📄 00000002.htm
字号:
<HTML><HEAD> <TITLE>BBS水木清华站∶精华区</TITLE></HEAD><BODY><CENTER><H1>BBS水木清华站∶精华区</H1></CENTER>Network Working Group P. Beertema <BR>Request for Comments: 1537 CWI <BR>Category: Informational October 1993 <BR> <BR> <BR> Common DNS Data File Configuration Errors <BR> <BR>Status of this Memo <BR> <BR> This memo provides information for the Internet community. It does <BR> not specify an Internet standard. Distribution of this memo is <BR> unlimited. <BR> <BR>Abstract <BR> <BR> This memo describes errors often found in DNS data files. It points <BR> out common mistakes system administrators tend to make and why they <BR> often go unnoticed for long periods of time. <BR> <BR>Introduction <BR> <BR> Due to the lack of extensive documentation and automated tools, DNS <BR> zone files have mostly been configured by system administrators, by <BR> hand. Some of the rules for writing the data files are rather subtle <BR> and a few common mistakes are seen in domains worldwide. <BR> <BR> This document is an attempt to list "surprises" that administrators <BR> might find hidden in their zone files. It describes the symptoms of <BR> the malady and prescribes medicine to cure that. It also gives some <BR> general recommendations and advice on specific nameserver and zone <BR> file issues and on the (proper) use of the Domain Name System. <BR> <BR>1. SOA records <BR> <BR> A problem I've found in quite some nameservers is that the various <BR> timers have been set (far) too low. Especially for top level domain <BR> nameservers this causes unnecessary traffic over international and <BR> intercontinental links. <BR> <BR> Unfortunately the examples given in the BIND manual, in RFC's and in <BR> some expert documents give those very short timer values, and that's <BR> most likely what people have modeled their SOA records after. <BR> <BR> First of all a short explanation of the timers used in the SOA <BR> record: <BR> <BR> <BR> <BR> <BR> <BR> <BR>Beertema [Page 1] <BR> <BR>RFC 1537 Common DNS Data File Configuration Errors October 1993 <BR> <BR> <BR> - Refresh: The SOA record of the primary server is checked <BR> every "refresh" time by the secondary servers; <BR> if it has changed, a zone transfer is done. <BR> <BR> - Retry: If a secondary server cannot reach the primary <BR> server, it tries it again every "retry" time. <BR> <BR> - Expire: If for "expire" time the primary server cannot <BR> be reached, all information about the zone is <BR> invalidated on the secondary servers (i.e., they <BR> are no longer authoritative for that zone). <BR> <BR> - Minimum TTL: The default TTL value for all records in the <BR> zone file; a different TTL value may be given <BR> explicitly in a record when necessary. <BR> (This timer is named "Minimum", and that's <BR> what it's function should be according to <BR> STD 13, RFC 1035, but most (all?) <BR> implementations take it as the default value <BR> exported with records without an explicit TTL <BR> value). <BR> <BR> For top level domain servers I would recommend the following values: <BR> <BR> 86400 ; Refresh 24 hours <BR> 7200 ; Retry 2 hours <BR> 2592000 ; Expire 30 days <BR> 345600 ; Minimum TTL 4 days <BR> <BR> For other servers I would suggest: <BR> <BR> 28800 ; Refresh 8 hours <BR> 7200 ; Retry 2 hours <BR> 604800 ; Expire 7 days <BR> 86400 ; Minimum TTL 1 day <BR> <BR> but here the frequency of changes, the required speed of propagation, <BR> the reachability of the primary server etc. play a role in optimizing <BR> the timer values. <BR> <BR>2. Glue records <BR> <BR> Quite often, people put unnecessary glue (A) records in their zone <BR> files. Even worse is that I've even seen *wrong* glue records for an <BR> external host in a primary zone file! Glue records need only be in a <BR> zone file if the server host is within the zone and there is no A <BR> record for that host elsewhere in the zone file. <BR> <BR> <BR> <BR> <BR>Beertema [Page 2] <BR> <BR>RFC 1537 Common DNS Data File Configuration Errors October 1993 <BR> <BR> <BR> Old BIND versions ("native" 4.8.3 and older versions) showed the <BR> problem that wrong glue records could enter secondary servers in a <BR> zone transfer. <BR> <BR>3. "Secondary server surprise" <BR> <BR> I've seen it happen on various occasions that hosts got bombarded by <BR> nameserver requests without knowing why. On investigation it turned <BR>
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -