19.5. Advanced Features of BIND
namedto provide name resolution services or to act as an authority for a particular domain or sub-domain. However, BIND version 9 has a number of advanced features that allow for a more secure and efficient DNS service.
19.5.1. DNS Protocol Enhancements
19.5.2. Multiple Views
named.conf, BIND can present different information depending on which network a request originates from.
viewstatement uses the
match-clientsoption to match IP addresses or entire networks and give them special options and zone data.
- Short for DNS SECurity, this feature allows for zones to be cryptographically signed with a zone key.In this way, the information about a specific zone can be verified as coming from a nameserver that has signed it with a particular private key, as long as the recipient has that nameserver's public key.BIND version 9 also supports the SIG(0) public/private key method of message authentication.
- Short for Transaction SIGnatures, this feature allows a transfer from master to slave only after verifying that a shared secret key exists on both nameservers.This feature strengthens the standard IP address-based method of transfer authorization. An attacker would not only need to have access to the IP address to transfer the zone, but they would also need to know the secret key.BIND version 9 also supports TKEY, which is another shared secret key method of authorizing zone transfers.
19.5.4. IP version 6
lwresdlightweight resolver daemon on all network clients. This daemon is a very efficient, caching-only nameserver which understands the new
DNAMErecords used under IPv6. Refer to the
lwresdman page for more information.