| Delegation is the process whereby a name server relinquishes responsibility for the resource records for a zone. Responsibility is delegated to another name server, which becomes authoritative for that zone. The name server(s) performing the delegation needs to know the name server(s) that will be authoritative for the delegated zone. I say name server(s) because, like any other domain, this delegated subdomain should have at least two name servers configured, a master and at least one slave. The process of delegation can be summarized as follows : -
Help the new master name server set up an appropriate hosts file. -
Set up the delegated master name server. -
Set up the delegated slave server. -
Configure delegated clients to reference delegated name servers. -
Make alias (CNAME) names for all delegated hostnames (optional). -
Reference the delegated name server(s) in the name server database files. -
Consider setting up a forwarders entry in the delegated domains /etc/named.conf file. Let's go through this process of delegating responsibility for all machines in the HQ subdomain of maabof.com . 17.3.1 Help the new master name server set up an appropriate hosts file What I am thinking here is to copy all the hostname/IP addresses for the HQ domain into a separate file. We could forward that on to the new master name server:
root@hpeos004[dns] cat /etc/hosts.hq # @(#)B.11.11_LRhosts $Revision: 1.9.214.1 $ $Date: 96/10/08 13:20:01 $ # # The form for each entry is: # <internet address> <official hostname> <aliases> # # For example: # 192.1.2.34 hpfcrm loghost # # See the hosts(4) manual page for more information. # Note: The entries cannot be preceded by a space. # The format described in this file is the correct format. # The original Berkeley manual page contains an error in # the format description. # 192.168.0.67 hpeos001.maabof.com hpeos001 #[no smtp] 192.168.0.65 hpeos003.maabof.com hpeos003 hp003_lan1 #[no smtp] 192.168.0.33 hpeos003.maabof.com hpeos003 hp003_lan0 #[no smtp] ::ffff:192.168.0.67 hpeos001.maabof.com hpeos001 #[no smtp] ::ffff:192.168.0.65 hpeos003.maabof.com hpeos003 hp003_lan1 #[no smtp] ::ffff:192.168.0.33 hpeos003.maabof.com hpeos003 hp003_lan0 #[no smtp] fec0:0:0:1::3 hpeos001.maabof.com hpeos001 hp1v6 #[no smtp] fec0:0:0:1::1 hpeos003.maabof.com hpeos003 hp3v6 hp3v6_lan0 #[no smtp] fec0:0:0:2::1 hpeos003.maabof.com hpeos003 hp3v6 hp3v6_lan1 #[no smtp] fe80::a00:9ff:feba:841b hpeos001.maabof.com hpeos001 hp1v6 #[no smtp] fe80::230:6eff:fe46:7bf0 hpeos003.maabof.com hpeos003 hp3v6 hp3v6_lan1 #[no smtp] fe80::230:6eff:fe5c:3ff8 hpeos003.maabof.com hpeos003 hp3v6 hp3v6_lan0 #[no smtp] 192.168.0.21 hq021.maabof.com hq021 #[no smtp] 192.168.0.22 hq022.maabof.com hq022 #[no smtp] 192.168.0.23 hq023.maabof.com hq023 #[no smtp] 192.168.0.24 hq024.maabof.com hq024 #[no smtp] 192.168.0.25 hq025.maabof.com hq025 #[no smtp] 192.168.0.26 hq026.maabof.com hq026 #[no smtp] 192.168.0.27 hq027.maabof.com hq027 #[no smtp] 192.168.0.28 hq028.maabof.com hq028 #[no smtp] 192.168.0.29 hq029.maabof.com hq029 #[no smtp] 192.168.0.30 hq030.maabof.com hq030 #[no smtp] 127.0.0.1 localhost.maabof.com localhost loopback #[no smtp] root@hpeos004[dns]
The delegated master server will need to work with this file to change the domain name to be hq.maabof.com . We need to establish the delegated name servers before proceeding any further. 17.3.2 Set up the delegated master name server We need to go through the entire process of setting up the master server as we did for the parent domain. I won't go through the entire process here because it's similar to setting up the parent master server. Initially, I would take the /etc/hosts.hq file and transform the domain name into hp.maabof.com . From there, I would continue to set up the master server as before. I used the same process to set up this master server as before: I even used the same running directory: /etc/dns , although this is obviously not necessary. Here is the parameter file for my delegated master server:
root@hpeos003[dns] cat param.conf -d hq.maabof.com -n 192.168 -Z 192.168.0.65 -Z 192.168.0.33 -z 192.168.0.65 -z 192.168.0.33 -m 10:hpeos003 -s hpeos003 -s hpeos001 -b /etc/named.conf root@hpeos003[dns]
Here's the resulting /etc/named.conf file updated with my key information so I can use Transaction Signatures:
root@hpeos003[dns] cat /etc/named.conf # # type domain source file # options { directory "/etc/dns"; listen-on { any; }; listen-on-v6 { any; }; random-device "/dev/random"; }; key TSIGkey { algorithm "hmac-md5"; secret "1vK7G+mGTOLFCrBCqpIq6A5lLOqf3A1u9MFJ6+5ih/dCDgoIkyc+oa0d2N36LgoA OZIKnUEOSBAj/krrFgiOAw=="; }; controls { inet 127.0.0.1 allow { 127.0.0.1; } keys { TSIGkey; }; }; zone "0.0.127.IN-ADDR.ARPA" { type master; file "db.127.0.0"; zone "0.0.127.IN-ADDR.ARPA" { type master; file "db.127.0.0"; }; zone "IP6.INT" { type master; file "db.IP6.INT"; }; zone "hq.maabof.com" { type master; file "db.hq"; }; zone "168.192.IN-ADDR.ARPA" { type master; file "db.192.168"; }; zone "." { type hint; file "db.cache"; }; root@hpeos003[dns]
As you can see, the process is very similar to setting up our parent master server. Once it has been set up, we should have a fully functioning name server.
root@hpeos003[dns] dig hq.maabof.com NS ; <<>> DiG named 9.2.0 <<>> hq.maabof.com NS ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9317 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 15 ;; QUESTION SECTION: ;hq.maabof.com. IN NS ;; ANSWER SECTION: hq.maabof.com. 86400 IN NS hpeos001.hq.maabof.com. hq.maabof.com. 86400 IN NS hpeos003.hq.maabof.com. ;; ADDITIONAL SECTION: hpeos001.hq.maabof.com. 86400 IN A 192.168.0.67 hpeos001.hq.maabof.com. 86400 IN A6 0 fe80::a00:9ff:feba:841b hpeos001.hq.maabof.com. 86400 IN A6 0 fec0:0:0:1::3 hpeos001.hq.maabof.com. 86400 IN AAAA fec0:0:0:1::3 hpeos001.hq.maabof.com. 86400 IN AAAA fe80::a00:9ff:feba:841b hpeos003.hq.maabof.com. 86400 IN A 192.168.0.33 hpeos003.hq.maabof.com. 86400 IN A 192.168.0.65 hpeos003.hq.maabof.com. 86400 IN A6 0 fec0:0:0:1::1 hpeos003.hq.maabof.com. 86400 IN A6 0 fec0:0:0:2::1 hpeos003.hq.maabof.com. 86400 IN A6 0 fe80::230:6eff:fe46:7bf0 hpeos003.hq.maabof.com. 86400 IN A6 0 fe80::230:6eff:fe5c:3ff8 hpeos003.hq.maabof.com. 86400 IN AAAA fec0:0:0:2::1 hpeos003.hq.maabof.com. 86400 IN AAAA fe80::230:6eff:fe46:7bf0 hpeos003.hq.maabof.com. 86400 IN AAAA fe80::230:6eff:fe5c:3ff8 hpeos003.hq.maabof.com. 86400 IN AAAA fec0:0:0:1::1 ;; Query time: 7 msec ;; SERVER: 192.168.0.65#53(192.168.0.65) ;; WHEN: Wed Oct 22 12:57:31 2003 ;; MSG SIZE rcvd: 467 root@hpeos003[dns]
We need to remember to follow the same process as before; here is a quick reminder of some of the additional files involved: -
/dev/ip6 (remember to rename it) -
/etc/rndc.conf -
/etc/resolv.conf -
/etc/nsswitch.conf -
/etc/hosts.equiv , /etc/X0.hosts , /etc/mail/sendmail.cf , /etc/mail/sendmail.cw , /var/adm/inetd.sec , $HOME/.rhosts , $HOME/. netrc 17.3.3 Set up the delegated slave server I won't go through the detail here; I'll simply remind you to ensure that you have fully tested the functionality of your slave servers. This includes updating the master server and ensuring that the updates get propagated to the slave server. 17.3.4 Configure delegated clients to reference delegated name servers This is the simple process of updating /etc/resolv.conf to reference the new domain name:
root@hpeos003[] cat /etc/resolv.conf domain hq.maabof.com search hq.maabof.com maabof.com nameserver 192.168.0.33 root@hpeos003[]
Notice that I have used both the old and the new domain names in my searchlist . I want to make the transition to the new domain as simple and straightforward as possible for my users. With this searchlist, users can still enter the simple hostname and resolve it to an IP address. It is a good idea to have a similar searchlist on my parent domain as well, except with the searchlist referencing the domain names in the other order:
root@hpeos004[] cat /etc/resolv.conf domain maabof.com search maabof.com hq.maabof.com nameserver 192.168.0.35 root@hpeos004[]
17.3.5 Make alias (CNAME) names for all delegated hostnames (Optional) Here's a nice-to-do task. Many users will still know the delegated hosts via their old hostnames:
root@hpeos004[dns] nslookup hq021 Name Server: hpeos004.maabof.com Address: 192.168.0.35 Trying DNS Name: hq021.maabof.com Address: 192.168.0.21 root@hpeos004[dns]
By setting up aliases for the old hostnames, we can send all users an email detailing the upcoming changes. In the interim, users can still use the old name if they wish. In the future, we can exclude these hostnames from the parent domain resource records. First, we need to replace all the old hostname references for the delegated servers with references to the new domain name. We could use the /etc/hosts.hq file we created earlier to help the administrator in the delegate subdomain. Eventually, we want to end up with an /etc/hosts file that references the IP addresses for the delegate hosts, using their new hq.maabof.com domain name.
root@hpeos004[dns] tail /etc/hosts 192.168.0.21 hq021.hq.maabof.com hq021 #[no smtp] 192.168.0.22 hq022.hq.maabof.com hq022 #[no smtp] 192.168.0.23 hq023.hq.maabof.com hq023 #[no smtp] 192.168.0.24 hq024.hq.maabof.com hq024 #[no smtp] 192.168.0.25 hq025.hq.maabof.com hq025 #[no smtp] 192.168.0.26 hq026.hq.maabof.com hq026 #[no smtp] 192.168.0.27 hq027.hq.maabof.com hq027 #[no smtp] 192.168.0.28 hq028.hq.maabof.com hq028 #[no smtp] 192.168.0.29 hq029.hq.maabof.com hq029 #[no smtp] 192.168.0.30 hq030.hq.maabof.com hq030 #[no smtp] root@hpeos004[dns]
We can proceed in one of two ways. We can make a relatively simply change to the parameter file on the master server. We can add an option “c hq.maabof.com . This creates CNAME entries in the database file. Because we already have entries in the database files, simply using our existing parameter file does this job just as well. In fact, I much prefer it. While we are considering making changes to the parameter file, we should update the MX records for all hosts. In our case, our email server hpeos003 is moving to the delegated subdomain. We may still send emails to this machine, so we need to update only the hostname for the MX records parameter in param.conf . If we decide to separate the email services for this domain, we need to supply the new name of the mail hub:
root@hpeos004[dns] cat param.conf -d maabof.com -n 192.168 -Z 192.168.0.35 -Z 192.168.0.66 -z 192.168.0.35 -z 192.168.0.66 -m 10:hpeos003.hq.maabof.com -s hpeos004 -s hpeos002 -b /etc/named.conf root@hpeos004[dns] root@hpeos004[dns] hosts_to_named -f param.conf Translating /etc/hosts to lower case ... Creating "CNAME" data for the hq.maabof.com domain ... Collecting network data ... 192.168 Creating list of multi-homed hosts ... Creating "A" data (name to address mapping) for net 192.168 ... Creating "PTR" data (address to name mapping) for net 192.168 ... New "PTR" data is the same as the old. Removing new version ... Creating "MX" (mail exchanger) data ... Building default boot.sec.save for secondary servers ... Building default boot.sec for secondary servers ... done root@hpeos004[dns] root@hpeos004[dns] sig_named restart Name server restarted root@hpeos004[dns] root@hpeos004[dns] dig frog001.maabof.com MX ; <<>> DiG named 9.2.0 <<>> frog001.maabof.com MX ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20760 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 15 ;; QUESTION SECTION: ;frog001.maabof.com. IN MX ;; ANSWER SECTION: frog001.maabof.com. 86400 IN MX 10 hpeos003.hq.maabof.com . ;; AUTHORITY SECTION: maabof.com. 86400 IN NS hpeos002.maabof.com. maabof.com. 86400 IN NS hpeos004.maabof.com. ;; ADDITIONAL SECTION: hpeos003.hq.maabof.com. 86400 IN A6 0 fec0:0:0:2::1 hpeos003.hq.maabof.com. 86400 IN A6 0 fe80::230:6eff:fe46:7bf0 hpeos003.hq.maabof.com. 86400 IN A6 0 fe80::230:6eff:fe5c:3ff8 hpeos003.hq.maabof.com. 86400 IN A6 0 fec0:0:0:1::1 hpeos003.hq.maabof.com. 86400 IN AAAA fe80::230:6eff:fe5c:3ff8 hpeos003.hq.maabof.com. 86400 IN AAAA fec0:0:0:1::1 hpeos003.hq.maabof.com. 86400 IN AAAA fec0:0:0:2::1 hpeos003.hq.maabof.com. 86400 IN AAAA fe80::230:6eff:fe46:7bf0 hpeos002.maabof.com. 86400 IN A 192.168.0.34 hpeos002.maabof.com. 86400 IN A6 0 fe80::a00:9ff:fec2:69c6 hpeos002.maabof.com. 86400 IN A6 0 fec0:0:0:2::3 hpeos002.maabof.com. 86400 IN AAAA fe80::a00:9ff:fec2:69c6 hpeos002.maabof.com. 86400 IN AAAA fec0:0:0:2::3 hpeos004.maabof.com. 86400 IN A 192.168.0.35 hpeos004.maabof.com. 86400 IN A 192.168.0.66 ;; Query time: 6 msec ;; SERVER: 192.168.0.35#53(192.168.0.35) ;; WHEN: Wed Oct 22 13:51:57 2003 ;; MSG SIZE rcvd: 500 root@hpeos004[dns]
By restarting the daemon on the master server, this should have initiated a transfer of resource records to all the slave servers.
root@hpeos002[dns] # nslookup hq021 Name Server: hpeos002.maabof.com Address: 192.168.0.34 Trying DNS Name: hq021.hq.maabof.com Address: 192.168.0.21 Aliases: hq021.maabof.com root@hpeos002[dns] # root@hpeos002[dns] #
This allows existing users to continue to use the hostname hq021 and still be resolved to an IP address. Obviously, if the IP address of this node changes, we would need to reflect those changes in our /etc/hosts file. At that point, it may be time to rid all the HQ hosts from the parent's database files. 17.3.6 Reference the delegated name server(s) in the name server database file This is where we will probably update the database files by hand. Here are the changes I made to the db.maabof file:
root@hpeos004[dns] vi db.maabof $TTL 86400 @ IN SOA hpeos004.maabof.com. root.hpeos004.maabof.com. ( 3 ; Serial 10800 ; Refresh every 3 hours 3600 ; Retry every hour 604800 ; Expire after a week 86400 ) ; Minimum ttl of 1 day IN NS hpeos004.maabof.com. IN NS hpeos002.maabof.com. hq.maabof.com. IN NS hpeos001.hq.maabof.com. hq.maabof.com. IN NS hpeos003.hq.maabof.com. hpeos001.hq.maabof.com. IN A 192.168.0.67 hpeos003.hq.maabof.com. IN A 192.168.0.35 localhost IN A 127.0.0.1 hp003_lan0 IN CNAME hp003_lan0.hq.maabof.com. hp003_lan1 IN CNAME hp003_lan1.hq.maabof.com. hpeos001 IN CNAME hpeos001.hq.maabof.com. hpeos003 IN CNAME hpeos003.hq.maabof.com.
Once I had restarted my named daemon, I could try some resolutions .
root@hpeos004[] dig hq.maabof.com NS ; <<>> DiG named 9.2.0 <<>> hq.maabof.com NS ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51240 ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 15 ;; QUESTION SECTION: ;hq.maabof.com. IN NS ;; ANSWER SECTION: hq.maabof.com. 86400 IN NS hpeos001.hq.maabof.com. hq.maabof.com. 86400 IN NS hpeos003.hq.maabof.com. ;; ADDITIONAL SECTION: hpeos001.hq.maabof.com. 86400 IN A 192.168.0.67 hpeos001.hq.maabof.com. 86400 IN A6 0 fe80::a00:9ff:feba:841b hpeos001.hq.maabof.com. 86400 IN A6 0 fec0:0:0:1::3 hpeos001.hq.maabof.com. 86400 IN AAAA fe80::a00:9ff:feba:841b hpeos001.hq.maabof.com. 86400 IN AAAA fec0:0:0:1::3 hpeos003.hq.maabof.com. 86400 IN A 192.168.0.33 hpeos003.hq.maabof.com. 86400 IN A 192.168.0.65 hpeos003.hq.maabof.com. 86400 IN A6 0 fe80::230:6eff:fe5c:3ff8 hpeos003.hq.maabof.com. 86400 IN A6 0 fec0:0:0:1::1 hpeos003.hq.maabof.com. 86400 IN A6 0 fec0:0:0:2::1 hpeos003.hq.maabof.com. 86400 IN A6 0 fe80::230:6eff:fe46:7bf0 hpeos003.hq.maabof.com. 86400 IN AAAA fe80::230:6eff:fe5c:3ff8 hpeos003.hq.maabof.com. 86400 IN AAAA fec0:0:0:1::1 hpeos003.hq.maabof.com. 86400 IN AAAA fec0:0:0:2::1 hpeos003.hq.maabof.com. 86400 IN AAAA fe80::230:6eff:fe46:7bf0 ;; Query time: 9 msec ;; SERVER: 192.168.0.35#53(192.168.0.35) ;; WHEN: Wed Oct 22 16:55:23 2003 ;; MSG SIZE rcvd: 467 root@hpeos004[]
What might be a better idea for this special delegation data is to put it into a file in the directory /etc/dns . The file should be called spcl.maabof . In this way, we don't need to include it directly in the db.maabof file, and every time we run hosts_to_named , it will insert a $INCLUDE spcl.maabof directive into the db.maabof file.
root@hpeos004[dns] cat spcl.maabof hq.maabof.com. IN NS hpeos001.hq.maabof.com. hq.maabof.com. IN NS hpeos003.hq.maabof.com. hpeos001.hq.maabof.com. IN A 192.168.0.67 hpeos003.hq.maabof.com. IN A 192.168.0.35 root@hpeos004[dns] root@hpeos004[dns] tail db.maabof it144 IN MX 10 hpeos003.hq.maabof.com. it145 IN MX 10 hpeos003.hq.maabof.com. it146 IN MX 10 hpeos003.hq.maabof.com. it147 IN MX 10 hpeos003.hq.maabof.com. it148 IN MX 10 hpeos003.hq.maabof.com. it149 IN MX 10 hpeos003.hq.maabof.com. it150 IN MX 10 hpeos003.hq.maabof.com. it151 IN MX 10 hpeos003.hq.maabof.com. ntpdc1 IN MX 10 hpeos003.hq.maabof.com. $INCLUDE spcl.maabof root@hpeos004[dns]
Whenever we delegate another domain or the HQ domain adds another server, we can just update the spcl.maabof file. 17.3.6.1 DELEGATING NETWORK NUMBERS We have looked at delegating hostname to a subdomain. Our parent name servers will receive requests from outside our domain for hostnames within our domain. If we think about reverse lookups, i.e., IP address back to hostname, we may need to consider delegating responsibility for that zone as well. Remember, IP addresses are seen as just names within the DNS. All IP addresses are linked to the IN-ADDR.ARPA domain, so it is the responsibility of the Internet Assigned Numbers Authority (http://www.iana.org) to delegate responsibility of that zone. If you obtained a new network address from an ISP, you should talk to the ISP's representatives about delegating what is effectively a new network number and hence a new domain number under IN-ADDR.ARPA . If you obtained a new network number via the IANA (most TLDs for IPv4 addresses are already assigned), then you should talk to the relevant regional authority. See http://www.iana.org/ipaddress/ ip-addresses .htm for more details about your regional authority. 17.3.7 Consider setting up a forwarders entry in the delegated domains /etc/named.conf file The idea behind forwarders is that we don't want every name server going out onto the Internet to find IP addresses for URLs. We may have one or two machines that are allowed access (through a firewall) to the Internet, while all other servers are barred. The forwarders directive will allow an internal server to forward unanswerable requests to the server with external access. In this way, the servers with external access can build up a large cache of previously requested data. The setup of forwarders is relatively straightforward. There is nothing, as such, to change on the servers with external access. The change in configuration is to all other name servers in the network. We need to include a forwarders directive in the /etc/named.conf file and restart the named daemon. Here is an example from hpeos001 , where nodes hpeos002 and hpeos004 are acting as the forwarders :
root@hpeos001[] # more /etc/named.conf # # type domain source file # options { directory "/etc/dns"; listen-on { any; }; listen-on-v6 { any; }; random-device "/dev/random"; forwarders { 192.168.0.66; 192.168.0.34; }; }; key TSIGkey { algorithm "hmac-md5"; secret "1vK7G+mGTOLFCrBCqpIq6A5lLOqf3A1u9MFJ6+5ih/dCDgoIkyc+oa0d2N36LgoA OZIKnUEOSBAj/krrFgiOAw=="; }; controls { inet 127.0.0.1 allow { 127.0.0.1; } keys { TSIGkey; }; }; zone "0.0.127.IN-ADDR.ARPA" { ... root@hpeos001[] #
The servers with external access can have a forwarders directive as well, if they need to forward their queries to a machine in a DMZ/ bastion host (as is the case here). This is the entry from node hpeos004 :
root@hpeos004[dns] more /etc/named.conf # # type domain source file # options { directory "/etc/dns"; listen-on { any; }; listen-on-v6 { any; }; random-device "/dev/random"; forwarders { 213.1.119.101; 213.1.119.102; }; }; ... root@hpeos004[dns]
The result is that unanswerable queries will be forwarded until either someone can come up with an answer or the request times out.
root@hpeos001[] # nslookup www.keenan-consultants.co.uk Name Server: hpeos001.hq.maabof.com Address: 192.168.0.67 Trying DNS Non-authoritative answer: Name: www.keenan-consultants.co.uk Address: 212.85.249.130 root@hpeos001[] #
| 