Guide to Configuring a Primary DNS Server on CentOS

       Any domain in operation has at least two DNS servers: a primary (e.g., ns1) and a secondary (e.g., ns2). These are used for failover: if one goes down, the other activates. (Translator note: in reality, multiple DNS servers work together; the resolver randomly selects one and moves to the next on timeout.)More complex failover mechanisms including load balancing, firewalls, and clustering can also be implemented.

All DNS entries are added to the primary server. The secondary server syncs all data based on the SOA record serial number.

This tutorial explainsHow to Create a Primary DNS Server on CentOS. Note: this DNS server will be open, responding to queries from any IP. Access control is discussed inthis tutorial. (Translator note: an open DNS server is a security risk.)

Before starting, DNS can be configured with or without chroot. chroot confines the DNS server to a specific directory, preventing system-wide compromise. Placing the DNS server in a chroot environment is also useful for testing.

Objective

We will configure a DNS server for the fake domain example.tst to avoid interfering with real domains.

In this domain, there are three servers:

We will configure a primary DNS server and add the necessary zone and DNS records.

Set Hostname

All hostnames must be correctly defined as FQDNs. Set them as follows:

1. # vim /etc/sysconfig/network

1. HOSTNAME=ns1.example.tst

Note: the hostname in this file takes effect after reboot (or network restart). The following command changes it temporarily:

1. # hostname ns1.example.tst

Once set, verify with:

1. # hostname
   ns1.example.tst

Ensure hostnames are correct on all three servers before proceeding.

Install Packages

We will use bind for DNS, installable via yum.

Without chroot:

1. # yum install bind bind-chroot

With chroot:

1. # yum install bind bind-chroot

Prepare Configuration Files

As mentioned, bind can be configured with or without chroot. The paths differ accordingly:

We can use the default named.conf, but we will use a simpler template instead.

Non-chroot:

1. # cp /usr/share/doc/bind-9.8.2/sample/etc/named.rfc1912.zones /etc/named.conf

Chroot:

1. # cp /usr/share/doc/bind-9.8.2/sample/etc/named.rfc1912.zones /var/named/chroot/etc/named.conf

Now backup and modify the config file:

Non-chroot:

1. # vim /etc/named.conf

Chroot:

1. # vim /var/named/chroot/etc/named.conf

Add/modify the following lines:

1. options {
2. ## Zone file directory ##
3. directory “/var/named”;
4.  
5. ## Forward non-authoritative queries to Google public DNS ##
6. forwarders { 8.8.8.8; };
7. };
8.  
9. ## Declare a local zone example.tst ##
10. zone “example.tst” IN {
11. type master;
12. file “example-fz”; ## File name, stored in /var/named ##
13. allow–update { none; };
14. };
15.  
16. ## Provide reverse resolution for 172.16.1.0/24 ##
17. zone “1.16.172.in-addr.arpa” IN {
18. type master;
19. file “rz-172-16-1”; ## File name, stored in /var/named ##
20. allow–update { none; };
21. };

Prepare Zone Files

Default zone files are created in /var/named or /var/named/chroot/var/named (chroot). If not found, template files are available in /usr/share/doc/bind.

If default zone files are not provided, copy from /usr:

Non-chroot:

1. # cp /usr/share/doc/bind-9.8.2/sample/var/named/named.* /var/named/

Chroot:

1. # cp /usr/share/doc/bind-9.8.2/sample/var/named/named.* /var/named/chroot/var/named

Good! Now that default zone files are ready, create zone files for example.tst and the 172.16.1.0 network. Keep these points in mind:

• The special character‘@’means null (represents the current domain).
• All FQDNs must end with a dot‘.’. E.g., example.tst. Without the dot, it will be treated as a subdomain of the current domain.

1. Forward Zone (Local Authoritative Domain)

Forward zones contain name-to-IP mappings. For public domains, the DNS provider stores forward zone files.

Non-chroot:

1. # vim /var/named/example-fz

Chroot:

1. # vim /var/named/chroot/var/named/example-fz

1. $TTL 1D
2. @ IN SOA ns1.example.tst. sarmed.example.tst. (
3. 0 ; serial
4. 1D ; refresh
5. 1H ; retry
6. 1W ; expire
7. 3H ) ; minimum
8. IN NS ns1.example.tst.
9. IN A 172.16.1.3
10. mail IN A 172.16.1.1
11. IN MX 10 mail.example.tst.
12. www IN A 172.16.1.2
13. ns1 IN A 172.16.1.3
14. ftp IN CNAME www.example.tst.

Note: In zone files, SOA means Start of Authority. The first value is the authoritative name server FQDN, followed by the email address. Since @ cannot be used in this format, the email address is rewritten as sarmed.example.tst.[email protected]format, we rewrite the email as sarmed.example.tst. (special char, representing current domain)。

Typical DNS record types:

• NS: Name Server
• A: Address record, maps hostname to IP
• MX: Mail Exchanger. We use one MX record with priority 10. Lower numbers have higher priority.
• CNAME: Canonical Name. Maps multiple names to a single server with an A record.

2. Reverse Zone

Reverse zones contain IP-to-name mappings. We create one for 172.16.1.0. Some services (e.g., email) require proper reverse resolution, which is typically provided by the IP owner such as the ISP or IDC.

Non-chroot:

1. # vim /var/named/rz-172-16-1

Chroot:

1. # vim /var/named/chroot/var/named/rz-172-16-1

1. $TTL 1D
2. @ IN SOA ns1.example.tst. sarmed.example.tst. (
3. 0 ; serial
4. 1D ; refresh
5. 1H ; retry
6. 1W ; expire
7. 3H ) ; minimum
8. IN NS ns1.example.tst.
9. 1 IN PTR mail.example.tst.
10. 2 IN PTR www.example.tst.
11. 3 IN PTR ns1.example.tst.

Note: Most parameters in reverse zone files are the same as forward zone files except:

• PTR: Pointer record, points to a reverse FQDN.

Final Steps

Now that zone files are ready, adjust their permissions:

Non-chroot:

1. # chgrp named /var/named/*

Chroot:

1. # chgrp named /var/named/chroot/var/named/*

Now set the DNS server IP address:

1. # vim /etc/resolv.conf

1. nameserver 172.16.1.3

Finally, start the DNS service and enable it on boot:

1. # service named restart
2. # chkconfig named on

After starting, check /var/log/messages for useful info. If no errors, test the DNS server.

Test DNS

Use dig or nslookup to test DNS. First, install required packages:

1. # yum install bind-utils

1. Test Forward Zone with dig

When using dig, always check the status:“NOERROR”，Any other value indicates a problem.

1. # dig example.tst

1. ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31184
2.  
3. ;; QUESTION SECTION:
4. ;example.com. IN A
5.  
6. ;; ANSWER SECTION:
7. example.com. 86400 IN A 172.16.1.3
8.  
9. ;; AUTHORITY SECTION:
10. example.com. 86400 IN NS ns1.example.com.
11.  
12. ;; ADDITIONAL SECTION:
13. ns1.example.com. 86400 IN A 172.16.1.3

2. Test PTR Record with dig

When using dig, always check the status:“NOERROR”，Any other value indicates a problem. (Alternatively: dig 1.1.16.172.in-addr.arpa. ptr)

1. # dig -x 172.16.1.1

1. ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27415
2.  
3. ;; QUESTION SECTION:
4. ;1.1.17.172.in–addr.arpa. IN PTR
5.  
6. ;; ANSWER SECTION:
7. 1.1.16.172.in–addr.arpa. 86400 IN PTR mail.example.tst.
8.  
9. ;; AUTHORITY SECTION:
10. 1.16.172.in–addr.arpa. 86400 IN NS ns1.example.tst.
11.  
12. ;; ADDITIONAL SECTION:
13. ns1.example.tst. 86400 IN A 172.16.1.3

3. Test MX Record with dig

1. # dig example.tst mx

1. ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 35405
2.  
3. ;; QUESTION SECTION:
4. ;example.tst. IN MX
5.  
6. ;; ANSWER SECTION:
7. example.tst. 14366 IN MX 10 mail.example.tst.

Troubleshooting Tips

1. I have disabled SELinux.
2. Ensure firewall is not blocking UDP port 53.
3. If errors occur, check /var/log/messages for useful info.
4. Ensure zone file owner is‘named’
5. Ensure the DNS server IP is the first entry in /etc/resolv.conf.
6. If using example.tst for testing, disconnect from the internet as it is a non-existent domain.

In summary, this tutorial focuses on configuring example.tst for demonstration. Note this creates an open DNS server. For production, check policies for public DNS servers. Other tutorials coverCreating a Secondary DNS Server, Restricting Access to the DNS Serverand Deploying DNSSEC.

Hope this tutorial helps.

via: http://xmodulo.com/2014/04/primary-dns-server-using-centos.html