DNS Cheatsheet (dig, bind, nslookup)

dig is a command line utility that will query the domain-name system for entries, usually based on name, and return the DNS records found.

By default, dig will query the name servers as specified in the operating system configurations, i.e. according to /etc/resolv.conf

With no options, dig will do an NS query for "." which is the root server.

dig

Servers running BIND place their zone files in: /var/named

Zone file resource records contain columns of data, separated by whitespace, that define the record. All zone file resource records are assigned a particular type, which designates the record's purpose. The following types of resource records are the most commonly used:

• A - address record
• CNAME - canonical name record
• MX - mail exchange record
• NS - nameserver record
• PTR - pointer record
• SOA - Start of Authority record

The syntax of the named.conf file is as follows:

<statement-1> ["<statement-1-name>"] [<statement-1-class>] {
   <option-1>;
   <option-2>;
   <option-N>;
};

<statement-2> ["<statement-2-name>"] [<statement-2-class>] {
   <option-1>;
   <option-2>;
   <option-N>;
};

<statement-N> ["<statement-N-name>"] [<statement-N-class>] {
   <option-1>;
   <option-2>;
   <option-N>;
};

Using this syntax, you can create an actual named.conf file:

  // MASTER & CACHING NAME SERVER for EXAMPLE, INC.
  // maintained by: me myself alone
  // CHANGELOG:
  // 1. 9 july 2003 - did something
  // 2. 16 july 2003 - did something else
  // 3. 23 july 2003 - did something more
  //
  options {
    directory "/var/named";
    // version statement - inhibited for security
    // (avoids hacking any known weaknesses)	
    version "get lost";
    // optional - disables all transfers 
    // slaves allowed in zone clauses
    allow-transfer {"none";};
    // Closed DNS - permits only local IPs to issue recursive queries 
    // remove if an Open DNS required to support all users 
    // or add additional ranges 
    allow-recursion {192.168.3.0/24;};
};
//
// log to /var/log/named/example.log all events from 
// info UP in severity (no debug)
// defaults to use 3 files in rotation
// BIND 8.x logging MUST COME FIRST in this file
// BIND 9.x parses the whole file before using the log
// failure messages up to this point are in (syslog) 
// typically /var/log/messages
//
  logging{
  channel example_log{
   file "/var/log/named/example.log" versions 3 size 2m;
   severity info;
   print-severity yes;
   print-time yes;
   print-category yes;
 };
 category default{
  example_log;
 };
};
// required zone for recursive queries
zone "." {
  type hint;
  file "root.servers";
};
zone "example.com" in{
  type master;
  file "master/master.example.com";
  // enable slaves only
  allow-transfer {192.168.23.1;192.168.23.2;};
};
// required local host domain
zone "localhost" in{
  type master;
  file "master.localhost";
  allow-update{none;};
};
// localhost reverse map
zone "0.0.127.in-addr.arpa" in{
  type master;
  file "localhost.rev";
  allow-update{none;};
};
// reverse map for class C 192.168.0.0
zone "0.168.192.IN-ADDR.ARPA" in{
  type master;
  file "192.168.0.rev";
};

The following statements may be used in /etc/named.conf:

acl <acl-name> — Configures an access control list of IP addresses to be allowed or disallowed certain named services. Most of the time, individual IP addresses or IP network notation (such as 10.0.1.0/24) is used identify the exact IPs.

A few access control lists are already defined, so you do not have to configure an acl statement to define them:

any — Matches every IP address.

localhost — Matches any IP address in use by the local system.

localnets — Matches any IP address on any network to which the local system is connected .

none — Matches no IP addresses.

When utilized with other /etc/named.conf statements and their options, acl statements can be very useful in ensuring the proper use of your BIND nameserver. Consider the example in Figure 17-3.

acl black-hats { 10.0.2.0/24; 192.168.0.0/24; };

acl red-hats { 10.0.1.0/24; };

options { blackhole { black-hats; }; allow-query { red-hats; }; allow-recursion { red-hats; }; }

// SLAVE & CACHING NAME SERVER for EXAMPLE, INC.
// maintained by: me myself alone
// CHANGELOG:
// 1. 9 july 2003 - did something
// 2. 16 july 2003 - did something else
// 3. 23 july 2003 - did something more
//
options {
  directory "/var/named";
  // version statement - inhibited for security
  // (avoids hacking any known weaknesses)	
  version "not currently available";
  // allows notifies only from master
  allow-notify {192.168.0.1};
  // disables all zone transfer requests
  allow-transfer{"none"};
  // Closed DNS - permits only local IPs to issue recursive queries 
  // remove if an Open DNS required to support all users 
  // or add additional ranges 
  allow-recursion {192.168.3.0/24;};
};
//
// log to /var/log//named/example.log all events 
// from info UP in severity (no debug)
// defaults to use 3 files in rotation
// BIND 8.x logging MUST COME FIRST in this file
// BIND 9.x parses the whole file before using the log
// failure messages up to this point are in (syslog)
// typically /var/log/messages
//
  logging{
  channel example_log{
  file "/var/log/named/example.log" versions 3 size 2m;
  severity info;
  print-severity yes;
  print-time yes;
  print-category yes;
 };
 category default{
  example_log;
 };
};
// required zone for recursive queries
zone "." {
  type hint;
  file "root.servers";
};
// see notes below
zone "example.com" in{
  type slave;
  file "slave/slave.example.com";
  masters {192.168.0.1;};
};
// required local host domain
zone "localhost" in{
  type master;
  file "pri.localhost";
  allow-update{none;};
};
// localhost reverse map
zone "0.0.127.in-addr.arpa" in{
  type master;
  file "localhost.rev";
  allow-update{none;};
};
// reverse map for class C 192.168.0.0 (see notes)
zone "0.168.192.IN-ADDR.ARPA" IN {
  type slave;
  file "sec.192.168.0.rev";
  masters {192.168.0.1;};
};

A shorter easier alternative to dig is host -t a cbc.ca

host can also lookup other resource records, by specifying type, -t host -t soa www.cbc.ca host -t mx www.cbc.ca

From man page:

SYNOPSIS
     host [-aCdlnrsTUwv] [-c class] [-N ndots] [-R number] [-t type] [-W wait]
          [-m flag] [[-4] | [-6]] [-v] [-V] {name} [server]

DESCRIPTION
     host is a simple utility for performing DNS lookups. It is normally
     used to convert names to IP addresses and vice versa. When no arguments
     or options  are given, host prints a short summary of its command line
     arguments and options.

     name is the domain name that is to be looked up. It can also be a
     dotted-decimal IPv4 address or a colon-delimited IPv6 address, in which
     case host  will by default perform a reverse lookup for that address.
     server is an optional argument which is either the name or IP address of
     the name server that host should query instead of the server or servers
     listed in /etc/resolv.conf.

host -4 cbc.ca 8.8.8.8 host -t SOA cbc.ca 208.67.222.222

nslookup [-option] [name | -] [server]

nslookup -query=hinfo -timeout=10 senecacollege.ca

nslookup