Contents CIDR IPv6 Wildcard MX DNS

Size: px

Start display at page:

Download "Contents CIDR IPv6 Wildcard MX DNS"

あいりさわなか
5 years ago
Views:

1 9. DNS

2 Contents CIDR IPv6 Wildcard MX DNS

3 DNS (Domain Name System) IP

4 ( ) ( root ( ) ) jp uk com org ac ad co or kyoto-u wide nic janog ad.jp domain jp domain

5 Delegation( ) TOP domain, 2nd(3rd)-level domain NIC ( ) root root

6 1 / 1

7 root zone jp zone jp delegation ( ) net net zone co.jp zone co ad ad.jp zone x.co.jp zone x wide.ad.jp zone wide nic nic.ad.jp zone sub1 sub2 kyoto tokyo v6 v6.wide.ad.jp zone

8 () / () / Authorized / Unauthorized /

9 ( ) (cont.) ( ) ( )

10 ( ) (cont d) A B

11 Authorized Server ( ) Unauthorized Server ( )

12 ( ) ad Unauthorized ns3 ns1 ns2 ( ) Authorized Servers wide.ad.jp

13 Unauthoritative Answer ( )

14 root zone (root server) 3 jp zone jp 2 4 (ns.nic.ad.jp) root cache 5 ad ad.jp zone (ns.nic.ad.jp) 1 6 wide.ad.jp zone wide (ns.wide.ad.jp) ( ) root server root server jp zone Unauthorized Secondary

15 DNS Servers Berkeley Internet Name Domain (BIND) Server bind bind Windows NT (?)

16 named.boot (bind 4) named.conf (bind 8) named-bootconf.pl named.boot bind 8 BIND ;

17 sample of named.boot (bind 4) directory /etc/namedb ; ( ) cache. root.cache ; localhost primary localhost localhost.zone primary in-addr.arpa localhost.rev ; primary wide.ad.jp wide.zone primary in-addr.arpa wide.rev ; secondary v6.wide.ad.jp sec/v6.zone

18 sample of named.conf (bind 8) options { directory "/etc/namedb"; }; zone "." { type hint; file "root.cache"; }; zone "localhost" { type master; file "localhost.zone"; }; zone " in-addr.arpa" { type master; file "localhost.rev"; }; zone "wide.ad.jp" { type master; file "wide.zone"; }; zone " in-addr.arpa" { type master; file "wide.rev"; }; zone "v6.wide.ad.jp jp" " { type slave; file "sec/v6.zone"; masters { ; }; };

19 root cache ftp://ftp.rs.internic.net/domain/named.root 13 (1997/8) m.root-servers.net Firewall root server

20 sample of root.cache ; formerly NS.INTERNIC.NET IN NS A.ROOT-SERVERS.NET. A.ROOT-SERVERS.NET A ; ; formerly NS1.ISI.EDU NS B.ROOT-SERVERS.NET. B.ROOT-SERVERS.NET A : : ; housed in Japan, operated by WIDE NS M.ROOT-SERVERS.NET. M.ROOT-SERVERS.NET A

21 forwarders socks firewall slave forwarders ( ) slave (options forward-only or later) ( )

22 sample of localhost.zone ; $ORIGIN IN SOA ns.wide.ad.jp. postmaster.wide.ad.jp. ( 1 ; Serial number ; Refresh every 2 days 3600 ; Retry every hour ; Expire every 20 days ); Minimum 2 days ; IN NS localhost. ; IN A

23 sample of localhost.rev ; $ORIGIN IN SOA ns.wide.ad.jp. postmaster.wide.ad.jp. ( 1 ; Serial number ; Refresh every 2 days 3600 ; Retry every hour ; Expire every 20 days ); Minimum 2 days ; IN NS localhost. ; 0 IN PTR loopback-net. 1 IN PTR localhost.

24 sample of wide.zone IN SOA ns.wide.ad.jp. two.wide.ad.jp. ( ; Serial 3600 ; Refresh 900 ; Retry ; Expire 3600 ; Minimum ) IN A IN NS ns IN NS ns.tokyo IN MX 10 sh ns IN A ns.tokyo IN A

25 sample of wide.zone (cont d) sh IN A www IN CNAME endo endo IN A localhost IN CNAME localhost. v6 IN NS ns1.v6 IN NS ns2.v6 ns1.v6 IN A ns2.v6 IN A

26 key [ttl] IN r-id value1 value2... < > < > ttl - IN (class-id) - Internet Domain r-id (resource-id) (SOA, NS, A, MX,...) value (r-id )

27 key key $ORIGIN <domain> named.{boot,conf} zone $INCLUDE <filename> [<domain>] FQDN.

28 SOA (Start Of Authority) IN SOA <Pri-NS> < > ( 1 ; Serial ; Refresh (2d) 3600 ; Retry ; Expire (20d) ; Minimum TTL (2d)

29 SOA (cont.) Serial Sec-NS Refresh () Sec-NSSerial Retry () Refresh

30 SOA (cont d) Expire () nslookup *** ns.provider.ad.jp can't find x.co.jp.: Server failed Minimum TTL (time to live) () (NS )

31 Serial 32. ( ) 1.01 = ("." "000" ) ( ):RFC1912(I) (7fffffff)2

32 NS (Name Server) RR Pri-NS Sec-NS Authorized Server Unauthorized Server NS A RR glue record ( zone ) $ORIGIN ad.jp. wide IN NS ns.wide.ad.jp. ;ad.jp.zone delegation ns.wide IN A

33 lame ( ) NS Authorized Unauthoritative answer Delegation Authorized NS Authorized NS

34 A (Address) RR A RR IP $ORIGIN wide.ad.jp. sh IN A

35 MX (Mail exchanger) RR MX RR $ORIGIN IN MX 10 sh MX A ( ) A 1st-MX

36 CNAME (Canonical NAME) RR $ORIGIN wide.ad.jp. archie IN CNAME sun3.tokyo CNAME key key CNAME NS, MX CNAME

37 PTR (domain name PoinTeR) RR IP $ORIGIN in-addr.arpa. 73 IN PTR sh.wide.ad.jp. PTR

38 nslookup IP % nslookup > set q=ptr > in-addr.arpa. (4.8.3 ) nslookup % nslookup

39 RFC1101(?): DNS Encoding of Network Names and Other Types netstat -i, -r in-addr.arpa. kuins.kyoto-u.ac.jp. IN PTR kuins.kyoto-u.ac.jp. IN A IN PTR in-addr.arpa in-addr.arpa. IN PTR BASE-ADDRESS.MCAST.NET.

40 HINFO, TXT, WKS HINFO 2! NULL, MB, MG, MR, MINFO (experimental) RFC1035(S) AFSDB, ISDN, RP, RT, X25 PX RFC1183(E) RFC1664(E)

41 localhost/127.in-addr.arpa zone root server $ORIGIN localhost my.domain.jp. IN CNAME localhost localhost.my.domain.jp

42 CIDR class less /25 - A /26 - B (8 ) CNAME draft-ietf-dnsind-classless-inaddr-03.txt NS

43 Classless IN-ADDR.ARPA delegation (cont.) $ORIGIN in-addr.arpa. ; <<0-127>> /25 0/25 NS ns.a.domain.jp. 1 IN CNAME 1.0/ in-addr.arpa. 2 IN CNAME 2.0/ in-addr.arpa. : 126 IN CNAME 126.0/ in-addr.arpa.

44 Classless IN-ADDR.ARPA delegation (cont d) $ORIGIN IN SOA... IN NS ns.a.domain.jp. 1 IN PTR host1.a.domain.jp. 2 IN PTR host2.a.domain.jp. : 126 IN PTR host126.a.domain.jp.

45 DNS IPv6 (cont.) IPv6 128 CIDR 4 16 IPv4 sh.v6.wide.ad.jp. IN AAAA 3ffe:501:1000::1 $ORIGIN e.f.f.3.ip6.int IN PTR sh.v6.wide.ad.jp.

46 DNS IPv6 (cont d) named bind sendmail(?) AAAA RR v4 additional information

47 (cont.) MX RR A RR MX /etc/resolv.conf domain sub.x.co.jp search sub.x.co.jp x.co.jp co.jp 3 (MAXDFLSRCH) 2 (LOCALDOMAINPARTS) JP domain RFC1535(I)

48 (cont d) search sub1.x.co.jp sub2.x.co.jp x.co.jp LOCALDOMAIN 6 (MAXDNSRCH) nic.ad.jp nic.ad.jp.sub.x.co.jp nic.ad.jp.x.co.jp nic.ad.jp.co.jp RFC1535(I) nic.ad.jp

49 Wildcard MX is harmful exact RR ResolverOptions HasWildcardMX sendmail.cf MX RR.

50 glue 4.8.3? server A: primary of x.co.jp server B: primary of sub.x.co.jp x.co.jp NS (server C) server C glue server A server B zone transfer

51 (cont.) bad referral NS SOA NS points to a CNAME MX points to a CNAME dangling CNAME pointer CNAME Lame server on 'x.co.jp' Authorized Unauthoritative answer

52 (cont d) Response from unexpected source?? zone "xxx" (class 1) SOA serial# (nn) is < ours (mm) SOA serial! RFC1912(I): Common DNS Operational and Configuration Errors

53 (cont.) RFC1713: Tools for DNS debugging Host (bind 8 ) ftp://ftp.nikhef.nl/pub/network/host_yymmdd.tar.z Dnswalk (bind 8 ) ftp://ftp.pop.psu.edu/pub/src/dnswalk Lamers ftp://terminator.cc.umich.edu/dns/lamedelegations/

54 (cont d) Doc (Domain Obscenity Control) ftp://ftp.uu.net/networking/ip/dns/doc.2.0.tar.z DDT (Domain Debug Tools) ftp://ns.dns.pt/pub/dns/ddt tar.gz Checker ftp://catarina.usc.edu/pub/checker Dig (bind 8 )

55 IP ( ) IP RR ( ) sendmail.cf IP

56 IP (, cont.) named.boot A RR TTL (5) SOA Refresh Retry

57 IP (, cont d) A RR

58 IP (, cont.) A RR TTL, Refresh, Retry Serial

59 IP (, cont d) glue record glue

60 DNS Dynamic Update Incremental Zone Transfer (IXFR) Security Extention SIG RR, NXT RR

MUA (Mail User Agent) MTA (Mail Transfer Agent) DNS (Domain Name System) DNS MUA MTA MTA MUA MB mailbox MB

MUA (Mail User Agent) MTA (Mail Transfer Agent) DNS (Domain Name System) DNS MUA MTA MTA MUA MB mailbox MB »» SMTP MAIL FROM: 250 sender ok RCPT TO: 250 recipient