Re: Secondary DNS Server

1 msg	Recursive Timeout with Windows 2000 Domain Cont...
5 msg	Spam from <meldin>]
3 msg	Architecture opinions
17 msg	cannot connect
11 msg	Usage of TCP/53
2 msg	when to reload a zone with $include
10 msg	APIs for Management and More
1 msg	using a unix time stamp
2 msg	reply from unexpected source
3 msg	Get all RR's from a zone
1 msg	Question regarding bind9 named
2 msg	bug using dnssec tools
3 msg	Secondary not updating.
3 msg	BIND secondary not updating

Secondary DNS Server
\ Pilu (25 Sep 2006)
. \ Kevin Darcy (27 Sep 2006)

3 msg	Queries for host command
2 msg	High CPU Usage
7 msg	One Server, two IPs, DNS setup
3 msg	S: Example named.conf file for Win32
4 msg	File System Permissions for Windows Service Acc...

Subject:	Re: Secondary DNS Server
Group:	Bind-users
From:	Kevin Darcy
Date:	27 Sep 2006

Pilu wrote:
> Hi,
>
> I am currently upgrading my Bind DNS Server version 4.1 to 9.3 ...
>
> My secondary DNS server is hosted by our internet providers and i would
> like to be sure that zone-transfers will work perfectly after the migration.
>
> On my named.conf file, i have defined this:
>
> key "rndc-key" { algorithm hmac-md5; secret "jdhfjddf@@{#\{#\"; };
>
> controls {
> inet 127.0.0.1 allow { any; } keys { "rndc-key"; };
> };
>
>
> acl "secondary_servers" {
> 194.98.65.69;
> 194.98.65.169;
> 192.76.144.17;
> 194.128.171.100;
> };
>
> options {
>
> check-names master fail;
> check-names response ignore;
> check-names slave warn;
> directory "e:\named\zones";
> allow-transfer {"secondary_servers"; };
>
> query-source address * port 53;
> };
>
> In my zone files, i have defined secondary server ip as NS
>
> Can you please confirm that this configuration is correct?
>
>
I'd probably just start simply -- maybe just the "directory" statement
-- and then add the other features incrementally in phases. You should
only lock down your query-source if you have a firewall and/or a
firewall ruleset that requires it. As for rndc controls, check-names
settings, and restricting zone transfers, those are all just matters of
local opinion/preference/practice/convention, and I won't comment on
their "correctness".

If you want to check the syntax of the named.conf file at any point in
its evolution, then you can use the named-checkconf utility for that.

- Kevin