10.2.2.45
www                     A       123.12.34.32 // externally hosted www server
0

2 Answers 2

2

I'd like internal clients to be able to resolve example.com to www.example.com (our externally served web site).

The way this is usually done is by creating an A record for example.com, and making www.example.com a CNAME that points to that A record.
It is also acceptable to make them both A records pointing to the same IP address.

If you have an Internal and External version of the example.com zone you must duplicate the external addresses in your internal zone file (or point these records at their internal/private IP addresses).


Note that you may not CNAME the base domain (example.com), per RFC 1912:

2.4 CNAME records

   A CNAME record is not allowed to coexist with any other data.  In
   other words, if suzy.podunk.xx is an alias for sue.podunk.xx, you
   can't also have an MX record for suzy.podunk.edu, or an A record, or
   even a TXT record.  Especially do not try to combine CNAMEs and NS
   records like this!:


           podunk.xx.      IN      NS      ns1
                           IN      NS      ns2
                           IN      CNAME   mary
           mary            IN      A       1.2.3.4


   This is often attempted by inexperienced administrators as an obvious
   way to allow your domain name to also be a host.  However, DNS
   servers like BIND will see the CNAME and refuse to add any other
   resources for that name.  Since no other records are allowed to
   coexist with a CNAME, the NS entries are ignored.  Therefore all the
   hosts in the podunk.xx domain are ignored as well!

   If you want to have your domain also be a host, do the following:

           podunk.xx.      IN      NS      ns1
                           IN      NS      ns2
                           IN      A       1.2.3.4
           mary            IN      A       1.2.3.4

   Don't go overboard with CNAMEs.  Use them when renaming hosts, but
   plan to get rid of them (and inform your users).  However CNAMEs are
   useful (and encouraged) for generalized names for servers -- `ftp'
   for your ftp server, `www' for your Web server, `gopher' for your
   Gopher server, `news' for your Usenet news server, etc.

   Don't forget to delete the CNAMEs associated with a host if you
   delete the host it is an alias for.  Such "stale CNAMEs" are a waste
   of resources.
4
  • I added example.com. A 123.123.123.32 // externally hosted web site to my db.example.com zonefile, and it worked. Thank you! Now I just need to figure out this ddns reverse zone update problem, and I'll be all set.
    – sbgoodwin
    May 1, 2013 at 20:23
  • 1
    I know that "thanks" comments are discouraged, but thank you for covering the NS/SOA collision issue with CNAMEs in detail.
    – Andrew B
    May 1, 2013 at 20:57
  • 2
    No, that's the wrong way: by "making www.example.com a CNAME that points to that A record [sic]" you also inherit the other records such as NS. You should add the IP address twice, for example.com and for www.example.com.
    – bortzmeyer
    May 2, 2013 at 16:55
  • @bortzmeyer there is nothing "wrong" with inheriting the other records (there is a negligible increase in DNS bandwidth consumption, in exchange for which you don't have to remember to change an IP address in multiple places). There are of course conditions where you explicitly shouldn't use a CNAME - like for targets of MX records - but that's a separate discussion, covered by other RFCs.
    – voretaq7
    May 2, 2013 at 17:28
-1

For issue 1, add a Canonical Name.

# cat /var/named/db.example.com

$ORIGIN .
$TTL 600        ; 10 minutes
example.com     IN SOA  ns1.example.com. root.example.com. (
                                6          ; serial
                                604800     ; refresh (1 week)
                                86400      ; retry (1 day)
                                2419200    ; expire (4 weeks)
                                604800     ; minimum (1 week)
                                )
                        NS      ns1.example.com.
                        A       10.2.2.44
$TTL 3600       ; 1 hour
                        MX      1 ASPMX.L.GOOGLE.COM.
                        MX      5 ALT1.ASPMX.L.GOOGLE.COM.
                        MX      5 ALT2.ASPMX.L.GOOGLE.COM.
                        MX      10 ASPMX2.GOOGLEMAIL.COM.
                        MX      10 ASPMX3.GOOGLEMAIL.COM.
$ORIGIN example.com.
$TTL 600        ; 10 minutes
myserver                A       10.2.2.5
test                    A       10.2.2.45
example.com.            A       123.12.34.32 // externally hosted www server
www                     CNAME   example.com.

Issue 2: Not 100% sure. In your /etc/named.conf file the "IN" directives seem weird. Not sure if that is legit or not you could try taking them out.

Something else I haven't seen before, in /var/named/db.2.2.10.in-addr.arpa is your NS line second from the bottom. I think the file should look more like this:

;
; BIND data file for example.com
;
$TTL 10m
@  IN  SOA ns1.example.com. root.example.com. (
            2           ; Serial
            604800      ; Refresh
            86400       ; Retry
            2419200     ; Expire
            604800 )    ; Negative Cache TTL

                        IN      NS      ns1.example.com.
;
;
;
5                       IN      PTR     myserver.example.com.
4
  • I tried this, but get errors about invalid CNAME configuration. Do you mean something like using @ instead of example.com.? EDIT: NEver mind, I tried that but got errors again.
    – sbgoodwin
    May 1, 2013 at 20:08
  • 1
    You can't CNAME the base domain like that. It's a violation of RFC 1912 and BIND will not allow it.
    – voretaq7
    May 1, 2013 at 20:09
  • Bah... that's too bad. I guess the only solution would be to do the reverse. Updated
    – MattPark
    May 1, 2013 at 20:19
  • Found this: zytrax.com/books/dns/ch7/zone.html. Looks like the "IN" parameters in my zone statements in named.conf are optional, and default to "IN" if not specified. As for the change to /var/named/db.2.2.10.in-addr.arpa, I tried that but same result... Thanks for the try though!
    – sbgoodwin
    May 1, 2013 at 20:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .