DNS HOWTO : Forwarding

4. Forwarding

In large, well organized, academic or ISP (Internet Service Provider) networks you will sometimes find that the network people have set up a forwarder hierarchy of DNS servers which helps lighten the internal network load and the load on the outside servers as well. It's not easy to know if you're inside such a network or not. It is however not important and by using the DNS server of your network provider as a ``forwarder'' you can make the responses to queries faster and less of a load on your network. If you use a modem this can be quite a win. For the sake of this example we assume that your network provider has two name servers they want you to use, with IP numbers 10.0.0.1 and 10.1.0.1. Then, in your named.conf file, inside the opening section called ``options'', insert these lines:


           forward first;
           forwarders {
                10.0.0.1;
                10.1.0.1;
            };

There is also a nice trick for dialup machines using forwarders, it is described in the qanda section.

Restart your nameserver and test it with dig. Should work fine.

Your Comments

Comment by ChupaMe - 2001-09-10 10:23:25

Any1 knows a good doc about BIND 9?

comment
Comment by amol - 2001-09-04 03:47:29

nice document to start with .
read it and really enjoyed reading it .
regards,
amol sanglikar

Security - Preventing an attacker to know our bind version
Comment by Gabriel - 2001-04-23 10:01:41

Some versions of bind are known to have numerous exploits so we (dns admins) want to hide the bind version to make an attaker's job more difficult. Try this:

# dig @localhost version.bind chaos txt

;;ANSWER SECTION:
version.bind. OS CHAOS TXT "9.0.1"

Now add the following line to the options section of your named.conf:

version "Go Away, Lame!!!"

and try the dig command again:

# dig @localhost version.bind chaos txt

;;ANSWER SECTION
version.bind. OS CHAOS TXT "Go Away, Lame!!!"

Hope this is usefull for you guys!!!
NOTE: Obviously you can change the version string to whatever you like.

Hmmmm - not sure if I agree
Comment by nick@nexnix.co.uk - 2001-03-01 07:48:26

I'm not sure if having a machine with the same name
as the domain (as per your zone files -ie land-5.com ) is a good idea. I did it once and my ISP thought it was "scary". :-)

Also, according to my Cricket book, the SOA should
point to the primary nameserver for the domain.
ie "SOA ns.land-5.com hostmaster.land-5.com ( "
This might be explained by my first point though.

Finally, I don't think you need to declare an mx record
after each host in the domain - once per zone file is sufficent.

But I may be completely wrong and it wouldn't be the first time.
:-))

Hours of involving
Comment by Hung H Dang - 2001-02-21 01:22:01

Well, I have taken a course Linux at college for setup up a web server. But I haven't done setting up DNS server. My question is How much to involve to Set DNS for a linux's beginner to do this? And How many memory does it need for DNS server reach minimal expectation?

Re: ISP
Comment by Mike Fisher - 2001-01-09 06:19:12

It is possible, and also not at all expensive. To be an ISP however, requires quite a bit more of a capital investment. I'm not sure if you're talking about an ISP to provide a connection for just yourself or for yourself AND others.

ISP ....
Comment by Bill Scott - 2000-12-19 08:14:02

is it feasible to handle my own email ISP connection .. using Best Linux as a connection to the internet ? I am a little confused as to what I need to be my own ISP and serve my own email tired of using onemain.com ... is it feasible to be my own connection to the internet I mean money wise ?

Please share a comment:

You are posting anonymously. Create an account.

Name (optional):

Subject:

Comment:

Allowed tags in comment body: B BR I P U

convert newlines to <BR> tags

Please note that comments will be moderated. We reserve the right to delete comments that are obscene, copyrighted by someone else, or otherwise objectionable.

Please also note that your comment may be displayed alongside your name, email address and url, as supplied on your account details.