Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

170

|

Chapter 6: Securing Domain Name Services (DNS)

This is the most common type of name lookup. It and other single-host type look-

ups are simply called queries; DNS queries are handled on UDP port 53.

Not all DNS transactions involve single-host lookups, however. Sometimes it is nec-

essary to transfer entire name-domain (zone) databases: this is called a zone transfer,

and it happens when you use the end-user command host with the

-l flag and the

command dig with query-type set to

axfr. The output from such a request is a com-

plete list of all DNS records for the requested zone.

host and dig are normally used for diagnostic purposes, however; zone transfers are

meant to be used by nameservers that are authoritative for the same domain to stay

in sync with each other (e.g., for “master to slave” updates). In fact, as we’ll discuss

shortly, a master server should refuse zone-transfer requests from any host that is not

a known and allowed slave server. Zone transfers are handled on TCP port 53.

The last general DNS concept we’ll touch on here is caching. Nameservers cache all

local zone files (i.e., their hints file plus all zone information for which they are

authoritative), plus the results of all recursive queries they’ve performed since their

last startup—that is, almost all of