3.1 Getting BIND

If you plan to set up your own zones and run name servers for them, you'll need the BIND software first. Even if you're planning on having someone else host your zones, it's helpful to have the software around. For example, you can use your local name server to test your data files before giving them to the administrator of your remote name servers.

Most commercial Unix vendors ship BIND with the rest of their standard TCP/IP networking software. And the networking software is usually included with the operating system, so you get BIND free. Even if the networking software is priced separately, you've probably already bought it, since you clearly do enough networking to need DNS, right?

If you don't have a version of BIND for your flavor of Unix, though, or if you want the latest, greatest version, you can always get the source code. As luck would have it, it's freely distributed. The source code for the most up-to-date versions of BIND as of this writing (the BIND 8.2.3 and 9.1.0 releases) is available via anonymous FTP from the Internet Software Consortium's web site, ftp.isc.org, in /isc/bind/src/cur/bind-8/bind-src.tar.gz and /isc/bind9/9.1.0/bind-9.1.0.tar.gz, respectively. Compiling these releases on most common Unix platforms is relatively straightforward.^[1] The ISC includes a list of Unix-ish operating systems that BIND is known to compile on in the file src/INSTALL, including several versions of Linux, Digital Unix, and Solaris 2. There's also a list of other Unix-ish and not-so-Unix-ish (MPE, anyone?) operating systems that BIND has supported in the past and that these most recent versions of BIND will probably compile on without much effort.^[2] Regardless of which category your operating system falls into, we strongly recommend reading all of the sections of src/INSTALL relevant to your OS. We also include instructions on compiling BIND 8.2.3 and 9.1.0 on RedHat Linux 6.2 as Appendix C. It's a remarkably short appendix.

^[1] Compiling early versions of BIND 9 (before 9.1.0) can be a little tricky, since these versions require pthreads and many OSes sport broken pthreads implementations. BIND 9.1.0 and later can be built without pthreads by running configure - -disable-threads.

^[2] We know for a fact that BIND 8.2.3 compiles cleanly on several of these operating systems.

Some of you may already have a version of BIND that came with your operating system, but you're wondering whether you need the latest, greatest version of BIND. What does it have to offer that earlier versions of BIND don't? Here's an overview:

Security fixes

Arguably the most important reason to run the newest BIND is that only the most recent versions are patched against most attacks, some of them widely known. BIND 8.2.3 and BIND 9.1.0 are resistant to all well-known attacks, while BIND 4.9.8 can withstand an important subset of them. Earlier versions of BIND have many widely known vulnerabilities. If you're running a name server on the Internet, we strongly recommend that you run BIND 8.2.3, BIND 9.1.0, at the very least BIND 4.9.8, or whatever the current released version is as you read this.

Security features

BIND 8 and BIND 9 support access lists on queries, zone transfers, and dynamic updates. BIND 4.9 servers support access lists on queries and zone transfers, and earlier versions of BIND don't support access lists at all. Certain name servers, particularly those running on bastion hosts or other security-critical hosts, may require these features.

We cover these features in Chapter 11.

DNS UPDATE

BIND 8 and BIND 9 support the Dynamic Update standard described in RFC 2136. This allows authorized agents to update zone data by sending special update messages to add or delete resource records. BIND 4 servers don't support Dynamic Update.

We cover Dynamic Update in Chapter 10.

DNS NOTIFY

BIND 8 and BIND 9 support zone change notification, which allows the primary master name server for a zone to notify the zone's slaves when the serial number has incremented. BIND 4 servers don't support NOTIFY.

We describe NOTIFY in Chapter 10.

Incremental zone transfer

BIND 8.2.3 and BIND 9 support incremental zone transfer, which allows slave name servers to request just the changes to a zone from their master servers. This makes zone transfers faster and more efficient, and is particularly important for large, dynamic zones.

Configuration syntax

The configuration syntax used by BIND 8 and BIND 9 is completely different from BIND 4's. While the new configuration syntax is more flexible and more powerful, it also requires learning a brand-new system for configuring BIND. But then, you have this book to help you through that.

We introduce the BIND 8 and BIND 9 configuration syntax in Chapter 4, and describe it throughout the rest of the book.

We've also provided a summary of the capabilities of four popular versions of BIND (4.9.8, 8.1.2, 8.2.3, and 9.1.0) as Appendix B. If you're not sure which version is right for you or if you need some exotic BIND feature you're not sure is supported yet in BIND 9, take a look at the appendix.

If, after reading through this list and checking the appendix, you're convinced you need BIND 8 or BIND 9's features and neither a BIND 8 nor BIND 9 name server comes with your operating system, download the source code and build your own.

3.1.1 Handy Mailing Lists and Usenet Newsgroups

Instructions on how to port BIND to every other version of Unix could consume another book this size, so we'll have to refer you to the BIND users mailing list (bind-users@isc.org ) or the corresponding Usenet newsgroup (comp.protocols.dns.bind) for further help.^[3] For BIND 9, there's a separate mailing list, bind9-users@isc.org.^[4] The folks who read and contribute to the BIND users mailing lists can be enormously helpful in your porting efforts. Before sending mail to the list asking whether a particular port is available, though, be sure to check the searchable archive of the mailing list at http://www.isc.org/ml-archives/bind-users. Also, take a look at the ISC's BIND web page at http://www.isc.org/products/BIND for notes or links specific to your operating system, and check Andras Salamon's DNS Resource Directory for precompiled BIND software. The directory currently has a short list of precompiled binaries at http://www.dns.net/dnsrd/bind.html.

^[3] To ask a question on an Internet mailing list, all you need to do is send a message to the mailing list's address. If you'd like to join the list, however, you have to send a message to the list's maintainer first, requesting that he or she add your electronic mail address to the list. Don't send this request to the list itself—that's considered rude. The Internet convention is that you can reach the maintainer of a mailing list by sending mail to list-request@domain, where list@domain is the address of the mailing list. So, for example, you can reach the BIND users mailing list's administrator by sending mail to bind-users-request@isc.org.

^[4] Most of the BIND 9 developers read the bind9-users mailing list exclusively.

Another mailing list you might be interested in is the namedroppers list. Folks on the namedroppers mailing list are involved in the IETF working group that develops extensions to the DNS specifications, DNSEXT. For example, the discussion of a new, proposed DNS record type would probably take place on namedroppers instead of the BIND mailing list. For more information on DNSEXT's charter, see http://www.ietf.org/html.charters/dnsext-charter.html.

The address for the namedroppers mailing list is namedroppers@ops.ietf.org, and it is gatewayed into the Internet newsgroup comp.protocols.dns.std. To join the namedroppers mailing list, send mail to namedroppers-request@ops.ietf.org with the text "subscribe namedroppers" as the body of the message.

3.1.2 Finding IP Addresses

You'll notice that we gave you a number of domain names of hosts that have FTPable software, and that the mailing lists we mentioned include domain names. That should underscore the importance of DNS: see what valuable software and advice you can get with the help of DNS? Unfortunately, it's also something of a chicken-and-egg problem: you can't send email to an address with a domain name in it unless you've got DNS set up, so how can you ask someone on the list how to set DNS up?

Well, we could give you the IP addresses for all the hosts we mentioned, but since IP addresses change often (in publishing timescales, anyway), we'll show you how you can temporarily use someone else's name server to find the information instead. As long as your host has Internet connectivity and the nslookup program, you can retrieve information from the Internet namespace. To look up the IP address for ftp.isc.org, for example, you could use:

% nslookup ftp.isc.org. 207.69.188.185

This instructs nslookup to query the name server running on the host at the IP address 207.69.188.185 to find the IP address for ftp.isc.org, and should produce output like:

Server:  ns1.mindspring.com
Address:  207.69.188.185

Name:    isrv4.pa.vix.com
Address: 204.152.184.27
Aliases:  ftp.isc.org

Now you can FTP to ftp.isc.org's IP address, 204.152.184.27.

How did we know that the host at IP address 207.69.188.185 runs a name server? Our ISP, Mindspring, told us—it's one of their name servers. If your ISP provides name servers for its customers' use (and most do), use one of them. If your ISP doesn't provide name servers (shame on them!), you can temporarily use one of the name servers listed in this book. As long as you use it only to look up a few IP addresses or other data, the administrators probably won't mind. It's considered very rude, however, to point your resolver or query tool at someone else's name server permanently.

Of course, if you already have access to a host with Internet connectivity and DNS configured, you can use it to FTP the stuff you need.

Once you've got a working version of BIND, you're ready to start thinking about your domain name.