BIND 9 Administrator Reference Manual BIND 9.16.0 (Stable Release) Copyright (C) 2000-2020 Internet Systems Consortium, Inc. ("ISC") This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0. If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla.org/MPL/2.0/. Internet Systems Consortium 950 Charter Street Redwood City, California USA https://www.isc.org/ Contents 1 Introduction 1 1.1 Scope of Document . .1 1.2 Organization of This Document . .1 1.3 Conventions Used in This Document . .1 1.4 The Domain Name System (DNS) . .2 DNS Fundamentals . .2 Domains and Domain Names . .2 Zones . .3 Authoritative Name Servers . .3 The Primary Master . .3 Slave Servers . .4 Stealth Servers . .4 Caching Name Servers . .4 Forwarding . .5 Name Servers in Multiple Roles . .5 2 BIND Resource Requirements7 2.1 Hardware requirements . .7 2.2 CPU Requirements . .7 2.3 Memory Requirements . .7 2.4 Name Server Intensive Environment Issues . .7 2.5 Supported Operating Systems . .8 iii BIND 9.16.0 CONTENTS CONTENTS 3 Name Server Configuration9 3.1 Sample Configurations . .9 A Caching-only Name Server . .9 An Authoritative-only Name Server . .9 3.2 Load Balancing . 10 3.3 Name Server Operations . 11 Tools for Use With the Name Server Daemon . 11 Diagnostic Tools . 11 Administrative Tools . 12 Signals . 13 3.4 Plugins . 14 Configuring Plugins . 14 Developing Plugins . 14 4 Advanced DNS Features 17 4.1 Notify . 17 4.2 Dynamic Update . 17 The journal file . 18 4.3 Incremental Zone Transfers (IXFR) . 18 4.4 Split DNS . 19 Example split DNS setup . 19 4.5 TSIG . 22 Generating a Shared Key . 23 Loading A New Key . 23 Instructing the Server to Use a Key . 24 TSIG-Based Access Control . 24 Errors . 24 4.6 TKEY . 25 4.7 SIG(0) . 25 4.8 DNSSEC . 26 Generating Keys . 26 Signing the Zone . 27 Configuring Servers for DNSSEC . 27 4.9 DNSSEC, Dynamic Zones, and Automatic Signing . 29 BIND 9.16.0 iv CONTENTS CONTENTS Converting from insecure to secure . 29 Dynamic DNS update method . 30 Fully automatic zone signing . 31 Private-type records . 31 DNSKEY rollovers . 32 Dynamic DNS update method . 32 Automatic key rollovers . 33 NSEC3PARAM rollovers via UPDATE . 33 Converting from NSEC to NSEC3 . 33 Converting from NSEC3 to NSEC . 33 Converting from secure to insecure . 33 Periodic re-signing . 33 NSEC3 and OPTOUT . 34 4.10 Dynamic Trust Anchor Management . 34 Validating Resolver . 34 Authoritative Server . 34 4.11 PKCS#11 (Cryptoki) support . 35 Prerequisites . 35 Native PKCS#11 . 36 Building SoftHSMv2 . 36 OpenSSL-based PKCS#11 . 36 Patching OpenSSL . 37 Building OpenSSL for the AEP Keyper on Linux . 38 Building OpenSSL for the SCA 6000 on Solaris . 38 Building OpenSSL for SoftHSM . 39 Configuring BIND 9 for Linux with the AEP Keyper . 39 Configuring BIND 9 for Solaris with the SCA 6000 . 40 Configuring BIND 9 for SoftHSM . 40 PKCS#11 Tools . 40 Using the HSM . 40 Specifying the engine on the command line . 42 Running named with automatic zone re-signing . 42 4.12 DLZ (Dynamically Loadable Zones) . 43 v BIND 9.16.0 CONTENTS CONTENTS Configuring DLZ . 43 Sample DLZ Driver . 44 4.13 DynDB (Dynamic Database) . 45 Configuring DynDB . 45 Sample DynDB Module . 45 4.14 Catalog Zones . 46 Principle of Operation . 46 Configuring Catalog Zones . 47 Catalog Zone format . 48 4.15 IPv6 Support in BIND 9 . 49 Address Lookups Using AAAA Records . 50 Address to Name Lookups Using Nibble Format . 50 5 BIND 9 Configuration Reference 51 5.1 Configuration File Elements . 51 Address Match Lists . ..