0

I am maintaining a DNS host with bind9 inside company. My problem is the I am supporting few Teams and I would like to split their configuration into separate files, but all of them has the same domain. All FQHN are X.abc.com, Y.abc.com. Can I have multiple files under one zone? Currently my named.conf if:

zone "abc.com" IN {
        type master;
        file "/ephemeral/bind_confs/all.ca";
        notify yes;
    };

I would like to have something like:

zone "abc.com" IN {
        type master;
        files "/ephemeral/bind_confs/one.ca",
              "/ephemeral/bind_confs/two.ca";
        notify yes;
    };
  • 1
    You could split it up in three files: one for the NS+SOA records and the like, one for "team-A" and a third for "team-B" then use a simple bash script to cat the three files together and reload BIND on that single file. I don't believe you can have multiple file statements in a zone config. – Tommiie Sep 19 '18 at 8:08
3

The typical thing to would be to create multiple zones with each their own zone-file:

zone "x.example.com" IN {
        type master;
        file "/ephemeral/bind_confs/com.example.x.conf";
        notify yes;
    };

zone "y.example.com" IN {
        type master;
        file "/ephemeral/bind_confs/com.example.y.conf";
        notify yes;
    };

zone "example.com" IN {
        type master;
        file "/ephemeral/bind_confs/com.example.conf";
        notify yes;
    };

where every resource for *.x.example.com and x.example.com would be placed in a dedicated zone file, similar to those for y.example.com and everything else in the main zone file. This will need to be complete zone files with a SOA record.

Resource records for *.x.example.com that get entered in the zone file for example.com should effectively be ignored since there is an more specific authoritative zone file.

That is the "proper" delegation of control as the team that manages the DNS data for x.example.com won't be able to override or break the main example.com zone nor can they interfere in the y.example.com zone.


In zone files, rather than the main bind configuration file, you can use the $INCLUDE directive to include records from an external file. The included file is not a full zone file, it only needs to contain the records your want to include.

 zone "example.com" IN {
        type master;
        file "/ephemeral/bind_confs/com.example.conf";
        notify yes;
    };

and the zone file /ephemeral/bind_confs/com.example.conf:

$ORIGIN example.com.
$TTL 86400
@   SOA dns1.example.com.   hostmaster.example.com. (
        2001062501 ; serial
        21600      ; refresh after 6 hours
        3600       ; retry after 1 hour
        604800     ; expire after 1 week
        86400 )    ; minimum TTL of 1 day
;
;

$INCLUDE /ephemeral/bind_confs/com.example.y.data ; absolute path
...
ftp        IN      A   192.168.35.16

and /ephemeral/bind_confs/com.example.y.data

ftp.y.example.com.        IN      A   192.168.1.16
www.y.example.com.        IN      A   192.168.1.17

The problem with that is there is no delegation of control, nothing prevents a team from setting a record for www.example.com. in the com.example.y.data file.

  • Thanks, that is what I needed. Since I am the only admin (it sux...) no delegation is needed – Vardens Archangel Sep 19 '18 at 16:08
  • Please take note though that you won't forget to update the SAO serial in the main file after edits have been made to an included file, or the zone updates won't be picked up by your slave name servers... – HBruijn Sep 19 '18 at 16:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.