10

I have Ubuntu 16 LTS

What is the purpose 0.in-addr.arpa and 255.in-addr.arpa zones in bind's default configuration?(named.conf.default-zones)

I ask here because think that these zone files are common across bind's packages on various GNU/Linux distributions, not Ubuntu specific ones.

  • 1
    They're common on BIND packages for every operating system, not just Linux. – Alnitak Jan 16 '17 at 23:54
1

The purpose of the default local zones in BIND is to stop queries for those IP ranges from leaking out onto the global internet, and to reduce load on the root name servers, per RFC 6303 "Locally Served DNS Zones".

From the introduction to that RFC:

This recommendation is made because data has shown that significant leakage of queries for these namespaces is occurring, despite instructions to restrict them, and because it has therefore become necessary to deploy sacrificial nameservers to protect the immediate
parent nameservers for these zones from excessive, unintentional query load [AS112] [RFC6304] [RFC6305]. There is every expectation that the query load will continue to increase unless steps are taken as outlined here.

Additionally, queries from clients behind badly configured firewalls that allow outgoing queries for these namespaces, but drop the responses, put a significant load on the root servers (forward zones but not reverse zones are configured). They also cause operational load for the root server operators, as they have to reply to enquiries about why the root servers are "attacking" these clients.

This should be considered the definitive reference, not least because the RFC was written by Mark Andrews, one of the main developers working on BIND.

See also the IANA Registry of Locally Served Zones, which contains the list of all (reverse) zones that should be served like this.

Since the release of BIND 9.9 in 2011, BIND9 automatically creates the default local zones at startup time, unless explicitly turned off with the empty-zones-enable flag in the named.conf file.

The IANA registry is tracked by ISC and new entries added to the current BIND sources as and when they appear.

  • So you've said the same thing as my answer but in a different way, but my answer is "out of date"? – Darren Jan 17 '17 at 7:12
  • @Alnitak, so one should include these zones in BIND, so that it can handle such queries without forwarding to root servers? – Bulat M. Jan 17 '17 at 14:14
  • 1
    @BulatM. with modern BIND versions it shouldn't be necessary - they'll be enabled automatically at start up, unless they've been disabled by your distro package with the empty-zones-enable setting in named.conf. The list of empty zones should appear in your syslog output when BIND starts. – Alnitak Jan 17 '17 at 14:54
  • 1
    @BulatM. the automatic creation of default local zones was introducing in BIND 9.9, in 2011, BTW. – Alnitak Jan 17 '17 at 14:59
  • 1
    @BulatM. depends on the BIND version - if it's 9.9 or later then there's no need for that include. – Alnitak Jan 17 '17 at 16:48
14

This from here (an MS page, but still relevant):

Reverse lookup zones enable the DNS server to be authoritative, that is, to know the answer in advance and to respond immediately to the most common name queries, eliminating unnecessary recursive queries. In accordance with pertinent Requests for Comments (RFCs), by default, the DNS server is authoritative for three reverse lookup zones:

0.in-addr.arpa (0.0.0.0)

127.in-addr.arpa (127.0.0.1 - loopback)

255.in-addr.arpa (255. 255. 255. 255 - broadcast)

In other words; the DNS server will not query an Internet based DNS server for those addresses (as they are all local addresses).

  • 3
    @BulatM.: I don't think anyone would do it deliberately, but such addresses may be caught in a more general-purpose tool, or it may happen by accident. When it does, you want the correct results. So why not implement this? – Lightness Races in Orbit Jan 16 '17 at 12:22
  • 3
    @BulatM.: I think you're looking at this backwards. You're trying to find a use case. Instead, we do things correctly per specification, then every conceivable and inconceivable use case is covered by default. – Lightness Races in Orbit Jan 16 '17 at 12:50
  • 4
    But it's perfectly reasonable to have for example a tool that shows you all listening processes on your pc and the ports, ip-addresses they are bound to and matching rDNS hostname. Such a tool will quite often try to find the hostname for "127.0.0.1", "0.0.0.0" etc. And this is just the first example I came up with. – Josef Jan 16 '17 at 14:13
  • 8
  • 2
    @Darren it's out of date because the list of zones recommended by the IETF and maintained by IANA contains about 30 entries, not just the 3 mentioned by Microsoft. This particular topic has changed quite a bit recently, and the links I've included in my answer are the definitive references. I can't answer for the other popular resolvers, but BIND does this by default for the whole IANA list. – Alnitak Jan 17 '17 at 9:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.