Build a forward and reverse zone that agree

short · 45 min · Objective 3.4

Task

Author a small authoritative zone with the record types the exam names, add the matching reverse zone, and prove that a name resolves forward and back. Record types are much easier to remember once you have written them.

Steps

  1. Create a forward zone file for lab.internal containing an SOA, two NS records, an A record for hostb at 192.168.20.10, an A for hosta at 192.168.10.10, a CNAME www pointing at hostb, an MX pointing at hostb, and a TXT record.
  2. Note what each is for as you write it. A maps a name to IPv4, AAAA to IPv6, CNAME aliases one name to another, MX names a mail exchanger with a priority, TXT carries arbitrary text and is where SPF, DKIM and domain verification live, NS delegates, and SOA holds the zone's serial and timers.
  3. Create the reverse zone 20.168.192.in-addr.arpa with a PTR record mapping 10 back to hostb.lab.internal.. Note the octets are reversed — that reversal is examinable and is the thing people get wrong.
  4. Add both zones to named.conf.local, check them with named-checkzone lab.internal /etc/bind/db.lab.internal, and reload.
  5. From Host A, point /etc/resolv.conf at Host B and resolve forward and reverse. Then break the serial number deliberately — decrement it — and observe that a secondary would refuse to transfer.

Verify

named-checkzone lab.internal /etc/bind/db.lab.internal
dig @192.168.20.10 hostb.lab.internal A +short
dig @192.168.20.10 www.lab.internal CNAME +short
dig @192.168.20.10 lab.internal MX +short
dig @192.168.20.10 -x 192.168.20.10 +short

named-checkzone must say OK. The A lookup must return 192.168.20.10, the CNAME must return hostb.lab.internal., and the reverse lookup (-x) must return the name. Forward and reverse agreeing is the property this lab exists to establish.

Notes

Reverse DNS matters more than its obscurity suggests. Mail servers check it, logging systems display it, and a missing PTR is a common cause of slow connections to services that try to resolve their client's address and wait for the timeout.

The SOA serial is the coordination mechanism between primary and secondary servers: a secondary transfers the zone only when the serial has increased. Forgetting to increment it after an edit is the classic "I changed the record and nothing happened" fault, and decrementing it is worse — the secondary will never update until you push past the old value.

While the zone is up, add an NTP server to Host B with chrony and point Host A at it. Time and DNS fail in the same way: quietly, and with symptoms that look like something else. Kerberos authentication breaks with about five minutes of clock skew, and TLS certificates fail validation with more.