Where we list some real zone files
Users have suggested that I include a real example of a working domain as my explanation of what the differences between a working domain and the bogus example was was a bit unclear.
One thing about this example: Do not enter it into your name servers! Use it only to read for reference. If you want to experiment do that with the bogus example. I use this example with permission from David Bullock of LAND-5. These files were current 24th of September 1996, and might differ from what you find if you query LAND-5's name servers now. Also, keep in mind: delete the leading spaces ;-)
Here we find primary lines for the two reverse zones needed: the
127.0.0 net, as well as LAND-5's 206.6.177 subnet. And a primary line
for land-5's forward zone land-5.com. Also note that instead of
stuffing the files in a directory called pz, as I do in this
HOWTO, he puts them in a directory called zone.
; Boot file for LAND-5 name server ; directory /var/named ; ; type domain source file or host cache . root.cache primary 0.0.127.in-addr.arpa zone/127.0.0 primary 177.6.206.in-addr.arpa zone/206.6.177 primary land-5.com zone/land-5.com
Keep in mind that this file is dynamic, and the one listed here is old. You're better off using one produced now, with dig.
; <<>> DiG 2.1 <<>> ;; res options: init recurs defnam dnsrch ;; got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6 ;; flags: qr rd ra; Ques: 1, Ans: 9, Auth: 0, Addit: 9 ;; QUESTIONS: ;; ., type = NS, class = IN ;; ANSWERS: . 518357 NS H.ROOT-SERVERS.NET. . 518357 NS B.ROOT-SERVERS.NET. . 518357 NS C.ROOT-SERVERS.NET. . 518357 NS D.ROOT-SERVERS.NET. . 518357 NS E.ROOT-SERVERS.NET. . 518357 NS I.ROOT-SERVERS.NET. . 518357 NS F.ROOT-SERVERS.NET. . 518357 NS G.ROOT-SERVERS.NET. . 518357 NS A.ROOT-SERVERS.NET. ;; ADDITIONAL RECORDS: H.ROOT-SERVERS.NET. 165593 A 128.63.2.53 B.ROOT-SERVERS.NET. 165593 A 128.9.0.107 C.ROOT-SERVERS.NET. 222766 A 192.33.4.12 D.ROOT-SERVERS.NET. 165593 A 128.8.10.90 E.ROOT-SERVERS.NET. 165593 A 192.203.230.10 I.ROOT-SERVERS.NET. 165593 A 192.36.148.17 F.ROOT-SERVERS.NET. 299616 A 192.5.5.241 G.ROOT-SERVERS.NET. 165593 A 192.112.36.4 A.ROOT-SERVERS.NET. 165593 A 198.41.0.4 ;; Total query time: 250 msec ;; FROM: land-5 to SERVER: default ---- 127.0.0.1 ;; WHEN: Fri Sep 20 10:11:22 1996 ;; MSG SIZE sent: 17 rcvd: 312
Just the basics, the obligatory SOA record, and a record that maps
127.0.0.1 to localhost. Both are required. No more should be in
this file. It will probably never need to be updated, unless your
nameserver or hostmaster address changes.
@ IN SOA land-5.com. root.land-5.com. (
199609203 ; Serial
28800 ; Refresh
7200 ; Retry
604800 ; Expire
86400) ; Minimum TTL
NS land-5.com.
1 PTR localhost.
Here we see the mandatory SOA record, the needed NS records. We can see that he has a secondary name server at ns2.psi.net. This is as it should be, always have a off site secondary server as backup. We can also see that he as a master host called land-5 which takes care of all the different services, and that he's done it with CNAMEs (a alternative is using A records).
As you see from the SOA record, the zone file originates at
land-5.com, the contact person is
root@land-5.com. hostmaster is another oft used address for
the contact person. The serial number is in the customary yyyymmdd
format with todays serial number appended; this is probably the sixth
version of zone file on the 20th of September 1996. Remember that
the serial number must increase monotonically, here there is only
one digit for todays serial#, so after 9 edits he has to wait
until tomorrow before he can edit the file again. Consider using two
digits.
@ IN SOA land-5.com. root.land-5.com. (
199609206 ; serial, todays date + todays serial #
10800 ; refresh, seconds
7200 ; retry, seconds
10800 ; expire, seconds
86400 ) ; minimum, seconds
NS land-5.com.
NS ns2.psi.net.
MX 10 land-5.com. ; Primary Mail Exchanger
localhost A 127.0.0.1
router A 206.6.177.1
land-5.com. A 206.6.177.2
ns CNAME land-5.com.
ftp CNAME land-5.com.
www CNAME land-5.com.
mail CNAME land-5.com.
news CNAME land-5.com.
funn A 206.6.177.3
illusions CNAME funn.land-5.com.
@ TXT "LAND-5 Corporation"
;
; Workstations
;
ws_177200 A 206.6.177.200
MX 10 land-5.com. ; Primary Mail Host
ws_177201 A 206.6.177.201
MX 10 land-5.com. ; Primary Mail Host
ws_177202 A 206.6.177.202
MX 10 land-5.com. ; Primary Mail Host
ws_177203 A 206.6.177.203
MX 10 land-5.com. ; Primary Mail Host
ws_177204 A 206.6.177.204
MX 10 land-5.com. ; Primary Mail Host
ws_177205 A 206.6.177.205
MX 10 land-5.com. ; Primary Mail Host
; {Many repetitive definitions deleted - SNIP}
ws_177250 A 206.6.177.250
MX 10 land-5.com. ; Primary Mail Host
ws_177251 A 206.6.177.251
MX 10 land-5.com. ; Primary Mail Host
ws_177252 A 206.6.177.252
MX 10 land-5.com. ; Primary Mail Host
ws_177253 A 206.6.177.253
MX 10 land-5.com. ; Primary Mail Host
ws_177254 A 206.6.177.254
MX 10 land-5.com. ; Primary Mail Host
Another thing to note is that the workstations don't have individual names, but rather a prefix followed by the two last parts of the IP numbers. Using such a convention can simplify maintenance significantly, but can be a bit impersonal, and, in fact, be a source of disgruntlement among your customers.
I'll comment on this file after it.
@ IN SOA land-5.com. root.land-5.com. (
199609206 ; Serial
28800 ; Refresh
7200 ; Retry
604800 ; Expire
86400) ; Minimum TTL
NS land-5.com.
NS ns2.psi.net.
;
; Servers
;
1 PTR router.land-5.com.
2 PTR land-5.com.
3 PTR funn.land-5.com.
;
; Workstations
;
200 PTR ws_177200.land-5.com.
201 PTR ws_177201.land-5.com.
202 PTR ws_177202.land-5.com.
203 PTR ws_177203.land-5.com.
204 PTR ws_177204.land-5.com.
205 PTR ws_177205.land-5.com.
; {Many repetitive definitions deleted - SNIP}
250 PTR ws_177250.land-5.com.
251 PTR ws_177251.land-5.com.
252 PTR ws_177252.land-5.com.
253 PTR ws_177253.land-5.com.
254 PTR ws_177254.land-5.com.
The reverse zone is the bit of the setup that seems to cause the most grief. It is used to find the host name if you have the IP number of a machine. Example: you are an irc server and accept connections from irc clients. However you are a Norwegian irc server and so you only want to accept connections from clients in Norway and other Scandinavian countries. When you get a connection from a client the C library is able to tell you the IP number of the connecting machine because the IP number of the client is contained in all the packets that are passed over the network. Now you can call a function called gethostbyaddr that looks up the name of a host given the IP number. Gethostbyaddr will ask a DNS server, which will then traverse the DNS looking for the machine. Supposing the client connection is from ws_177200.land-5.com. The IP number the C library provides to the irc server is 206.6.177.200. To find out the name of that machine we need to find 200.177.6.206.in-addr.arpa. The DNS server will first find the arpa. servers, then find in-addr.arpa. servers, following the reverse trail through 206, then 6 and at last finding the server for the 177.6.206.in-addr.arpa zone at land-5. From which it will finally get the answer that for 200.177.6.206.in-addr.arpa we have a 'PTR ws_177200.land-5.com' record, meaning that the name that goes with 206.6.177.200 is ws_177200.land-5.com. As with the explanation of how prep.ai.mit.edu is looked up, this is slightly fictitious.
Getting back to the irc server example. The irc server only accepts connections from the Scandinavian countries, i.e., *.no, *.se, *.dk, the name ws_177200.land-5.com clearly does not match any of those, and the server will deny the connection. If there was no reverse mapping of 206.2.177.200 through the in-addr.arpa zone the server would have been unable to find the name at all and would have to settle to comparing 206.2.177.200 with *.no, *.se and *.dk, none of which will match.
Some people will tell you that reverse lookup mappings are only important for servers, or not important at all. Not so: Many ftp, news, irc and even some http (WWW) servers will not accept connections from machines that they are not able to find the name of. So reverse mappings for machines are in fact mandatory.