Installation guide

Chapter 16. Berkeley Internet Name Domain (BIND) 243
16.4.2. Multiple Views
Through the use of the view statement in /etc/named.conf, BIND allows you to configure a name-
server to answer queries for some clients in a different way than it answers them for others.
This is primarily used to deny particular types of DNS queries from clients outside of your network,
while allowing those same queries from clients on the local network.
The view statement uses the match-clients option to match IP addresses or entire networks and
give them special options and zone data.
16.4.3. Security
BIND supports a number of different methods to protect the updating and transfer of zones, on both
master and slave nameservers:
• DNSSEC — Short for DNS SECurity, this feature allows for zones to be cryptographically signed
with a zone key.
In this way, the information about a specific zone can be verified as coming from a nameserver that
has signed it with a particular private key, as long as the recipient has that nameserver’s public key.
BIND version 9 also supports the SIG(0) public/private key method of message authentication.
• TSIG — Short for Transaction SIGnatures, a shared secret key exists on the master and slave server,
verifying that a transfer from master to slave is authorized.
This feature strengthens the standard IP address-based method of transfer authorization. An attacker
would not only need to have access to the IP address to transfer the zone, but they would also need
to know the secret key.
BIND version 9 also support TKEY, which is another shared secret key method of authorizing zone
transfers.
16.4.4. IP version 6
BIND version 9 can provide nameservice in IP version 6 (IPv6) environments, through the use of A6
zone records.
If your network environment includes both IPv4 and IPv6 hosts, you should use the lwresd
lightweight resolver daemon on your network clients. This daemon is essentially a very efficient,
caching-only nameserver, which understands the new A6 and DNAME records used with IPv6. See the
lwresd man page for more information.
16.5. Common Mistakes to Avoid
It is very common for beginners to make mistakes when editing BIND configuration files or run in to
initial difficulties using named. Be sure to avoid the following problems:
• Make sure you increment the serial number when editing a zone file.
If the serial number is not incremented, your master nameserver may have the correct, new infor-
mation, but your slave nameservers will never be notified of the change or attempt to refresh their
data of that zone.
• Be careful to use ellipses and semi-colons correctly in the /etc/named.conf file.
An omitted semi-colon or unclosed ellipse section will cause named to refuse to start.