wk2 dns Flashcards
When is the cache in the ISP’s own caching nameservers updated?
This cache is updated periodically (generally defined by TTL, or ‘time to live’, though servers can choose to disregard these values), and if it observes that a domain’s serial number has changed, the new information will be loaded into that cache.
One of the first things to setup on the server (imo specifically cpanel server)?
One of the first things you will set up on your server is the hostname. A hostname should ideally be a publicly resolvable, fully-qualified domain name (FQDN), particularly if you intend to operate a mail server.
Break down this: host.domain.tld
An example of a fully-qualified domain name (FQDN). In this example, host is the subdomain, cpanel is the domain name, and .net is the top-level domain. In a lot of cases, instead of host you might see www. This is still considered an FQDN.
Why do remote mail servers want your hostname to be a fqdn?
Remote mail servers, in an effort to reduce the risk of spoofing and spam incidents, will very frequently rely on the ability to confirm the validity of its hostname, and its ability to verify that the server’s IP address points (via reverse lookup) back to that particular hostname.
What is TTL?
The TTL, or “time to live”, defines how long (in seconds) a zone should be cached by caching nameservers before it is checked for updates.
This acts primarily as a preference, however, because some caching name servers will set their own minimums and may ignore the TTL value defined on your server to prevent abuse and to accommodate for their individual environments.
If they have not been changed, the defaults (86400 seconds, which equates to 24 hours) will be present on initial zone creation.
What is AAAA
AAAA Records (IPv6 Address) –
cPanel environments support the use of IPv6, including its use in DNS zones via AAAA records, which function like a typical A record, except that rather than mapping a host to a typical IPv4 address (e.g.. 10.1.2.3), it would map the host to an IPv6 address.
When IPv6 is installed onto a cPanel server, DNS zones retain the original IPv4 address mapping, but a new IPv6 AAAA record is added into the zone files. The address assigned is determined by the address that is given to each account automatically by the system upon IPv6 installation.
NOTE:
At this time, only Bind and PowerDNS support IPv6.
What is CAA
CAA Records (Certification Authority Authorization) –
CAA records are for specifying which certificate authorities should be permitted to create SSL certificates for a domain.
These are inherited from the parent, so you only need to set a CAA record for example.com, which will then provide the same functionality for foo.example.com and any other subdomains of example.com.
CAA records are optional. If a domain does not have one, then any certificate authority may issue an SSL certificate for that domain.
A domain can have more than one CAA record. When there is more than one CAA record, all the listed certificate authorities are permitted to issue certificates for the domain.
Tell me about BIND/named
BIND/named is the default DNS server provided with cPanel. It is considered the most stable, and is the most prevalent in use on the internet.
All record types are supported by BIND, and it allows for significant flexibility in configuring it, which provides for most web hosting scenarios and requirements. It also provides additional IPv6 support that is not available through other selections.
One downside to the use of BIND/named is that it is more memory-intensive than the other available options, and performs a bit slower due to its need to load all of its zones with each change or start-up.
Tell me about MyDNS
NOTE: MyDNS is considered deprecated and will be removed in future versions.
MyDNS is a MySQL-based DNS server, allowing it to load faster and handle a larger quantity of zones than BIND/named.
MyDNS’s record support is more limited than BIND/named in that, while it does support the most commonly required records, it does not provide support for other alternative records such as DNSSEC.
By relying on MySQL, MyDNS can load new zones and zone changes “live”, without having to load all of its zones each time. This is a significant benefit to administrators that have very large quantities of zones.
Tell me about PowerDNS
PowerDNS is a fast nameserver with low memory usage. It is also the only nameserver that can be configured to handle DNSSEC within cPanel & WHM.
It can use any database backend, but within cPanel it uses a SQLite database for DNSSEC and the same BIND zone files that are used for the other nameserver options.
The /etc/named.conf file is used to locate the zone files. Due to a feature change in newer versions of cPanel, DNSSEC, and therefor PowerDNS can now be used in clustering.
Tell me about NSD
NOTE: NSD is considered deprecated and will be removed in future versions.
NSD, created by NLnet Labs, has a very small footprint, and is a fast option for very minimal DNS server requirements, or that need DNS functionality on very limited servers.
Because of its lightweight operation, it only supports the most commonly required DNS records, and may not be functional for more customized setups.
Recursion is also not supported in an NSD environment.
Where are the DNS zone files actually stored?
DNS zones, stored on the file system within the /var/named folder and ending in “.db” extensions, are at the core of how all DNS resolution is handled. Without a zone stored somewhere containing the correct information, a domain may as well not exist.
Because each domain requires its own zone file, the management of these can easily get out of hand on a server that frequently adds/removes domains or handles a large number of zones on a single environment.
How do you reload the named utility? (that’s dns)
rndc reload
What is ACL
Access Control List, is a list of IP addresses that are either allowed to or restricted from querying the server, based on a specific set of rules
Explain dns recursion
Recursion is the concept of passing on a received query over to another nameserver - essentially bouncing off one server onto another
