This article will go over some features in the BIND DNS service.

Enable Query Logging[edit | edit source]

Use rndc to enable query logging:

rndc querylog on

Lookups will then be dumped into /var/log/messages

To see whether rndc querylog is enabled, run:

1 rndc status
2  ...
3  query logging is ON
4  ...
5  server is up and running

This will be turned off whenever the service restarts. To enable logging by default, edit /etc/named.conf with:

1 logging {
2         channel "querylog" {
3                 file "/var/log/named-query.log";
4                 print-time yes;
5         };
6         category queries { querylog; };
7 };

Disable IPv6 Lookups[edit | edit source]

If you have querylog enabled, you may see lots of messages like:

1 May  5 12:14:44 linux named[2492]: error (network unreachable) resolving 'ns2.google.com/A/IN': 2001:503:231d::2:30#53
2 May  5 12:14:44 linux named[2492]: error (network unreachable) resolving 'ns2.google.com/AAAA/IN': 2001:503:231d::2:30#53
3 May  5 12:14:44 linux named[2492]: error (network unreachable) resolving 'ns3.google.com/A/IN': 2001:503:231d::2:30#53
4 May  5 12:14:44 linux named[2492]: error (network unreachable) resolving 'ns4.google.com/A/IN': 2001:503:231d::2:30#53
5 May  5 12:14:44 linux named[2492]: error (network unreachable) resolving 'ns3.google.com/AAAA/IN': 2001:503:231d::2:30#53
6 May  5 12:14:44 linux named[2492]: error (network unreachable) resolving 'ns1.google.com/A/IN': 2001:503:231d::2:30#53
7 May  5 12:14:57 linux named[2492]: error (network unreachable) resolving 'ns2.p42.dynect.net/A/IN': 2001:500:3::42#53

Since I don't have IPv6 on my network, it's obvious why I can't look up addresses using IPv6. To fix this on a RedHat based system, edit the config in /etc/sysconfig/named do:

1 vi /etc/sysconfig/named
2  OPTIONS="-4"

Creating 'zones' via Views[edit | edit source]

If you want to provide a set of IP addresses or subnets with a specific set of zones, use views to accomplish this. The basic syntax for a view is:

view "NetworkAB" {
	match-clients { subnetA; subnetB; };

	# Zones go here
};

You may also use acl to group multiple subnets into one 'client'.


acl subnetAB { subnetA; subnetB; };

view "NetworkAB" {
	match-clients { subnetAB; };

	# Zones go here
};

To have one specific IP address inside another view instead, use the ! operator in either the ACL definition list or the match-clients list.

acl subnetAB { ! leosIPInSubnetA/32; subnetA; subnetB; };
acl subnetLeo { leosIPInSubnetA/32; };

view "NetworkAB" {
	match-clients { subnetAB; };

	# Zones go here
};

view "LeosView" {
	match-clients { subnetLeo; };

	# Zones only Leo can see can go here
}

Troubleshooting[edit | edit source]

100% CPU Usage[edit | edit source]

If named is using 100% CPU, it might be unhappy with the managed-keys-directory at /var/named/dynamic. The directory exists with the proper permissions. Commenting out the line appears to fix the issue.