Greetings This is the action point from RIPE-28 thats in the final stage. I will be presenting this at RIPE-31 this Thursday. So any comments and suggestions will be looked at if they arrive before Thursday. Otherwise I´ll see you there. :) DNS recommendations. By: Hans Niklasson <hasse@swip.net> Amar Andersson <amar@telia.net> Scope: This documents act as a recommendation for configuring your DNS. This is NOT a requirement, only a recommendation of things to think about when setting up your DNS. Purpose: To decrease lame delegations and limit unecessary traffic due to resolving problems, among other things. To have a document for LIR:s to use for their customers instead of a number of RFC:s. Records: ----------------------------------------------------------------------------- SOA The address in this field must be a valid e-mail address to the administrator for the DNS. It's also good practise to have role address instead of personal, ie root.. admin.. hostmaster.. (when domain-administrator is leaving your company, you only change the alias for role address). Ex: foo.bar.com. IN SOA dns.foo.bar.com admin.foo.bar.com SERIAL Serial number should follow this format: YYYYMMDDXX ( year.year.year.year.month.month.day.day.nr.nr ), where XX is the number of the latest update of the zone in the same day. (Year 2000 is near.) Ex: 1998010101 ; serial TTL A good balance of this will reduce unecessary traffic between nameservers. Ex: 28800 ; refresh (8 hours) 7200 ; retry (2 hour) 1209600 ; expire (14 days) 86400 ) ; minimum (1 day) MX When pointing a domain to a mailserver/hostname, do not forget to add a record ( A ) for this. Ex: foo.bar.com. IN MX 10 mail.foo.bar.com. mail.foo.bar.com. IN A 192.168.0.1 CNAME Use this with caution. It is *not* recommended to use a CNAME for a mailservers hostname, as this can cause resolving problems and mailloops. Also it is not a good thing to use CNAMES on nameservers as this will cause unnecessary traffic on the net. A A record can only point to an IP address. PTR This is used for reverse lookup of the IP address to a hostname within the zone. Make sure that your PTR records and A records match. For each A record there has to be a PTR record, and vice versa. More tips: Unecessary glue data: Do not add unecessary glue data about hosts that is not within the zone. This can cause resolving problems if the host changes IP address. Ex: foo.bar.com. IN MX 10 mail.foo.bar.com. mail.foo.bar.com. IN A 192.168.0.1 Trailing dots: Do not forget to add a "." at the end of the domain/ hostname. If this is forgotten, this will make the DNS to add the domain name to the domain/hostname again. This will cause resolving problems. Ex: 11 PTR foo.test will produce foo.test.7.42.666.in-addr.arpa. Illegal characters: Only a-z , 0-9 and - is valid to use. The domain system allows a label to contain any 8-bit character. Although the domain system has no restrictions, other protocols such as SMTP do have name restrictions. Because of other protocol restrictions, only the above characters are recommended for use in a host name (besides the dot separator). General Points: Use the latest version of the DNS software for your platform. Check for updates regulary, as new versions has the latest solutions and information. Example on a recommended DNS: foo.bar.com IN SOA ns.foo.bar.com. root.foo.bar.com. ( 1998081900 ; serial 28800 ; refresh (8 hours) 7200 ; retry (2 hours) 1209600 ; expire (14 days) 86400 ) ; minimum (1 day) foo.bar.com. IN NS ns.foo.bar.com. foo.bar.com. IN NS ns2.foo.bar.com. foo.bar.com. IN MX 10 mail.foo.bar.com. www.foo.bar.com. IN CNAME www.webhotel.xx. www2.foo.bar.com. IN A 192.168.0.3 ns.foo.bar.com. IN A 192.168.0.1 ns2.foo.bar.com. IN A 192.168.0.4 mail.foo.bar.com. IN A 192.168.0.2 localhost IN A 127.0.0.1 Additional reading and references: RFC1537 ( RFC1912 ) ( Common DNS Operational and Configuration Errors ) RFC1033-5 RFC2181 "DNS & BIND 3nd Edition" by Paul Albitz & Cricket Liu from OReilly & Associates Inc. ftp://ftp.ripe.net/internet-drafts/draft-ietf-dnsind-classless- inaddr-04.txt ( For reverse delegation methods for blocks smaller than /24, 256 addresses ) http://www.dns.net/dnsrd/ ( DNS Resources Directory ) /Hans Niklasson ----------------------------------------------------------------- SWipNet - The Swedish IP Network
I was hoping the SOA values recomended would be reduced particuaraly the ttl to increase convergance with the implementation of notify's. I agree the refresh and the retry realy do not nee to change that much but having such a high TTL means the dns will not converge for up to 24 hours. This means that the dns reocmendaed convergance time overall has not changed. What is the point of using notify's if the resolvers are not going to keep up. Just my thoughts. Stephen Burley Senior HOSTMASTER for UUNET(UK) Internet House 332 Science Park, Milton Rd. Cambridge CB4 4BZ http://www.uk.uu.net Todays weirdness is tomorrows reasons why. On 22-Sep-98 Hans Niklasson wrote:
Greetings
This is the action point from RIPE-28 thats in the final stage. I will be presenting this at RIPE-31 this Thursday. So any comments and suggestions will be looked at if they arrive before Thursday. Otherwise I4ll see you there. :)
DNS recommendations.
By:
Hans Niklasson <hasse@swip.net> Amar Andersson <amar@telia.net>
Scope:
This documents act as a recommendation for configuring your DNS. This is NOT a requirement, only a recommendation of things to think about when setting up your DNS.
Purpose:
To decrease lame delegations and limit unecessary traffic due to resolving problems, among other things. To have a document for LIR:s to use for their customers instead of a number of RFC:s.
Records: -----------------------------------------------------------------------------
SOA The address in this field must be a valid e-mail address to the administrator for the DNS. It's also good practise to have role address instead of personal, ie root.. admin.. hostmaster.. (when domain-administrator is leaving your company, you only change the alias for role address).
Ex:
foo.bar.com. IN SOA dns.foo.bar.com admin.foo.bar.com
SERIAL Serial number should follow this format: YYYYMMDDXX ( year.year.year.year.month.month.day.day.nr.nr ), where XX is the number of the latest update of the zone in the same day. (Year 2000 is near.)
Ex:
1998010101 ; serial
TTL A good balance of this will reduce unecessary traffic between nameservers.
Ex:
28800 ; refresh (8 hours) 7200 ; retry (2 hour) 1209600 ; expire (14 days) 86400 ) ; minimum (1 day)
MX When pointing a domain to a mailserver/hostname, do not forget to add a record ( A ) for this.
Ex:
foo.bar.com. IN MX 10 mail.foo.bar.com.
mail.foo.bar.com. IN A 192.168.0.1
CNAME Use this with caution. It is *not* recommended to use a CNAME for a mailservers hostname, as this can cause resolving problems and mailloops. Also it is not a good thing to use CNAMES on nameservers as this will cause unnecessary traffic on the net.
A A record can only point to an IP address.
PTR This is used for reverse lookup of the IP address to a hostname within the zone. Make sure that your PTR records and A records match. For each A record there has to be a PTR record, and vice versa.
More tips:
Unecessary glue data:
Do not add unecessary glue data about hosts that is not within the zone. This can cause resolving problems if the host changes IP address.
Ex:
foo.bar.com. IN MX 10 mail.foo.bar.com.
mail.foo.bar.com. IN A 192.168.0.1
Trailing dots: Do not forget to add a "." at the end of the domain/ hostname. If this is forgotten, this will make the DNS to add the domain name to the domain/hostname again. This will cause resolving problems.
Ex:
11 PTR foo.test
will produce foo.test.7.42.666.in-addr.arpa.
Illegal characters:
Only a-z , 0-9 and - is valid to use. The domain system allows a label to contain any 8-bit character. Although the domain system has no restrictions, other protocols such as SMTP do have name restrictions. Because of other protocol restrictions, only the above characters are recommended for use in a host name (besides the dot separator).
General Points:
Use the latest version of the DNS software for your platform. Check for updates regulary, as new versions has the latest solutions and information.
Example on a recommended DNS:
foo.bar.com IN SOA ns.foo.bar.com. root.foo.bar.com. ( 1998081900 ; serial 28800 ; refresh (8 hours) 7200 ; retry (2 hours) 1209600 ; expire (14 days) 86400 ) ; minimum (1 day) foo.bar.com. IN NS ns.foo.bar.com.
foo.bar.com. IN NS ns2.foo.bar.com.
foo.bar.com. IN MX 10 mail.foo.bar.com.
www.foo.bar.com. IN CNAME www.webhotel.xx.
www2.foo.bar.com. IN A 192.168.0.3
ns.foo.bar.com. IN A 192.168.0.1
ns2.foo.bar.com. IN A 192.168.0.4
mail.foo.bar.com. IN A 192.168.0.2
localhost IN A 127.0.0.1
Additional reading and references:
RFC1537 ( RFC1912 ) ( Common DNS Operational and Configuration Errors )
RFC1033-5
RFC2181
"DNS & BIND 3nd Edition" by Paul Albitz & Cricket Liu from OReilly & Associates Inc.
ftp://ftp.ripe.net/internet-drafts/draft-ietf-dnsind-classless- inaddr-04.txt ( For reverse delegation methods for blocks smaller than /24, 256 addresses )
http://www.dns.net/dnsrd/ ( DNS Resources Directory )
/Hans Niklasson
----------------------------------------------------------------- SWipNet - The Swedish IP Network
Stephen Burley Senior HOSTMASTER for UUNET(UK) Internet House 332 Science Park, Milton Rd. Cambridge CB4 4BZ http://www.uk.uu.net Todays weirdness is tomorrows reasons why.
Ex:
foo.bar.com. IN SOA dns.foo.bar.com admin.foo.bar.com
Add trailing dots if this is supposed to be in master file format.
MX When pointing a domain to a mailserver/hostname, do not forget to add a record ( A ) for this.
... if and only if that target resides in the very same zone.
CNAME Use this with caution. It is *not* recommended to use a CNAME for a mailservers hostname, as this can cause resolving problems and mailloops. Also it is not a good thing to use CNAMES on nameservers as this will cause unnecessary traffic on the net.
Both are not only bad practice but forbidden by the protocol.
Unecessary glue data:
Do not add unecessary glue data about hosts that is not within the zone. This can cause resolving problems if the host changes IP address. Ex:
foo.bar.com. IN MX 10 mail.foo.bar.com.
mail.foo.bar.com. IN A 192.168.0.1
Is this an example of what *not* to do? So how does it differ from the suggestion a few lines above? Otherwise, the term "glue" data is wrong. The only valid purpose of glue A RRs is to provide for the address of a nameserver residing in the domain tree in or below the zone it is delegated.
Example on a recommended DNS:
s/DNS/zone file/
foo.bar.com IN SOA ns.foo.bar.com. root.foo.bar.com. ( 1998081900 ; serial 28800 ; refresh (8 hours) 7200 ; retry (2 hours) 1209600 ; expire (14 days) 86400 ) ; minimum (1 day) foo.bar.com. IN NS ns.foo.bar.com.
foo.bar.com. IN NS ns2.foo.bar.com.
foo.bar.com. IN MX 10 mail.foo.bar.com.
www.foo.bar.com. IN CNAME www.webhotel.xx. This cannot really be recommended. Extra zone CNAME-RRs have been the subject of long discussions and in most cases they are unnecessary. What users try to resemble by this is user-level aliasing, which is probably not a good idea here.
www2.foo.bar.com. IN A 192.168.0.3 ns.foo.bar.com. IN A 192.168.0.1 ns2.foo.bar.com. IN A 192.168.0.4
Having the zone served by only two nameservers inside that zone cannot be recommended. Especially, they're very likely connected to the same fuse, should "IP distance" reflect physical distance, which often holds :-) -Peter
participants (3)
-
Hans Niklasson -
Peter Koch -
Stephen Burley