APNIC elearning: Reverse DNS for IPv4 and IPv6

Transcription

1 APNIC elearning: Reverse DNS for IPv4 and IPv6 06 OCT :00 AM AEST Brisbane (UTC+10) Issue Date: 07 July 2015 Revision: 2.0 Introduction Presenter Sheryl Hermoso Training Officer Specialties: Network Security IPv6 DNS/DNSSEC Internet Resource Mgmt Reminder: Please take time to fill-up the survey 2 1

2 Overview What is Reverse DNS? Principles of DNS Tree Creating Reverse Zones PTR Records IPv6 Reverse Lookups Managing Reverse DNS Reverse Delegation Procedures Whois Domain Objects 3 What is Reverse DNS? Forward DNS maps names to numbers svc00.apnic.net è Reverse DNS maps numbers to names è svc00.apnic.net 4 2

3 Uses of Reverse DNS Service denial That only allow access when fully reverse delegated eg. anonymous ftp Diagnostics Assisting in network troubleshooting (ex: traceroute) Spam identifications Reverse lookup to confirm the source of the Failed lookup adds to an s spam score 5 Reverse DNS Tree Root. Mapping numbers to names - reverse DNS net org com arpa apnic iana in-addr whois www training www in-addr.arpa. ws1 ws2 6 3

4 Reverse DNS Tree with IPv6 Root. net org com arpa apnic iana in-addr int ip6 RFC IPv6 addresses Creating Reverse Zones Same as creating a forward zone file SOA and initial NS records are the same as forward zone Create additional PTR records In addition to the forward zone files, you need the reverse zone files Ex: for a reverse zone on a /24 block, create a zone file and name it as db (make it descriptive) 8 4

5 Start of Authority (SOA) record Domain_name. CLASS SOA hostname.domain.name. mailbox.domain.name ( Serial Number Refresh Retry Expire Minimum TTL ) Serial Number must be updated if any changes are made in the zone file Refresh how often a secondary will poll the primary server to see if the serial number for the zone has increased Retry - If a secondary was unable to contact the primary at the last refresh, wait the retry value before trying again Expire - How long a secondary will still treat its copy of the zone data as valid if it can't contact the primary. Minimum TTL - The default TTL (time-to-live) for resource records 9 TTL Time Values The right value depends on your domain Recommended time values for TLD (based on RFC 1912) Refresh (24h) Retry 7200 (2h) Expire (30d) Min TTL (4d) For other servers optimize the values based on Frequency of changes Required speed of propagation Reachability of the primary server (and many others) 10 5

6 Pointer (PTR) Records Create pointer (PTR) records for each IP address in-addr.arpa. IN PTR svc00.apnic.net. or 131 IN PTR svc00.apnic.net. 11 IPv6 Reverse Lookups PTR records Similar to the IPv4 reverse record b.a ip6.arpa. IN PTR test.ip6.example.com. Example: reverse name lookup for a host with address 3ffe: 8050:201:1860:42::1 $ORIGIN e.f.f.3.ip6.arpa IN PTR host.example.com. 12 6

7 Reverse Zone Example $ORIGIN 3600 IN SOA test.company.org. ( sys\.admin.company.org ; serial 1h ; refresh 30M ; retry 1W ; expiry 3600 ) ; neg. answ. ttl NS ns.company.org. NS ns2.company.org. 1 PTR gw.company.org. router.company.org. 2 PTR ns.company.org. ;auto generate: 65 PTR host65.company.org $GENERATE $ PTR host$.company.org. 13 Managing Reverse DNS APNIC manages reverse delegation for both IPv4 and IPv6 Before you register your domain objects, you need to ensure that your reverse zones have been configured and loaded in your DNS name servers. APNIC does not host your DNS name servers or configure your reverse zone files. APNIC only delegates the authority of your reverse zones to the DNS name servers you provide through your domain objects. 14 7

8 Reverse Delegation Requirements /24 Delegations Address blocks should be delegated At least one name server /16 Delegations Same as /24 delegations APNIC delegates entire zone to member < /24 Delegations Not supported in the RIR level Read classless in-addr.arpa delegation RFC Reverse Delegation Procedures Create a whois object for the reverse zone This can be done in MyAPNIC Verify nameserver and domain set up before submitting to the database Provide the FQDN of two nameservers Provide the maintainer password Used to protect objects 16 8

9 APNIC & LIR Responsibilities APNIC Manage reverse delegations of address block distributed by APNIC Process requests for reverse delegation of network allocations LIR and members Be familiar with APNIC procedures Ensure that addresses are reverse-mapped Maintain nameservers for allocations Keep accurate records in the database 17 Reverse Delegation Procedures Resources > IPv4 / IPv6 > Bulk reverse delegations Input your IP address block here At least one DNS server (FQDN) Maintainer password 18 9

10 Whois domain object Reverse Zone in-addr.arpa in-addr.arpa zone for in-addr.arpa NO4-AP AIC1-AP Contacts NO4-AP cumin.apnic.net tinnie.apnic.net Nameservers tinnie.arin.net MAINT-APNIC-AP Maintainers domain: Descr: admin-c: tech-c: zone-c: nserver: nserver: nserver: mnt-by: mnt-lower: MAINT-AP-DNS changed: changed: changed: changed: source: APNIC 19 APNIC Helpdesk Chat 20 10

11 Questions Please remember to fill out the feedback form apnic el1 Slide handouts will be available after completing the survey 21 Thank You! END OF SESSION 22 11