LPIC-2 202-450: Domain Name Server

Domain Name Server (DNS) in LPIC-2 202-450 tests BIND 9 administration: authoritative zones, delegation, replication, query tools, and DNSSEC. You must read a named.conf, correct a zone file, and diagnose resolution without guessing.

Core rules

• named.conf holds options (directory, listen-on, allow-query, recursion) and zone blocks. A primary uses type master; file "db.example";; a secondary uses type slave; masters { 192.0.2.10; };.
• Every zone needs an SOA with a rising serial, NS records, and consistent glue. The serial often uses YYYYMMDDnn; slaves compare it before AXFR/IXFR.
• Reverse zones end in in-addr.arpa (IPv4) or ip6.arpa (IPv6); PTR owner names are reversed octets/nibbles.
• rndc reload, rndc status, and rndc flush require a matching rndc.key or TSIG key. dig +trace, dig @server name type, and named-checkzone are the diagnostic tools.
• DNSSEC signs a zone with dnssec-keygen and dnssec-signzone; publish the DS at the parent and keep clocks synchronized.

Worked example

Master 192.0.2.10 serves example.com; add slave 192.0.2.53. On the master allow the transfer: allow-transfer { 192.0.2.53; }; and also-notify { 192.0.2.53; };. On the slave: zone "example.com" { type slave; file "slaves/example.com.db"; masters { 192.0.2.10; }; };. Ensure the slaves/ directory is writable by named, reload, then run dig @192.0.2.53 example.com SOA. Reasoning: the slave initiates an SOA query, sees a higher serial, and pulls the zone; the master must permit TCP/53 and the ACL.

Traps

Forgetting the trailing dot makes www.example.com.example.com.; a CNAME at the zone apex breaks NS/SOA; unchanged serial prevents replication; allow-transfer { any; }; leaks the zone; and a reverse zone whose network prefix does not match the PTR records fails named-checkzone.