Viewing a Name Server's Cache

You want to view a name server's cached data.

Solution
Use rndc dumpdb (BIND 9) or ndc dumpdb (BIND 8) to dump the cache to disk, then look through the dump file.

Discussion
BIND 9 name servers only dump the contents of the cache to disk by default, but BIND 8 name servers dump both the contents of cache and authoritative zone data to disk, so you'll have to find the cached records in the file.

To determine which records in a BIND 8 database dump were cached, look at the TTLs and the contents of the comment field. Authoritative zone data will have the nice, round TTLs you configured, while cached records will have had their TTLs decremented by the number of seconds they've been in the cache. Cached records will also have "Cr=" as a comment at the end of the record, giving the credibility level of the record (an indication of the quality of the cached record). For example, these records were cached from an authoritative response from the name server at 128.9.0.107:

. 518380 IN NS I.ROOT-SERVERS.NET. ;Cr=auth [128.9.0.107]
518380 IN NS E.ROOT-SERVERS.NET. ;Cr=auth [128.9.0.107]
518380 IN NS D.ROOT-SERVERS.NET. ;Cr=auth [128.9.0.107]
518380 IN NS A.ROOT-SERVERS.NET. ;Cr=auth [128.9.0.107]
518380 IN NS H.ROOT-SERVERS.NET. ;Cr=auth [128.9.0.107]
518380 IN NS C.ROOT-SERVERS.NET. ;Cr=auth [128.9.0.107]
518380 IN NS G.ROOT-SERVERS.NET. ;Cr=auth [128.9.0.107]
518380 IN NS F.ROOT-SERVERS.NET. ;Cr=auth [128.9.0.107]
518380 IN NS B.ROOT-SERVERS.NET. ;Cr=auth [128.9.0.107]
518380 IN NS J.ROOT-SERVERS.NET. ;Cr=auth [128.9.0.107]
518380 IN NS K.ROOT-SERVERS.NET. ;Cr=auth [128.9.0.107]
518380 IN NS L.ROOT-SERVERS.NET. ;Cr=auth [128.9.0.107]
518380 IN NS M.ROOT-SERVERS.NET. ;Cr=auth [128.9.0.107]

Remember that dumping the cache to disk has no effect on the contents of the cache. If you want to flush (clear) the cache, see Flushing (Clearing) a Name Server's Cache.

Flushing (Clearing) a Name Server's Cache
Problem
You want to flush bad records from a name server's cache.

Solution
If you run a BIND 9.2.0 or newer name server, you can flush the cache with rndc flush. With older name servers, you need to kill the name server and restart it to flush the cache. You can do that in one fell swoop with rndc restart or rndc exec.

Discussion
Clearing the cache is really a side effect of killing the name server, since BIND name servers only store cached data in memory. Since restarting the name server takes time, especially if the name server is authoritative for many zones, rndc flush is a better option.

If you run multiple views on your BIND 9.2.0 or newer name server, you can flush the cache in only one view using rndc flush viewname. For example:

# rndc flush internal
BIND 9.3.0 will support flushing all of the records attached to a particular domain name with rndc flushname. For example:

# rndc flushname cnn.com

Modifying Zone Data Without Restarting the Name Server
Problem
You want to modify your zone data without restarting the name server.

Solution
Make the change to the zone data file. For BIND 9, run:

# rndc reload domain-name-of-zone
For BIND 8, run:

# ndc reload domain-name-of-zone
If you've modified multiple zones, just list them after reload. For example:

# rndc reload foo.example bar.example
Discussion
Remember to increment the serial number in your zone's SOA record after changing the zone data. The primary master reloads the zone regardless of whether you've incremented the serial number, since the file's modification time has changed, but your zone's slaves only have the serial number to tell them whether the zone has been updated.

Reloading individual zones, as shown above, was introduced in BIND 8.2.1 and again in 9.1.0. With older versions of BIND, just use rndc reload or ndc reload, as appropriate. That takes a little more time, since the name server checks all zone data files to see which have changed.

If you're reloading a zone that exists in multiple views on a BIND 9 name server, specify the view with rndc reload domain-name-of-zone class view. For example:

# rndc reload foo.example in external
Unfortunately, you can't leave out the class, even though you're unlikely ever to reload a non-Internet class zone.

Telling a BIND 9 name server to reload a dynamically updated zone has no effect, since the name server doesn't expect you to update the zone manually. Telling a BIND 8 name server to reload a dynamically updated zone may work--or you may lose your manual changes.

Dynamic update is, of course, another way to update zone data without restarting the name server

Clarification of changes on "allow-recursion" and "allow-query-cache" in BIND 9.4.1

Everyone upgrading from older BIND versions to BIND 9.4.1 or newer should check if this change has effects on the nameserver:

There has been some confusion surrounding the changes to the "allow-recursion" and "allow-query-cache" options made with BIND 9.4.1-P1.

This document will attempt to clarify the change and the impact that it makes on BIND servers.

In BIND 9.3, there was no segregation of queries between cache and authoritative data.

The release of BIND 9.4 added fine-grained differentiation between queries against authoritative data ("allow-query") and cached data ("allow-query-cache"). This allows more precise control, particularly if you do not want your clients to use any cached data, for example, in an authoritative-only nameserver.

Prior to the release of BIND 9.4.1-P1, the default action of "allow-recursion" and "allow-query-cache" was to permit the query. The P1 patch to BIND 9.4.1 caused two changes in this behavior:

1) If not explicitly set, the ACLs for "allow-query-cache" and "allow-recursion" were set to "localnets; localhost;".

2) If either "allow-query-cache" or "allow-recursion" was set, the other would be set the same value.

Upgrading from the BIND 9.3 branch to BIND 9.4.1-P1 will significantly restrict those servers that were previously recursive servers for more than "localhost; localnets;" unless configuration changes are made.

To retain the behavior prior to BIND 9.4.1-P1, the following entries should be created in your named.conf file:

Code:

options {

...

allow-recursion { any; };

allow-query { any; };

allow-query-cache { any; };

...

};

We strongly advise against this configuration because clients spoofing queries can use your servers to launch distributed denial-of-service attacks.

The recommended method is to create ACLs that match hosts that should be allowed access to cache and recursion on the servers. For example, if you wanted to provided recursion and access to the cache to clients you trusted, you could list them in an ACL such as the following:

Code:

acl "trusted" {

192.168.0.0/16;

10.153.154.0/24;

localhost;

localnets;

};

options {

...

allow-query { any; };

allow-recursion { trusted; };

allow-query-cache { trusted; };

...

};

This example ACL includes 192.168.0.0/16 and 10.153.154.0/24 as sample networks that would require access. You must replace these sample networks with networks that correctly reflect your environment. This will allow anyone to query your server for authoritative data, but only those hosts within the "trusted" ACL access to your cache and recursion.