Tagged: DNS

How Do I Update The Root Hints Data File for BIND Named Server?

My local nameserver root zone file is outdated. It has no information about IPv6 and recently changed root server IP address.

How do I update my root hints data file on a Linux server?

You can download it:

wget --user=ftp --password=ftp ftp://ftp.rs.internic.net/domain/db.cache -O /etc/bind/db.root

Or you can generate it yourself:

dig +bufsize=1200 +norec NS . @a.root-servers.net | egrep -v ';|^$' | sort > /etc/bind/db.root

After all, refresh the name server:

rndc reload

After all the content of the file looks like this:

.			518400	IN	NS	a.root-servers.net.
.			518400	IN	NS	b.root-servers.net.
.			518400	IN	NS	c.root-servers.net.
.			518400	IN	NS	d.root-servers.net.
.			518400	IN	NS	e.root-servers.net.
.			518400	IN	NS	f.root-servers.net.
.			518400	IN	NS	g.root-servers.net.
.			518400	IN	NS	h.root-servers.net.
.			518400	IN	NS	i.root-servers.net.
.			518400	IN	NS	j.root-servers.net.
.			518400	IN	NS	k.root-servers.net.
.			518400	IN	NS	l.root-servers.net.
.			518400	IN	NS	m.root-servers.net.
a.root-servers.net.	518400	IN	A
a.root-servers.net.	518400	IN	AAAA	2001:503:ba3e::2:30
b.root-servers.net.	518400	IN	A
b.root-servers.net.	518400	IN	AAAA	2001:500:84::b
c.root-servers.net.	518400	IN	A
c.root-servers.net.	518400	IN	AAAA	2001:500:2::c
d.root-servers.net.	518400	IN	A
d.root-servers.net.	518400	IN	AAAA	2001:500:2d::d
e.root-servers.net.	518400	IN	A
f.root-servers.net.	518400	IN	A
f.root-servers.net.	518400	IN	AAAA	2001:500:2f::f
g.root-servers.net.	518400	IN	A
h.root-servers.net.	518400	IN	A
h.root-servers.net.	518400	IN	AAAA	2001:500:1::53
i.root-servers.net.	518400	IN	A
i.root-servers.net.	518400	IN	AAAA	2001:7fe::53
j.root-servers.net.	518400	IN	A
j.root-servers.net.	518400	IN	AAAA	2001:503:c27::2:30
k.root-servers.net.	518400	IN	A
k.root-servers.net.	518400	IN	AAAA	2001:7fd::1
l.root-servers.net.	518400	IN	A
l.root-servers.net.	518400	IN	AAAA	2001:500:3::42
m.root-servers.net.	518400	IN	A
m.root-servers.net.	518400	IN	AAAA	2001:dc3::35

This is a current list of the root name servers.

Adding a DKIM record to your DNS

Adding a DKIM record to your DNS is quite simple. Add two txt records like

_domainkey.domain.com          IN TXT o=!;r=postmaster@domain.com
selector._domainkey.domain.com IN TXT v=DKIM1;k=rsa;p=<public key>

Which means:

  • o=~ the server signs some mail
  • o=- all mail is signed, but unsigned mail should be accepted
  • o=! all mail is signed, do not accept unsigned mail
  • t=y I’m still testing
  • v=DKIM1 we use DKIM version 1
  • k=rsa it is a RSA key
  • r=<x@xx> report problems to this email address
  • p=<public key> this is my public key

Clear DNS cache on a Mac

Every Mac caches resolved DNS queries. Sometimes you get entries which create problems. To get rid of them you have to options: reboot the machine. This is the bad one. The good one is: Type the following command in the Terminal:

dscacheutil -flushcache

Hide your version of BIND

To hide your version of bind, enter the following value to your named.conf

version "[NONE]";

in the option section:

options {
directory "/var/lib/bind";
version "[NONE]";

Check the value with this command:

dig @dns.server.tld -c CH -t txt version.bind