TweetFollow Us on Twitter

DIY: BIND DNS Server

Volume Number: 23 (2007)
Issue Number: 07
Column Tag: Networking

DIY: BIND DNS Server

How to turn OS X client into a full-featured DNS server

by Ben Greisler

DNS is important!

To paraphrase Steve Ballmer, "DNS! DNS! DNS!"

What is the "DNS" and why is it so danged important? DNS stands for Domain Name Service and it is the method of translating domain names to IP addresses. Almost every aspect of network usage involves some level of name services and without it problems will pop up, sometimes in ugly ways.

In this article, we will assume that you know that you need to provide DNS services for your network. There are a number of ways you can do this including using OS X Server which has BIND (Berkeley Internet Name Domain) built in, but say you don't want to spend the $500 to $1000 that OS X Server will cost? Is there a lower cost way of doing this? If you have a spare OS X client machine hanging around, the answer is yes. With just a little bit of time and some low-key effort, you can get BIND running on almost any OS X client machine.

DNS Server Basics

A common scenario is that you just bought a shiny new Xserve and in the process of setting it up you turn on DNS services and pop in a few machines that you need records for. Nice and simple. Apple has done a reasonable job of giving administrators an easy method to get DNS up and running. Some people will argue that it is too simple and basic, but it is enough for Open Directory to be happy if you are setting up an OD master and clients trying to authenticate against it. An issue comes up when you realize that best practice states that you should have two DNS servers to provide some redundancy.

The basic steps we will take are to provide a method of starting up the BIND DNS server already in OS X, provide it with the proper configuration and give it some records to work with. There are a number of files involved:

/System/Library/StartupItems/BIND/BIND
/System/Library/StartupItems/BIND/StartupParameters.plist
/etc/rndc.key
/etc/named.conf
/etc/hostconfig
/var/named/named.local
/var/named/named.ca
/var/named/localhost.zone
/var/named/db.192.168.254 (this is an example)
/var/named/greisler.org.zone (this is an example)

Some of these files exist and will need modification; others will need to be built from scratch. None of it is hard, and following the steps below will get you a running DNS server faster and easier than you would expect.

Getting Started

In this article, we will be using a machine with OS X 10.4.9 installed on it. The test domain is greisler.org. Since OS X client has BIND already installed, all we need to do is get it running; it is really straightforward. The following steps will allow BIND to start every time the machine starts using a StartupItem. We will then provide a way to control the server.

Creating the StartupItem

Open up Terminal or ssh into the machine. I know some people will be unhappy with this, but I find that logging in as root makes things a bit easier while setting up the DNS server.

Create a folder named BIND within /System/Library/StartupItems and navigate to it:

mkdir  /System/Library/StartupItems/BIND
cd  /System/Library/StartupItems/BIND

Create two files within the BIND folder:

touch BIND
touch StartupParameters.plist

Open up the BIND file in your favorite editor and drop in the following text:

#!/bin/sh
. /etc/rc.common
if [ "${DNSSERVER}" = "-YES-" ]; then
  ConsoleMessage "Starting Cheap BIND DNS Server"
  /usr/sbin/named
fi

Make BIND executable:

chmod +x BIND

Open up the StartupParameters.plist file in your favorite editor and drop in the following text:

{
  Description = "Cheap DNS Server";
  Provides = ("DNS Server");
  OrderPreference = "None";
  Messages =
  {
  start = "Starting Cheap BIND DNS Server";
  stop = "Stopping Cheap BIND DNS Server";
  };
}

Allow BIND to be controlled:

We now need to make the RNDC (Remote Name Daemon Controller) configuration files:

rndc-confgen -a

Letting OS X know that we want a DNS server to run:

Open up /etc/hostconfig in your favorite editor and drop in the following text:

DNSSERVER=-YES-

DNS Zone Files

With those steps, we have made ourselves a functional DNS server all ready to go, but now we need to give it some information on what to serve. If you have access to OS X Server, it is an easy job of setting up your configurations and copying over the various zone files. If you don't, you can use the following examples as a template and just modify them with the appropriate data for your environment. In this article, we are using greisler.org in the 192.168.254.x range as the example.

In a nutshell, we need to build a forward zone file that converts names to IP addresses, a reverse zone file that converts IP addresses to names and then we need to tell the named.conf file that they exist for usage.

Forward Zone File:

To build the forward zone file, navigate to /var/named and make a file that will contain the forward zone information:

cd /var/named
touch greisler.org.zone

Inside the file build out the zone information you need, such as:

$TTL 86400
greisler.org.   IN      SOA     nameserver.greisler.org. admin.greisler.org. (
                        2007010201
                        3h
                        1h
                        1w
                        1h )
greisler.org.              IN      NS  nameserver.greisler.org.        
greisler.org.              IN      A   192.168.254.240  
nameserver.greisler.org.   IN      A   192.168.254.240  
test.greisler.org.         IN      A   192.168.254.22  
dnsiscool.greisler.org.    IN      A   192.168.254.23  
bubba.greisler.org.        IN      A   192.168.254.24

Reverse Zone File:

To build the reverse zone file, navigate to /var/named and make a file that will contain the forward zone information:

cd /var/named
touch db.192.168.254

Inside the file build out the zone information you need, such as:

$TTL 86400
254.168.192.in-addr.arpa. IN SOA nameserver.greisler.org. admin.greisler.org. (
                        2007010203
                        3h
                        1h
                        1w
                        1h )
254.168.192.in-addr.arpa.   IN   NS   nameserver.greisler.org.        
240.254.168.192.in-addr.arpa.   IN    PTR   nameserver.greisler.org.        
22.254.168.192.in-addr.arpa.   IN   PTR    test.greisler.org.      
23.254.168.192.in-addr.arpa.   IN   PTR   dnsiscool.greisler.org. 
24.254.168.192.in-addr.arpa.   IN   PTR   bubba.greisler.org.

Modifying named.conf

To allow the DNS to recognize those zones, we need to tell /etc/named.conf about the zone files by editing /etc/named.conf and placing the following text within it:

zone "greisler.org" {
        type master;
        file "/var/named/greisler.org.zone";
        };
         
zone "254.168.192.in-addr.arpa" IN {
        file "db.192.168.254";
        type master;
};

Testing the DNS Server:

Restart the computer and test the DNS server:

nameserver:~ backup$ host -a dnsiscool
Trying "dnsiscool.greisler.org"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32764
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1
;; QUESTION SECTION:
;dnsiscool.greisler.org.      IN   ANY
;; ANSWER SECTION:
dnsiscool.greisler.org. 86400   IN      A   192.168.254.23
;; AUTHORITY SECTION:
greisler.org.          86400   IN      NS nameserver.greisler.org.
;; ADDITIONAL SECTION:
nameserver.greisler.org.86400   IN      A   192.168.254.240
Received 97 bytes from 192.168.254.240#53 in 18 ms

We can see from this example we have asked for the A records for dnsiscool.greisler.org and it returned in the answer section that its IP address is 192.168.254.23, which is what we expected. We can try this for the PTR or reverse look up records:

nameserver:~ backup$ host -a 192.168.254.23
Trying "23.254.168.192.in-addr.arpa"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21546
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1
;; QUESTION SECTION:
;23.254.168.192.in-addr.arpa.   IN   PTR
;; ANSWER SECTION:
23.254.168.192.in-addr.arpa.   86400 IN    PTR  dnsiscool.greisler.org.
;; AUTHORITY SECTION:
254.168.192.in-addr.arpa.   86400   IN   NS   nameserver.greisler.org.
;; ADDITIONAL SECTION:
nameserver.greisler.org.   86400   IN   A      192.168.254.240
Received 122 bytes from 192.168.254.240#53 in 2 ms

We asked for the PTR record for 192.168.254.23 and it returned in the answer section, dnsiscool.greisler.org. Success!

Understanding Zone Files

There are many good references on how to build a zone file, but I find that the easiest way to get started is to look at an existing file and to understand what is in it. We have the sample zone files earlier in the article, so let's dissect them and see what we find.

Forward Zone:

A forward DNS record is called an "A" record. This is the type of record that might get used when you enter a URL into a browser and the DNS system needs to find its associated IP address. Our sample forward zone file is located in /var/named and looks like this:

$TTL 86400
greisler.org.   IN      SOA     nameserver.greisler.org. admin.greisler.org. (
                        2007010201   ; serial
                        3h            ; refresh
                        1h            ; retry
                        1w            ; expiry
                        1h )         ; minimum
greisler.org.   IN      NS         nameserver.greisler.org.        
greisler.org.   IN      A          192.168.254.240  
nameserver.greisler.org.   IN      A   192.168.254.240  
test.greisler.org.   IN      A       192.168.254.22  
dnsiscool.greisler.org.   IN      A   192.168.254.23  bubba.greisler.org.   IN      A       192.168.254.24

The first line gives us the TTL or Time To Live. This is how long cached data will live on your DNS server.

The second line includes the SOA or Start Of Authority. This tells us that this 'nameserver' is authoritative for this domain. The portion that has admin.greisler.org declares the email address of the zone contact. Notice it doesn't use the standard email format we are normally used to (admin@greisler.org); It simply replaces "@" with a dot.

The following section is slightly modified from the earlier examples as I have added notations for the definitions of each line. The data in this section is mostly for use with slave DNS servers and doesn't impact us at the moment. The serial number is exactly that; it allows us to serialize the zone file for whatever usage we may want. In this case, it is the date the zone was made.

The 8th line tells us which DNS server is authoritative for the zone. We only have one listed in this example, but we typically would list two or more depending on the size of the environment.

The following lines include the actual information regarding the records we want to resolve. For example if the server "bubba.greisler.org" had the IP of 192.168.254.24, we write it out as:

bubba.greisler.org.   IN      A       192.168.254.24

Note that there is a trailing dot after the server name. Be careful with your dots and make sure they are in the right places. FYI: "IN" means Internet and is the class of record. The "A" means address.

Reverse Zone:

The reverse zone allows the DNS server to resolve IP addresses into host names. In the OS X server world, without reverse lookups many things will fail badly, such as a login to Open Directory. A reverse record is known as a pointer record or PTR. Let's look at our example:

$TTL 86400
254.168.192.in-addr.arpa. IN SOA nameserver.greisler.org. admin.greisler.org. (
                        2007010203
                        3h
                        1h
                        1w
                        1h )
254.168.192.in-addr.arpa.        IN      NS      nameserver.greisler.org.        
240.254.168.192.in-addr.arpa.    IN      PTR     nameserver.greisler.org.        
22.254.168.192.in-addr.arpa.     IN      PTR     test.greisler.org.      
23.254.168.192.in-addr.arpa.     IN      PTR     dnsiscool.greisler.org. 
24.254.168.192.in-addr.arpa.     IN      PTR     bubba.greisler.org.

Most of the information from the forward zone is the same or similar to the reverse zone except that we define the IP address first. You might have noticed that the IP addresses are listed in reverse order and have ".in-addr.arpa." tagged onto them; this is the correct formatting. Also, note the trailing dot after each host name.

The /etc/named.conf file:

The /etc/named.conf file contains the configuration information for the 'named' daemon. What was important to us was to enter the information for the new zones, forward and reverse, that we made and make 'named' aware of them. In the example below you will see the entries that begin with "zone" and how they point at the "zone file" files in /var/named.

You will see zone file entries for named.ca, localhost.zone and named.local. The named.ca file holds the DNS root server information. These are the official top-level DNS servers of the hierarchical DNS search process. The other two files provide local information, which is consistent on all machines. Basically, it defines what "localhost" and "127.0.0.1" are.

The file also contains information regarding what gets logged and where it gets logged. This may be important if you have a non-standard place you like to have the logs located. You can choose different levels of logging including: info, debug, notice, warning, error, critical, alert and emerg.

//
// Include keys file
//
include "/etc/rndc.key";
// Declares control channels to be used by the rndc utility.
//
// It is recommended that 127.0.0.1 be the only address used.
// This also allows non-privileged users on the local host to manage
// your name server.
//
// Default controls
//
controls {
        inet 127.0.0.1 port 54 allow {any;}
        keys { "rndc-key"; };
};
options {
        directory "/var/named";
        /*
         * If there is a firewall between you and nameservers you want
         * to talk to, you might need to uncomment the query-source
         * directive below.  Previous versions of BIND always asked
         * questions using port 53, but BIND 8.1 uses an unprivileged
         * port by default.
         */
        // query-source address * port 53;
};
// 
// a caching only nameserver config
// 
zone "." IN {
        type hint;
        file "named.ca";
};
zone "localhost" IN {
        type master;
        file "localhost.zone";
        allow-update { none; };
};
zone "0.0.127.in-addr.arpa" IN {
        type master;
        file "named.local";
        allow-update { none; };
};
zone "greisler.org" {
        type master;
        file "/var/named/greisler.org.zone";
        };
         
zone "254.168.192.in-addr.arpa" IN {
        file "db.192.168.254";
        type master;
};
logging {
        category default {
                _default_log;
        };
        channel _default_log  {
                file "/Library/Logs/named.log";
                severity info;
                print-time yes;
        };
};

Conclusion

There is much more to utilizing DNS itself, but we have given you the tools to build a DNS server. You can now use this server as a spare, a test bed for configurations or anything else you can think of.

A common use of DNS within a network is to refer to devices specific to our network, such as file servers. We can also put in entries for IP printers, individual workstations or anything that has an IP address. It is a lot easier to remember "3rdfloorprinter" than "172.16.23.192." It is also handy to have people hitting your email server by its internal address rather than having to go outside the network only for it to come back in.

There are many references to use when dealing with DNS. The standard reference seems to be the Liu and Albitz book, DNS and BIND. It is a great book that requires some effort to get through, but seems to do its best answering specific questions. It isn't something that you would sit down and read from front page to back at one shot, but it's content is top notch.

When doing web searches for information on BIND, it is good to know what version you are running. The latest version of OS X at the time this article was written was 9.3.2. You can check yours by typing in command line "named -v" and it will return the version:

nameserver:~ backup$ named -v  
BIND 9.3.2
Make sure you peruse the man pages for the following:
named
named.conf
rndc
rndc.conf
rndc-confgen

Gather your resources and newly minted DNS server and have at it. DNS server management is a skill that is rewarded with smoothly running systems.


Ben has been everything from a Mac user to CTO of one of the leading Macintosh professional services firms. Besides writing an occasional article for MacTech, you can find him presenting at Macworld (including a session called "DNS: Demystified, co-presented with Doug Hanley) or consulting with clients around the world. You can reach him at ben@greisler.org.

 
AAPL
$111.78
Apple Inc.
-0.87
MSFT
$47.66
Microsoft Corpora
+0.14
GOOG
$516.35
Google Inc.
+5.25

MacTech Search:
Community Search:

Software Updates via MacUpdate

LibreOffice 4.3.5.2 - Free Open Source o...
LibreOffice is an office suite (word processor, spreadsheet, presentations, drawing tool) compatible with other major office suites. The Document Foundation is coordinating development and... Read more
CleanApp 5.0.0 Beta 5 - Application dein...
CleanApp is an application deinstaller and archiver.... Your hard drive gets fuller day by day, but do you know why? CleanApp 5 provides you with insights how to reclaim disk space. There are... Read more
Monolingual 1.6.2 - Remove unwanted OS X...
Monolingual is a program for removing unnecesary language resources from OS X, in order to reclaim several hundred megabytes of disk space. It requires a 64-bit capable Intel-based Mac and at least... Read more
NetShade 6.1 - Browse privately using an...
NetShade is an Internet security tool that conceals your IP address on the web. NetShade routes your Web connection through either a public anonymous proxy server, or one of NetShade's own dedicated... Read more
calibre 2.13 - Complete e-library manage...
Calibre is a complete e-book library manager. Organize your collection, convert your books to multiple formats, and sync with all of your devices. Let Calibre be your multi-tasking digital librarian... Read more
Mellel 3.3.7 - Powerful word processor w...
Mellel is the leading word processor for OS X and has been widely considered the industry standard since its inception. Mellel focuses on writers and scholars for technical writing and multilingual... Read more
ScreenFlow 5.0.1 - Create screen recordi...
Save 10% with the exclusive MacUpdate coupon code: AFMacUpdate10 Buy now! ScreenFlow is powerful, easy-to-use screencasting software for the Mac. With ScreenFlow you can record the contents of your... Read more
Simon 4.0 - Monitor changes and crashes...
Simon monitors websites and alerts you of crashes and changes. Select pages to monitor, choose your alert options, and customize your settings. Simon does the rest. Keep a watchful eye on your... Read more
BBEdit 11.0.2 - Powerful text and HTML e...
BBEdit is the leading professional HTML and text editor for the Mac. Specifically crafted in response to the needs of Web authors and software developers, this award-winning product provides a... Read more
ExpanDrive 4.2.1 - Access cloud storage...
ExpanDrive builds cloud storage in every application, acts just like a USB drive plugged into your Mac. With ExpanDrive, you can securely access any remote file server directly from the Finder or... Read more

Latest Forum Discussions

See All

Make your own Tribez Figures (and More)...
Make your own Tribez Figures (and More) with Toyze Posted by Jessica Fisher on December 19th, 2014 [ permalink ] Universal App - Designed for iPhone and iPad | Read more »
So Many Holiday iOS Sales Oh My Goodness...
The holiday season is in full-swing, which means a whole lot of iOS apps and games are going on sale. A bunch already have, in fact. Naturally this means we’re putting together a hand-picked list of the best discounts and sales we can find in order... | Read more »
It’s Bird vs. Bird in the New PvP Mode f...
It’s Bird vs. Bird in the New PvP Mode for Angry Birds Epic Posted by Jessica Fisher on December 19th, 2014 [ permalink ] Universal App - Designed for iPhone and iPad | Read more »
Telltale Games and Mojang Announce Minec...
Telltale Games and Mojang Announce Minecraft: Story Mode – A Telltale Games Series Posted by Jessica Fisher on December 19th, 2014 [ permalink ] | Read more »
WarChest and Splash Damage Annouce Their...
WarChest and Splash Damage Annouce Their New Game: Tempo Posted by Jessica Fisher on December 19th, 2014 [ permalink ] WarChest Ltd and Splash Damage Ltd are teaming up again to work | Read more »
BulkyPix Celebrates its 6th Anniversary...
BulkyPix Celebrates its 6th Anniversary with a Bunch of Free Games Posted by Jessica Fisher on December 19th, 2014 [ permalink ] BulkyPix has | Read more »
Indulge in Japanese cuisine in Cooking F...
Indulge in Japanese cuisine in Cooking Fever’s new sushi-themed update Posted by Simon Reed on December 19th, 2014 [ permalink ] Lithuanian developer Nordcurrent has yet again updated its restaurant simulat | Read more »
Badland Daydream Level Pack Arrives to C...
Badland Daydream Level Pack Arrives to Celebrate 20 Million Downloads Posted by Ellis Spice on December 19th, 2014 [ permalink ] | Read more »
Far Cry 4, Assassin’s Creed Unity, Desti...
Far Cry 4, Assassin’s Creed Unity, Destiny, and Beyond – AppSpy Takes a Look at AAA Companion Apps Posted by Rob Rich on December 19th, 2014 [ permalink ] These day | Read more »
A Bunch of Halfbrick Games Are Going Fre...
A Bunch of Halfbrick Games Are Going Free for the Holidays Posted by Ellis Spice on December 19th, 2014 [ permalink ] Universal App - Designed for iPhone and iPad | Read more »

Price Scanner via MacPrices.net

The Apple Store offering free next-day shippi...
The Apple Store is now offering free next-day shipping on all in stock items if ordered before 12/23/14 at 10:00am PT. Local store pickup is also available within an hour of ordering for any in stock... Read more
It’s 1992 Again At Sony Pictures, Except For...
Techcrunch’s John Biggs interviewed a Sony Pictures Entertainment (SPE) employee, who quite understandably wished to remain anonymous, regarding post-hack conditions in SPE’s L.A office, explaining “... Read more
Holiday sales this weekend: MacBook Pros for...
 B&H Photo has new MacBook Pros on sale for up to $300 off MSRP as part of their Holiday pricing. Shipping is free, and B&H charges NY sales tax only: - 15″ 2.2GHz Retina MacBook Pro: $1699... Read more
Holiday sales this weekend: MacBook Airs for...
B&H Photo has 2014 MacBook Airs on sale for up to $120 off MSRP, for a limited time, for the Thanksgiving/Christmas Holiday shopping season. Shipping is free, and B&H charges NY sales tax... Read more
Holiday sales this weekend: iMacs for up to $...
B&H Photo has 21″ and 27″ iMacs on sale for up to $200 off MSRP including free shipping plus NY sales tax only. B&H will also include a free copy of Parallels Desktop software: - 21″ 1.4GHz... Read more
Holiday sales this weekend: Mac minis availab...
B&H Photo has new 2014 Mac minis on sale for up to $80 off MSRP. Shipping is free, and B&H charges NY sales tax only: - 1.4GHz Mac mini: $459 $40 off MSRP - 2.6GHz Mac mini: $629 $70 off MSRP... Read more
Holiday sales this weekend: Mac Pros for up t...
B&H Photo has Mac Pros on sale for up to $500 off MSRP. Shipping is free, and B&H charges sales tax in NY only: - 3.7GHz 4-core Mac Pro: $2599, $400 off MSRP - 3.5GHz 6-core Mac Pro: $3499, $... Read more
Save up to $400 on MacBooks with Apple Certif...
The Apple Store has Apple Certified Refurbished 2014 MacBook Pros and MacBook Airs available for up to $400 off the cost of new models. An Apple one-year warranty is included with each model, and... Read more
Save up to $300 on Macs, $30 on iPads with Ap...
Purchase a new Mac or iPad at The Apple Store for Education and take up to $300 off MSRP. All teachers, students, and staff of any educational institution qualify for the discount. Shipping is free,... Read more
iOS and Android OS Targeted by Man-in-the-Mid...
Cloud services security provider Akamai Technologies, Inc. has released, through the company’s Prolexic Security Engineering & Research Team (PLXsert), a new cybersecurity threat advisory. The... Read more

Jobs Board

*Apple* Store Leader Program (US) - Apple, I...
…Summary Learn and grow as you explore the art of leadership at the Apple Store. You'll master our retail business inside and out through training, hands-on experience, Read more
Project Manager, *Apple* Financial Services...
**Job Summary** Apple Financial Services (AFS) offers consumers, businesses and educational institutions ways to finance Apple purchases. We work with national and Read more
*Apple* Retail - Multiple Positions (US) - A...
Sales Specialist - Retail Customer Service and Sales Transform Apple Store visitors into loyal Apple customers. When customers enter the store, you're also the Read more
*Apple* Retail - Multiple Positions (US) - A...
Sales Specialist - Retail Customer Service and Sales Transform Apple Store visitors into loyal Apple customers. When customers enter the store, you're also the Read more
*Apple* Retail - Multiple Positions (US) - A...
Job Description: Sales Specialist - Retail Customer Service and Sales Transform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.