Migrating from BIND 4 to BIND 8

If you have a BIND 4 installation you want to migrate to BIND 8, you might encounter some problems when you attempt the migration. Converting a server from BIND 4 to 8 should not be done without first testing everything under BIND 8; however, a quick test should be sufficient, and the problems should be obvious.

Configuration File Conversion

The zone files BIND 4 uses are identical to BIND 8 zone files, except for the $TTL. As of BIND 8.2.2, you don't have to have $TTLs in your zone files, but you will get several warnings if you don't have them .

The configuration file format is very different, though. Luckily, BIND 8 includes a shell script that converts your named.boot file to the named.conf file BIND 8 wants. The script is called named-bootconf and is installed in the same directory in which named is installed. This named-bootconf script is also in the source hierarchy in the directory called src/bin/named-bootconf. After generating a good named.conf file, the only thing left to do is start BIND 8, see which zones are rejected (and for what reasons), and fix all the errors and warnings.

named-bootconf is a shell script in BIND 8.2.2P5. It used to be a Perl script, and it is still included in the source tar file in the src/bin/named-bootconf/Grot. Try that if the shell script gives you problems.

CNAME

BIND 8 enforces the rules for CNAME use set forth in the DNS RFCs, which was not enforced in BIND 4. The effect is that users, unwittingly we must assume, have violated the rules. These restrictions, and how to disable them, are detailed in Chapter 3, "Maintenance and Enhancements."

Query Source

BIND 4 uses port 53 to send its queries. A number of firewalls know this, and when rules for letting DNS traffic through are installed, the rules specify source port 53. In contrast, BIND 8 does not use port 53 as the source address of queries unless you specify this in named.conf :

 options { … query-source address * port 53; … }; 

Name Checking

Versions of BIND prior to 4.9.4 perform no checking of the characters used in hostnames. On the other hand, in all BINDs from 4.9.4 on, checking is done. By default, BIND 8 rejects any master zones that do not pass muster and issues warnings about suspect slave zones. You can modify this reaction with the check-names option. The defaults is as follows :

 options { … check-names master fail; check-names slave warn; check-names response ignore; … }; 

Setting master to warn cures the immediate problem, but you really should work out a real solution to the problem.