TCP/IP Tutorial and Technical Overview - IBM Redbooks

-p port Specifies that dig should send the query to
a port other than well-known DNS port 53.
-x address Instructs dig to do a reverse lookup on the
specified address.
name The name of the resource record to be looked up.
type The type of query required. This can be any of the standard
resource record types (see Table 12-2 on page 438).
12.2 Dynamic Domain Name System
The Domain Name System described in 12.1, “Domain Name System (DNS)” on
page 426 is a static implementation without recommendations with regard to
security. In order to implement DNS dynamically, take advantage of DHCP, and
still to be able to locate any specific host by means of a meaningful label (such as
its host name), the following extensions to DNS are required:
► A method for the host name to address a mapping entry for a client in the
domain name server to be updated after the client has obtained an address
from a DHCP server
► A method for the reverse address to host name mapping to take place after
the client obtains its address
► Updates to the DNS to take effect immediately, without the need for
intervention by an administrator
► Updates to the DNS to be authenticated to prevent unauthorized hosts from
accessing the network and to stop imposters from using an existing host
name and remapping the address entry for the unsuspecting host to that of its
own
► A method for primary and secondary DNS servers to quickly forward and
receive changes as entries are being updated dynamically by clients
However, implementation of a Dynamic Domain Name System (DDNS) can
introduce problems if the environment is not secure. One method of security
employed by DNS is the use of Secret Key Transaction Authentication (TSIG),
defined in RFC 2845. This can be used to authenticate dynamic updates from
clients, or authenticate responses coming from a recursive server. Additionally,
these messages can now be protected for integrity and confidentiality through
using TSIG over the Generic Security Service (GSS-TSIG). This extension, and
the associated algorithms needed to implement GSS-TSIG, are defined in RFC
3645.
Chapter 12. Directory and naming protocols 453