BIND, Master, Slaves and Notify

Question

It might seem like a very basic question, but, how is a master DNS server aware of its slaves?

I mean, does it parse the zone file and determine where to send the NOTIFY message?

And if that is the case, then, is the NOTIFY mechanism broken in a hidden master setup, isn't it?

I think I'm experiencing the same issue, I'm using a hidden master, only one of my slaves is being notified, I'm using the standard `notify yes`, and both slaves are listed as NS records for the domains — Rob, Jun 07 '12 at 16:09

score 16 · Answer 1 · answered Apr 22 '12 at 08:01

16

You've two options in your master's BIND config for a given zone:

notify yes - will send notifications to all of the published NS records for the domain.

notify explicit - will send notifications only to those IPs listed in the also-notify configuration.

In either case, the slaves must be configured with allow-notify that accepts these notifications from the master's IP.

Once it accepts a NOTIFY, the slave then sends an IXFR or AXFR request back to the master. If the master is 'hidden' (ie: not published as an NS record for the domain), then this doesn't matter. The slaves have to be configured with the master's IP directly, so they should know where to send the request.

So long as the master's firewall allows the requests in from the slaves and the master is configured to allow zone transfers, then the salves can retreive their configuration. (This is the part you have to lock down to prevent unauthorized name servers scraping your zone files)

answered Apr 22 '12 at 08:01

SmallClanger

8,947
1
31
45

This is not what I question. First things first. The notify yes is the DEFAULT option on bind 9.x, so you do not want to set it. Your answer is about how notify works AFTER the slave receives that from Master. What I ask, is completely different. I ask how master KNOWS which servers are slaves. Slaves DO know their master, but you do not set anywhere in the configuration file the secondary servers. So, Master DOES NOT KNOW EXPLICITLY his slaves. So, the question is still unanswered. – Peter Apr 22 '12 at 09:04
9

With the default setting (`notify yes`) the master doesn't have to have the slaves explicitly configured, It simply sends a NOTIFY to each `NS` record for the domain. (In your terms, the master *knows* the slaves, because they're right there in the zone file.) – SmallClanger Apr 22 '12 at 09:51
2

In that case, I have a problem to solve, because the master does not send NOTIFY to the zone NS... – Peter Apr 22 '12 at 14:10

score 9 · Answer 2 · edited Dec 17 '20 at 12:05

Bind DNS sends a notify to all name servers except itself and the primary master listed in the SOA.

notify yes;
sends notify to all name servers in RR ** (except itself and SOA master)**
notify yes; also-notify { x.x.x.x; y.y.y.y; };
sends notify to x.x.x.x, y.y.y.y and all name servers in RR (except itself and SOA master).
notify explicit; also-notify { x.x.x.x; y.y.y.y; };
sends notify to just x.x.x.x, y.y.y.y

score 1 · Answer 3 · answered Apr 03 '19 at 19:04

Strictly speaking, the master doesn't know that it has slaves, let alone who they are.

All the DNS server in the role of master "knows" is that it's been configured to "master" a zone.

Further configuration tells it how to assemble a list of other nameservers to notify when that zone changes.

The stock bind 9+ config is, I think, for the nameserver to construct the list of notification targets from the list of NS RRs in the mastered zone. The admin can add to that list with the also-notify config thingy. The admin can also change the behavior with the "notify" thingy.

So, you could say that a master learns how to "knows its slaves" from it's configuration and that most of that time, that means all the NS records in the zone.

BIND, Master, Slaves and Notify

3 Answers3