06. Domain Name Service - zone file questions

heiko_s

Taking the labs as an example, I went to configure an authoritative name server / caching name server for my home network. I'm running an Ubuntu 18.04 VM. Here the configuration files, all under /etc/bind:

named.conf.local:

zone "mysweethome.com" IN {
    type master;
    file "/etc/bind/mysweethome.com.zone";
};

named.conf.options:

acl mysweethome { 192.168.0.0/24; 127.0.0.1; }; this name server is for locals (private network)
options {
    directory "/var/cache/bind";

    forwarders {
        9.9.9.9; for caching DNS
        8.8.8.8;
    };

    dnssec-validation auto;

    auth-nxdomain no;    # conform to RFC1035
    listen-on port 53 { mysweethome; };  see ACL rule on top
    allow-query { mysweethome; };
    recursion yes;
    // listen-on-v6 { any; }; the Ubuntu default is IPv6
};

Finally my zone file for my private network "mysweethome.com.zone":

$TTL 86400
@   IN SOA  localhost. root.localhost. (
2020073105  ; serial
24H     ; refresh
2H      ; retry
2H      ; expire
1M )        ; negative TTL
@   IN NS localhost.
oldy    IN A 192.168.0.129
master  IN A 192.168.0.130
worker1 IN A 192.168.0.131
worker2 IN A 192.168.0.132
worker3 IN A 192.168.0.133
worker4 IN A 192.168.0.134
xbmc    IN A 192.168.0.160

Question 1: @ stands for "current origin". How is the current origin determined? From the zone name in named.conf.local ?

Question 2: Actually related to Q1, what is the "$ORIGIN domain-name" directive good for? In the mysweethome.com.zone file above I did not specify "$ORIGIN mysweethome.com", yet it works fine.

For example, the RR:
master IN A 192.168.0.130
translates correctly to master.mysweethome.com

What I take from it is that I can use both FQDN (fully qualified domain names) with a trailing dot, or the short form I used which will be appended by the $ORIGIN, or the current origin (@).

Following this thought, could I also write:
master.@ IN A 192.168.0.130 ?

Question 3: In the lab exercise 6.2 the named.conf.local file has the following zone entry:

zone
"example.com." IN {
type master;
file
"/etc/bind/example.com.zone";
};

You are using a trailing . for the zone name, yet non of the zone files supplied with bind9 use this dot, nor is it used in the BIND 9 Administrator Reference Manual (see chapter 3). Is both correct? It seems to work with or without.

Remark: At one point I tried for example dig @localhost master.mysweethome.com and it would not work, whereas dig @192.168.0.130 ... would be fine. I then realized that localhost is IP 127.0.0.1, so I added this IP to the ACL. That's what happens when I try to outsmart myself.

lee42x

Yes! You have it, the "origin" is derived from the "zone" name. You don't need to use the "@ at all, it is just a short cut. You will see it in many configuration files. The origin" can be re-assigned if you wish with the "ORIGIN" directive.

The trailing "." in general it means "don't add zone" . In your example, your zone file has "short names" in the left most column, this will append the "zone" (or origin) to the name before fetching the address. If you add the trailing "." no additional zone will get added. Experiment with the "dig" command looking up short and FQDN names, notice the "question" section in "dig's" output.

The zone name with the "." , old habit of always using the trailing "." , it used to be far more fussy. I won't affect anything and as it is redundant, I'll see about removing it. Thank you for noticing.

Lee

heiko_s

A little belated: Thanks for clarifying. This makes it clear to me. (P.S.: The forum software does save automatic drafts.)