Loop User Manual

Warning

This document is still a work-in-progress. Large parts of it may be inaccurate, and it may mention programs, features and configuration options that do not exist in Loop. This warning will be removed when the manual is known to be correct.

Contents

• 1. Introduction
  • 1.1. Scope of Document
  • 1.2. Organization of This Document
  • 1.3. Conventions Used in This Document
  • 1.4. The Domain Name System (DNS)
    • 1.4.1. DNS Fundamentals
    • 1.4.2. Domains and Domain Names
    • 1.4.3. Zones
    • 1.4.4. Authoritative Name Servers
      • 1.4.4.1. The Primary Master
      • 1.4.4.2. Slave Servers
      • 1.4.4.3. Stealth Servers
    • 1.4.5. Caching Name Servers
      • 1.4.5.1. Forwarding
    • 1.4.6. Name Servers in Multiple Roles
• 2. Installation
  • 2.1. Hardware Requirements
  • 2.2. Supported Platforms
    • 2.2.1. Problems with SELinux
  • 2.3. Upgrading
• 3. Operation
  • 3.1. Sample Configurations
    • 3.1.1. A Caching-only Name Server
    • 3.1.2. An Authoritative-only Name Server
  • 3.2. Load-balancing
  • 3.3. Name Server Operations
    • 3.3.1. Tools for Use With the Name Server Daemon
      • 3.3.1.1. Diagnostic Tools
      • 3.3.1.2. Administrative Tools
• 4. Programs
  • 4.1. named --- DNS nameserver that implements authoritative server and recursive resolver features
    • 4.1.1. Synopsis
    • 4.1.2. Description
    • 4.1.3. Options
    • 4.1.4. Signals
    • 4.1.5. Files
    • 4.1.6. See also
    • 4.1.7. Copyright
  • 4.2. named-journalprint --- Zone journal file printer
    • 4.2.1. Synopsis
    • 4.2.2. Description
    • 4.2.3. See also
    • 4.2.4. Copyright
  • 4.3. rndc --- Remote-control a named(8) process
    • 4.3.1. Synopsis
    • 4.3.2. Description
    • 4.3.3. Options
    • 4.3.4. Commands
    • 4.3.5. Files
    • 4.3.6. See also
    • 4.3.7. Copyright
  • 4.4. nsec3hash --- NSEC3 hash generator
    • 4.4.1. Synopsis
    • 4.4.2. Description
    • 4.4.3. Options
    • 4.4.4. Copyright
  • 4.5. arpaname --- IP address to ARPA name translator
    • 4.5.1. Synopsis
    • 4.5.2. Description
    • 4.5.3. See also
    • 4.5.4. Copyright
  • 4.6. rndc-confgen --- rndc(1) key generator
    • 4.6.1. Synopsis
    • 4.6.2. Description
    • 4.6.3. Options
    • 4.6.4. Examples
    • 4.6.5. See also
    • 4.6.6. Copyright
  • 4.7. ddns-confgen --- TSIG key generator
    • 4.7.1. Synopsis
    • 4.7.2. Description
    • 4.7.3. Options
    • 4.7.4. See also
    • 4.7.5. Copyright
  • 4.8. named-checkconf --- named.conf syntax checker
    • 4.8.1. Synopsis
    • 4.8.2. Description
    • 4.8.3. Options
    • 4.8.4. Exit status
    • 4.8.5. See also
    • 4.8.6. Copyright
  • 4.9. named-checkzone --- Zone master file syntax checker
    • 4.9.1. Synopsis
    • 4.9.2. Description
    • 4.9.3. Options
    • 4.9.4. Exit status
    • 4.9.5. See also
    • 4.9.6. Copyright
  • 4.10. named-rrchecker --- Resource records syntax checker
    • 4.10.1. Synopsis
    • 4.10.2. Description
    • 4.10.3. Options
    • 4.10.4. Examples
    • 4.10.5. See also
    • 4.10.6. Copyright
  • 4.11. dnssec-dsfromkey --- DS RR generator
    • 4.11.1. Synopsis
    • 4.11.2. Description
    • 4.11.3. Options
    • 4.11.4. Examples
    • 4.11.5. Files
    • 4.11.6. Caveat
    • 4.11.7. See also
    • 4.11.8. Copyright
  • 4.12. dnssec-importkey --- DNSKEY importer
    • 4.12.1. Synopsis
    • 4.12.2. Description
    • 4.12.3. Options
    • 4.12.4. Timing options
    • 4.12.5. Files
    • 4.12.6. See also
    • 4.12.7. Copyright
  • 4.13. dnssec-keyfromlabel --- DNSKEY importer from HSM
    • 4.13.1. Synopsis
    • 4.13.2. Description
    • 4.13.3. Options
    • 4.13.4. Timing options
    • 4.13.5. Generated key files
    • 4.13.6. See also
    • 4.13.7. Copyright
  • 4.14. dnssec-keygen --- DNSKEY and KEY generator
    • 4.14.1. Synopsis
    • 4.14.2. Description
    • 4.14.3. Options
    • 4.14.4. Timing options
    • 4.14.5. Generated key files
    • 4.14.6. Examples
    • 4.14.7. See also
    • 4.14.8. Copyright
  • 4.15. dnssec-revoke --- DNSKEY revoker
    • 4.15.1. Synopsis
    • 4.15.2. Description
    • 4.15.3. Options
    • 4.15.4. See also
    • 4.15.5. Copyright
  • 4.16. dnssec-settime --- DNSKEY timing metadata setter
    • 4.16.1. Synopsis
    • 4.16.2. Description
    • 4.16.3. Options
    • 4.16.4. Timing options
    • 4.16.5. Printing options
    • 4.16.6. See also
    • 4.16.7. Copyright
  • 4.17. dnssec-signzone --- DNSSEC zone signer
    • 4.17.1. Synopsis
    • 4.17.2. Description
    • 4.17.3. Options
    • 4.17.4. Examples
    • 4.17.5. See also
    • 4.17.6. Copyright
  • 4.18. dnssec-verify --- DNSSEC zone signature verifier
    • 4.18.1. Synopsis
    • 4.18.2. Description
    • 4.18.3. Options
    • 4.18.4. See also
    • 4.18.5. Copyright
  • 4.19. delv --- DNSSEC lookup and validation utility
    • 4.19.1. Synopsis
    • 4.19.2. Description
    • 4.19.3. Options
    • 4.19.4. Query options
    • 4.19.5. Files
    • 4.19.6. See also
    • 4.19.7. Copyright
  • 4.20. dig --- DNS client with comprehensive DNS query capabilities
    • 4.20.1. Synopsis
    • 4.20.2. Description
    • 4.20.3. Options
    • 4.20.4. Query options
    • 4.20.5. Multiple queries
    • 4.20.6. Files
    • 4.20.7. See also
    • 4.20.8. Copyright
  • 4.21. host - Simple DNS lookup client
    • 4.21.1. Synopsis
    • 4.21.2. Description
    • 4.21.3. Options
    • 4.21.4. Files
    • 4.21.5. See also
    • 4.21.6. Copyright
  • 4.22. nsupdate - DNS client to send dynamic DNS UPDATEs to a nameserver
    • 4.22.1. Synopsis
    • 4.22.2. Description
    • 4.22.3. Options
    • 4.22.4. Input commands
    • 4.22.5. Examples
    • 4.22.6. Files
    • 4.22.7. See also
    • 4.22.8. Copyright
  • 4.23. dnsperf --- DNS client that measures DNS nameserver performance
    • 4.23.1. Synopsis
    • 4.23.2. Description
      • 4.23.2.1. Configuring the name server
      • 4.23.2.2. Constructing a query input file
      • 4.23.2.3. Constructing a dynamic update input file
      • 4.23.2.4. Running the tests
    • 4.23.3. Options
    • 4.23.4. See also
    • 4.23.5. Copyright
  • 4.24. resperf --- DNS client that measures DNS resolver performance
    • 4.24.1. Synopsis
    • 4.24.2. Description
      • 4.24.2.1. How resperf works
      • 4.24.2.2. What you will need
      • 4.24.2.3. Running the test
      • 4.24.2.4. Interpreting the report
      • 4.24.2.5. Determining the server's maximum throughput
      • 4.24.2.6. Generating constant traffic
    • 4.24.3. The plot data file
    • 4.24.4. Options
    • 4.24.5. See also
    • 4.24.6. Copyright
• 5. Configuration
  • 5.1. named.conf - named program's configuration
    • 5.1.1. Description
    • 5.1.2. Configuration grammar
      • 5.1.2.1. Data types
      • 5.1.2.2. acl statement
      • 5.1.2.3. controls statement
      • 5.1.2.4. include statement
      • 5.1.2.5. key statement
      • 5.1.2.6. logging statement
        • 5.1.2.6.1. channel phrase
        • 5.1.2.6.2. category phrase
      • 5.1.2.7. managed-keys statement
      • 5.1.2.8. masters statement
      • 5.1.2.9. options statement
      • 5.1.2.10. server statement
      • 5.1.2.11. trusted-keys statement
      • 5.1.2.12. view statement
      • 5.1.2.13. zone statement
        • 5.1.2.13.1. Zone Types
        • 5.1.2.13.2. Class
        • 5.1.2.13.3. Zone Options
    • 5.1.3. Comments syntax
    • 5.1.4. Files
    • 5.1.5. See also
    • 5.1.6. Copyright
  • 5.2. rndc.conf - rndc program's configuration
    • 5.2.1. Description
    • 5.2.2. Configuration grammar
      • 5.2.2.1. key statement
      • 5.2.2.2. server statement
      • 5.2.2.3. options statement
    • 5.2.3. Comments syntax
    • 5.2.4. Examples
    • 5.2.5. Nameserver configuration
    • 5.2.6. See also
    • 5.2.7. Copyright
• 6. Features
  • 6.1. Resolver
    • 6.1.1. Smoothed round-trip time computation
    • 6.1.2. Nameserver selection
  • 6.2. DNS NOTIFY
  • 6.3. DNS UPDATE (dynamic updates)
    • 6.3.1. Journal files
  • 6.4. IXFR (incremental zone transfers)
  • 6.5. Split DNS
    • 6.5.1. Example split DNS setup
    • 6.5.2. Example split DNS setup 2
  • 6.6. TSIG (transaction signatures)
    • 6.6.1. Generating a shared key
    • 6.6.2. Loading a new key
    • 6.6.3. Instructing the server to use a key
    • 6.6.4. TSIG-based access control
    • 6.6.5. TSIG errors
  • 6.7. TKEY (transaction keys)
  • 6.8. SIG(0)
  • 6.9. DNSSEC
    • 6.9.1. Generating Keys
    • 6.9.2. Signing the Zone
    • 6.9.3. Configuring Servers
  • 6.10. DNSSEC, Dynamic Zones, and Automatic Signing
    • 6.10.1. Converting from insecure to secure
    • 6.10.2. Dynamic DNS update method
    • 6.10.3. Fully automatic zone signing
    • 6.10.4. Private-type records
    • 6.10.5. DNSKEY rollovers
    • 6.10.6. Dynamic DNS update method
    • 6.10.7. Automatic key rollovers
    • 6.10.8. NSEC3PARAM rollovers via UPDATE
    • 6.10.9. Converting from NSEC to NSEC3
    • 6.10.10. Converting from NSEC3 to NSEC
    • 6.10.11. Converting from secure to insecure
    • 6.10.12. Periodic re-signing
    • 6.10.13. NSEC3 and OPTOUT
  • 6.11. Dynamic Trust Anchor Management
    • 6.11.1. Validating Resolver
    • 6.11.2. Authoritative Server
  • 6.12. PKCS#11
  • 6.13. IPv6
    • 6.13.1. Address Lookups Using AAAA Records
    • 6.13.2. Address to Name Lookups Using Nibble Format
  • 6.14. Empty zones
  • 6.15. DNS64
  • 6.16. Forwarding queries
  • 6.17. Dual-stack Servers
  • 6.18. Access Control
  • 6.19. Interfaces
  • 6.20. Query address
  • 6.21. Zone Transfers
  • 6.22. UDP port lists
  • 6.23. Operating System Resource Limits
  • 6.24. Server Resource Limits
  • 6.25. Periodic Task Intervals
  • 6.26. RRset ordering
  • 6.27. Tuning
  • 6.28. Built-in server information zones
  • 6.29. Built-in Empty Zones
  • 6.30. Content Filtering
  • 6.31. Response Policy Zones (RPZ)
  • 6.32. Response Rate Limiting (RRL)
    • 6.32.1. Dynamic Update Policies
    • 6.32.2. Multiple views
• 7. Master Files
  • 7.1. Types of Resource Records and When to Use Them
    • 7.1.1. Resource Records
    • 7.1.2. Textual expression of RRs
  • 7.2. Discussion of MX Records
  • 7.3. Setting TTLs
  • 7.4. Inverse Mapping in IPv4
  • 7.5. Directives
    • 7.5.1. @
    • 7.5.2. $ORIGIN
    • 7.5.3. $INCLUDE
    • 7.5.4. $TTL
    • 7.5.5. $GENERATE
• 8. Statistics
  • 8.1. XML Format
  • 8.2. Counters
  • 8.3. Nameserver Counters
  • 8.4. Zone Maintenance Counters
  • 8.5. Resolver Counters
  • 8.6. Socket I/O Counters
• 9. Security considerations
  • 9.1. Access Control Lists
  • 9.2. chroot() and setuid()
    • 9.2.1. The chroot Environment
    • 9.2.2. Using the setuid Function
  • 9.3. DNS UPDATE security
  • 9.4. Control channel security
• 10. Troubleshooting
  • 10.1. Common Problems
    • 10.1.1. It's not working; how can I figure out what's wrong?
  • 10.2. Incrementing and Changing the Serial Number
• 11. Release notes
  • 11.1. Loop version numbering scheme
    • 11.1.1. Stable and development versions
  • 11.2. Loop branches
  • 11.3. History of Loop
• 12. License
• 13. Data and privacy