TweetFollow Us on Twitter

DIY: BIND DNS Server

Volume Number: 23 (2007)
Issue Number: 07
Column Tag: Networking

DIY: BIND DNS Server

How to turn OS X client into a full-featured DNS server

by Ben Greisler

DNS is important!

To paraphrase Steve Ballmer, "DNS! DNS! DNS!"

What is the "DNS" and why is it so danged important? DNS stands for Domain Name Service and it is the method of translating domain names to IP addresses. Almost every aspect of network usage involves some level of name services and without it problems will pop up, sometimes in ugly ways.

In this article, we will assume that you know that you need to provide DNS services for your network. There are a number of ways you can do this including using OS X Server which has BIND (Berkeley Internet Name Domain) built in, but say you don't want to spend the $500 to $1000 that OS X Server will cost? Is there a lower cost way of doing this? If you have a spare OS X client machine hanging around, the answer is yes. With just a little bit of time and some low-key effort, you can get BIND running on almost any OS X client machine.

DNS Server Basics

A common scenario is that you just bought a shiny new Xserve and in the process of setting it up you turn on DNS services and pop in a few machines that you need records for. Nice and simple. Apple has done a reasonable job of giving administrators an easy method to get DNS up and running. Some people will argue that it is too simple and basic, but it is enough for Open Directory to be happy if you are setting up an OD master and clients trying to authenticate against it. An issue comes up when you realize that best practice states that you should have two DNS servers to provide some redundancy.

The basic steps we will take are to provide a method of starting up the BIND DNS server already in OS X, provide it with the proper configuration and give it some records to work with. There are a number of files involved:

/System/Library/StartupItems/BIND/BIND
/System/Library/StartupItems/BIND/StartupParameters.plist
/etc/rndc.key
/etc/named.conf
/etc/hostconfig
/var/named/named.local
/var/named/named.ca
/var/named/localhost.zone
/var/named/db.192.168.254 (this is an example)
/var/named/greisler.org.zone (this is an example)

Some of these files exist and will need modification; others will need to be built from scratch. None of it is hard, and following the steps below will get you a running DNS server faster and easier than you would expect.

Getting Started

In this article, we will be using a machine with OS X 10.4.9 installed on it. The test domain is greisler.org. Since OS X client has BIND already installed, all we need to do is get it running; it is really straightforward. The following steps will allow BIND to start every time the machine starts using a StartupItem. We will then provide a way to control the server.

Creating the StartupItem

Open up Terminal or ssh into the machine. I know some people will be unhappy with this, but I find that logging in as root makes things a bit easier while setting up the DNS server.

Create a folder named BIND within /System/Library/StartupItems and navigate to it:

mkdir  /System/Library/StartupItems/BIND
cd  /System/Library/StartupItems/BIND

Create two files within the BIND folder:

touch BIND
touch StartupParameters.plist

Open up the BIND file in your favorite editor and drop in the following text:

#!/bin/sh
. /etc/rc.common
if [ "${DNSSERVER}" = "-YES-" ]; then
  ConsoleMessage "Starting Cheap BIND DNS Server"
  /usr/sbin/named
fi

Make BIND executable:

chmod +x BIND

Open up the StartupParameters.plist file in your favorite editor and drop in the following text:

{
  Description = "Cheap DNS Server";
  Provides = ("DNS Server");
  OrderPreference = "None";
  Messages =
  {
  start = "Starting Cheap BIND DNS Server";
  stop = "Stopping Cheap BIND DNS Server";
  };
}

Allow BIND to be controlled:

We now need to make the RNDC (Remote Name Daemon Controller) configuration files:

rndc-confgen -a

Letting OS X know that we want a DNS server to run:

Open up /etc/hostconfig in your favorite editor and drop in the following text:

DNSSERVER=-YES-

DNS Zone Files

With those steps, we have made ourselves a functional DNS server all ready to go, but now we need to give it some information on what to serve. If you have access to OS X Server, it is an easy job of setting up your configurations and copying over the various zone files. If you don't, you can use the following examples as a template and just modify them with the appropriate data for your environment. In this article, we are using greisler.org in the 192.168.254.x range as the example.

In a nutshell, we need to build a forward zone file that converts names to IP addresses, a reverse zone file that converts IP addresses to names and then we need to tell the named.conf file that they exist for usage.

Forward Zone File:

To build the forward zone file, navigate to /var/named and make a file that will contain the forward zone information:

cd /var/named
touch greisler.org.zone

Inside the file build out the zone information you need, such as:

$TTL 86400
greisler.org.   IN      SOA     nameserver.greisler.org. admin.greisler.org. (
                        2007010201
                        3h
                        1h
                        1w
                        1h )
greisler.org.              IN      NS  nameserver.greisler.org.        
greisler.org.              IN      A   192.168.254.240  
nameserver.greisler.org.   IN      A   192.168.254.240  
test.greisler.org.         IN      A   192.168.254.22  
dnsiscool.greisler.org.    IN      A   192.168.254.23  
bubba.greisler.org.        IN      A   192.168.254.24

Reverse Zone File:

To build the reverse zone file, navigate to /var/named and make a file that will contain the forward zone information:

cd /var/named
touch db.192.168.254

Inside the file build out the zone information you need, such as:

$TTL 86400
254.168.192.in-addr.arpa. IN SOA nameserver.greisler.org. admin.greisler.org. (
                        2007010203
                        3h
                        1h
                        1w
                        1h )
254.168.192.in-addr.arpa.   IN   NS   nameserver.greisler.org.        
240.254.168.192.in-addr.arpa.   IN    PTR   nameserver.greisler.org.        
22.254.168.192.in-addr.arpa.   IN   PTR    test.greisler.org.      
23.254.168.192.in-addr.arpa.   IN   PTR   dnsiscool.greisler.org. 
24.254.168.192.in-addr.arpa.   IN   PTR   bubba.greisler.org.

Modifying named.conf

To allow the DNS to recognize those zones, we need to tell /etc/named.conf about the zone files by editing /etc/named.conf and placing the following text within it:

zone "greisler.org" {
        type master;
        file "/var/named/greisler.org.zone";
        };
         
zone "254.168.192.in-addr.arpa" IN {
        file "db.192.168.254";
        type master;
};

Testing the DNS Server:

Restart the computer and test the DNS server:

nameserver:~ backup$ host -a dnsiscool
Trying "dnsiscool.greisler.org"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32764
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1
;; QUESTION SECTION:
;dnsiscool.greisler.org.      IN   ANY
;; ANSWER SECTION:
dnsiscool.greisler.org. 86400   IN      A   192.168.254.23
;; AUTHORITY SECTION:
greisler.org.          86400   IN      NS nameserver.greisler.org.
;; ADDITIONAL SECTION:
nameserver.greisler.org.86400   IN      A   192.168.254.240
Received 97 bytes from 192.168.254.240#53 in 18 ms

We can see from this example we have asked for the A records for dnsiscool.greisler.org and it returned in the answer section that its IP address is 192.168.254.23, which is what we expected. We can try this for the PTR or reverse look up records:

nameserver:~ backup$ host -a 192.168.254.23
Trying "23.254.168.192.in-addr.arpa"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21546
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1
;; QUESTION SECTION:
;23.254.168.192.in-addr.arpa.   IN   PTR
;; ANSWER SECTION:
23.254.168.192.in-addr.arpa.   86400 IN    PTR  dnsiscool.greisler.org.
;; AUTHORITY SECTION:
254.168.192.in-addr.arpa.   86400   IN   NS   nameserver.greisler.org.
;; ADDITIONAL SECTION:
nameserver.greisler.org.   86400   IN   A      192.168.254.240
Received 122 bytes from 192.168.254.240#53 in 2 ms

We asked for the PTR record for 192.168.254.23 and it returned in the answer section, dnsiscool.greisler.org. Success!

Understanding Zone Files

There are many good references on how to build a zone file, but I find that the easiest way to get started is to look at an existing file and to understand what is in it. We have the sample zone files earlier in the article, so let's dissect them and see what we find.

Forward Zone:

A forward DNS record is called an "A" record. This is the type of record that might get used when you enter a URL into a browser and the DNS system needs to find its associated IP address. Our sample forward zone file is located in /var/named and looks like this:

$TTL 86400
greisler.org.   IN      SOA     nameserver.greisler.org. admin.greisler.org. (
                        2007010201   ; serial
                        3h            ; refresh
                        1h            ; retry
                        1w            ; expiry
                        1h )         ; minimum
greisler.org.   IN      NS         nameserver.greisler.org.        
greisler.org.   IN      A          192.168.254.240  
nameserver.greisler.org.   IN      A   192.168.254.240  
test.greisler.org.   IN      A       192.168.254.22  
dnsiscool.greisler.org.   IN      A   192.168.254.23  bubba.greisler.org.   IN      A       192.168.254.24

The first line gives us the TTL or Time To Live. This is how long cached data will live on your DNS server.

The second line includes the SOA or Start Of Authority. This tells us that this 'nameserver' is authoritative for this domain. The portion that has admin.greisler.org declares the email address of the zone contact. Notice it doesn't use the standard email format we are normally used to (admin@greisler.org); It simply replaces "@" with a dot.

The following section is slightly modified from the earlier examples as I have added notations for the definitions of each line. The data in this section is mostly for use with slave DNS servers and doesn't impact us at the moment. The serial number is exactly that; it allows us to serialize the zone file for whatever usage we may want. In this case, it is the date the zone was made.

The 8th line tells us which DNS server is authoritative for the zone. We only have one listed in this example, but we typically would list two or more depending on the size of the environment.

The following lines include the actual information regarding the records we want to resolve. For example if the server "bubba.greisler.org" had the IP of 192.168.254.24, we write it out as:

bubba.greisler.org.   IN      A       192.168.254.24

Note that there is a trailing dot after the server name. Be careful with your dots and make sure they are in the right places. FYI: "IN" means Internet and is the class of record. The "A" means address.

Reverse Zone:

The reverse zone allows the DNS server to resolve IP addresses into host names. In the OS X server world, without reverse lookups many things will fail badly, such as a login to Open Directory. A reverse record is known as a pointer record or PTR. Let's look at our example:

$TTL 86400
254.168.192.in-addr.arpa. IN SOA nameserver.greisler.org. admin.greisler.org. (
                        2007010203
                        3h
                        1h
                        1w
                        1h )
254.168.192.in-addr.arpa.        IN      NS      nameserver.greisler.org.        
240.254.168.192.in-addr.arpa.    IN      PTR     nameserver.greisler.org.        
22.254.168.192.in-addr.arpa.     IN      PTR     test.greisler.org.      
23.254.168.192.in-addr.arpa.     IN      PTR     dnsiscool.greisler.org. 
24.254.168.192.in-addr.arpa.     IN      PTR     bubba.greisler.org.

Most of the information from the forward zone is the same or similar to the reverse zone except that we define the IP address first. You might have noticed that the IP addresses are listed in reverse order and have ".in-addr.arpa." tagged onto them; this is the correct formatting. Also, note the trailing dot after each host name.

The /etc/named.conf file:

The /etc/named.conf file contains the configuration information for the 'named' daemon. What was important to us was to enter the information for the new zones, forward and reverse, that we made and make 'named' aware of them. In the example below you will see the entries that begin with "zone" and how they point at the "zone file" files in /var/named.

You will see zone file entries for named.ca, localhost.zone and named.local. The named.ca file holds the DNS root server information. These are the official top-level DNS servers of the hierarchical DNS search process. The other two files provide local information, which is consistent on all machines. Basically, it defines what "localhost" and "127.0.0.1" are.

The file also contains information regarding what gets logged and where it gets logged. This may be important if you have a non-standard place you like to have the logs located. You can choose different levels of logging including: info, debug, notice, warning, error, critical, alert and emerg.

//
// Include keys file
//
include "/etc/rndc.key";
// Declares control channels to be used by the rndc utility.
//
// It is recommended that 127.0.0.1 be the only address used.
// This also allows non-privileged users on the local host to manage
// your name server.
//
// Default controls
//
controls {
        inet 127.0.0.1 port 54 allow {any;}
        keys { "rndc-key"; };
};
options {
        directory "/var/named";
        /*
         * If there is a firewall between you and nameservers you want
         * to talk to, you might need to uncomment the query-source
         * directive below.  Previous versions of BIND always asked
         * questions using port 53, but BIND 8.1 uses an unprivileged
         * port by default.
         */
        // query-source address * port 53;
};
// 
// a caching only nameserver config
// 
zone "." IN {
        type hint;
        file "named.ca";
};
zone "localhost" IN {
        type master;
        file "localhost.zone";
        allow-update { none; };
};
zone "0.0.127.in-addr.arpa" IN {
        type master;
        file "named.local";
        allow-update { none; };
};
zone "greisler.org" {
        type master;
        file "/var/named/greisler.org.zone";
        };
         
zone "254.168.192.in-addr.arpa" IN {
        file "db.192.168.254";
        type master;
};
logging {
        category default {
                _default_log;
        };
        channel _default_log  {
                file "/Library/Logs/named.log";
                severity info;
                print-time yes;
        };
};

Conclusion

There is much more to utilizing DNS itself, but we have given you the tools to build a DNS server. You can now use this server as a spare, a test bed for configurations or anything else you can think of.

A common use of DNS within a network is to refer to devices specific to our network, such as file servers. We can also put in entries for IP printers, individual workstations or anything that has an IP address. It is a lot easier to remember "3rdfloorprinter" than "172.16.23.192." It is also handy to have people hitting your email server by its internal address rather than having to go outside the network only for it to come back in.

There are many references to use when dealing with DNS. The standard reference seems to be the Liu and Albitz book, DNS and BIND. It is a great book that requires some effort to get through, but seems to do its best answering specific questions. It isn't something that you would sit down and read from front page to back at one shot, but it's content is top notch.

When doing web searches for information on BIND, it is good to know what version you are running. The latest version of OS X at the time this article was written was 9.3.2. You can check yours by typing in command line "named -v" and it will return the version:

nameserver:~ backup$ named -v  
BIND 9.3.2
Make sure you peruse the man pages for the following:
named
named.conf
rndc
rndc.conf
rndc-confgen

Gather your resources and newly minted DNS server and have at it. DNS server management is a skill that is rewarded with smoothly running systems.


Ben has been everything from a Mac user to CTO of one of the leading Macintosh professional services firms. Besides writing an occasional article for MacTech, you can find him presenting at Macworld (including a session called "DNS: Demystified, co-presented with Doug Hanley) or consulting with clients around the world. You can reach him at ben@greisler.org.

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

LibreOffice 6.4.5.2 - Free, open-source...
LibreOffice is an office suite (word processor, spreadsheet, presentations, drawing tool) compatible with other major office suites. The Document Foundation is coordinating development and... Read more
Thunderbird 68.10.0 - Email client from...
As of July 2012, Thunderbird has transitioned to a new governance model, with new features being developed by the broader free software and open source community, and security fixes and improvements... Read more
Firefox 78.0.1 - Fast, safe Web browser.
Firefox offers a fast, safe Web browsing experience. Browse quickly, securely, and effortlessly. With its industry-leading features, Firefox is the choice of Web development professionals and casual... Read more
BetterTouchTool 3.389 - Customize multi-...
BetterTouchTool adds many new, fully customizable gestures to the Magic Mouse, Multi-Touch MacBook trackpad, and Magic Trackpad. These gestures are customizable: Magic Mouse: Pinch in / out (zoom)... Read more
Slack 4.7.0 - Collaborative communicatio...
Slack brings team communication and collaboration into one place so you can get more work done, whether you belong to a large enterprise or a small business. Check off your to-do list and move your... Read more
OsiriX Lite 11.0.3 - 3D medical image pr...
OsiriX Lite is an image processing software dedicated to DICOM images (".dcm" / ".DCM" extension) produced by medical equipment (MRI, CT, PET, PET-CT, ...) and confocal microscopy (LSM and BioRAD-PIC... Read more
Wireshark 3.2.5 - Network protocol analy...
Wireshark is one of the world's foremost network protocol analyzers, and is the standard in many parts of the industry. It is the continuation of a project that started in 1998. Hundreds of... Read more
Dabble 1.6.1 - Organize your manuscript,...
Dabble organizes your manuscript, story notes, and plot. Dabble simplifies the story, leaving more room in your brain to create, which is what being a writer is really about. Organize your story.... Read more
Quicken 5.17.0 - Complete personal finan...
Quicken makes managing your money easier than ever. Whether paying bills, upgrading from Windows, enjoying more reliable downloads, or getting expert product help, Quicken's new and improved features... Read more
Tor Browser 9.5.1 - Anonymize Web browsi...
The Tor Browser Bundle is an easy-to-use portable package of Tor, Vidalia, Torbutton, and a Firefox fork preconfigured to work together out of the box. It contains a modified copy of Firefox that... Read more

Latest Forum Discussions

See All

Detective Di is a point-and-click murder...
Detective Di is a point-and-click murder mystery set in Tang Dynasty-era China. You'll take on the role of China's best-known investigator, Di Renjie, as he solves a series of grisly murders that will ultimately lead him on a collision course with... | Read more »
Dissidia Final Fantasy Opera Omnia is se...
Dissidia Final Fantasy Opera Omnia, one of Square Enix's many popular mobile RPGs, has announced a plethora of in-game events that are set to take place over the summer. This will include several rewards, Free Multi Draws and more. [Read more] | Read more »
Sphaze is a neat-looking puzzler where y...
Sphaze is a neat-looking puzzler where you'll work to guide robots through increasingly elaborate mazes. It's set in a visually distinct world that's equal parts fantasy and sci-fi, and it's finally launched today for iOS and Android devices. [... | Read more »
Apple Arcade is in trouble
Yesterday, Bloomberg reported that Apple is disappointed in the performance of Apple Arcade and will be shifting their approach to the service by focusing on games that can retain subscribers and canceling other upcoming releases that don't fit... | Read more »
Pixel Petz, an inventive platform for de...
Pixel Petz has built up a sizeable player base thanks to its layered, easy-to-understand creative tools and friendly social experience. It revolves around designing, trading, and playing with a unique collection of pixel art pets, and it's out now... | Read more »
The King of Fighters Allstar's late...
The King of Fighters ALLSTAR, Netmarble's popular action RPG, has once again been updated with a plethora of new content. This includes battle cards, events and 21 new fighters, which increases the already sizeable roster even more. [Read more] | Read more »
Romancing SaGa Re;univerSe, the mobile s...
Square Enix latest mobile spin-off Romancing SaGa Re;univerSe is available now globally for both iOS and Android. It initially launched in Japan back in 2018 where it's proven to be incredibly popular, so now folks in the West can finally see what... | Read more »
Away: Journey to the Unexpected is a sto...
Away: Journey to the Unexpected looks really quite lovely. Stylish, cute, and clearly heavily inspired by Japanese animation, it's amongst the best-looking mobile games on the horizon. Developed by a two-person team, this story-driven rogue-lite... | Read more »
Black Desert Mobile is giving away free...
Pearl Abyss has just announced that it will continue to offer special in-game rewards to Black Desert Mobile players who also happen to be Amazon Prime subscribers. The rewards will be sent out over the next three months, and today's news comes... | Read more »
Golf on Mars "review"
| Read more »

Price Scanner via MacPrices.net

July 4th Sale: $100 off every 2020 13″ MacBoo...
Apple resellers have new 2020 13″ MacBook Airs on sale for $100 off Apple’s MSRP as part of their July 4th sales. Starting at $899, these are the cheapest new 2020 MacBooks for sale anywhere: (1) B... Read more
This hidden deal on Apple’s site can save you...
Are you a local, state, or federal government employee? If so, Apple offers special government pricing on their products, including AirPods, for you as well as immediate family members. Here’s how... Read more
Apple Watch Series 3 models on sale for new l...
Amazon has Apple Watch Series 3 GPS models on sale for $30 off MSRP, starting at only $169. Their prices are the lowest available for these models from any Apple reseller. Choose Amazon as the seller... Read more
Deal Alert! Get these refurbished 2018 13″ Ma...
Apple has restocked and lowered prices on select Certified Refurbished 2018 13″ MacBook Airs, starting at only $679. Each MacBook features a new outer case, comes with a standard Apple one-year... Read more
July 4th Sale: 13″ 2.0GHz MacBook Pros for $2...
B&H Photo has new 2020 13″ 2.0GHz MacBook Pros on sale for $200 off Apple’s MSRP as part of their July 4th sale. Prices start at $1599. These are the same MacBook Pros sold by Apple in their... Read more
July 1 only: $100 off Apple iPhone 11, 11 Pro...
Boost Mobile is offering Apple iPhone 11, 11 Pro, and iPhone 11 Pro Max models for $100 off MSRP with service. Their discount reduces the cost of an iPhone 11/64GB to $599, iPhone 11 Pro to $899 for... Read more
Apple offers $50-$100 Education discount on i...
Purchase a new 12.9″ or 11″ iPad Pro at Apple using your Education discount, and Apple will take $50-$100 off their MSRP. All teachers, students, and staff of any educational institution with a .edu... Read more
Apple has Series 5 Apple Watch models availab...
Apple has Certified Refurbished Apple Watch Series 5 WiFi models available for $60 off MSRP, starting at $339. Each Watch includes Apple’s standard one-year warranty and free shipping: – 44mm Apple... Read more
Use our exclusive price trackers at MacPrices...
Looking for a new 2020 13″ MacBook Air or one of the new 2020 iPad Pros? Our Apple award-winning price trackers are the best place to look for the lowest prices and latest sales on Apple gear. Scan... Read more
Clearance Mac minis available for only $679,...
Apple reseller DataVision has clearance, previous-generation Mac minis available for up to $120 off Apple’s original MSRP, each including free shipping. Prices start at $679. DataVision charges... Read more

Jobs Board

Perioperative RN - ( *Apple* Hill Surgical C...
Perioperative RN - ( Apple Hill Surgical Center) Tracking Code 60593 Job Description Monday - Friday - Full Time Days Possible Saturdays General Summary: Under the Read more
Product Manager, *Apple* Commercial Sales -...
Product Manager, Apple Commercial Sales Austin, TX, US Requisition Number:77652 As an Apple Product Manager for the Commercial Sales team at Insight, you Read more
*Apple* Mac Product Engineer - Barclays (Uni...
Apple Mac EngineerWhippany, NJ Support the development and delivery of solutions, products, and capabilities into the Barclays environment working across technical Read more
Blue *Apple* Cafe Student Worker - Pennsylv...
…enhance your work experience. Student positions are available at the Blue Apple Cafe. Employee meal discount during working hours. Duties include food preparation, Read more
Blue *Apple* Cafe Student Worker - Fall - P...
…to enhance your work experience. Student positions are available at the Blue Apple Cafe. Employee meal discount during working hours is provided. Duties include food Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.