IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
servers which possess authority for superordinate and subordinate zones. To
ensure name resolution for the hosts in the zone, record type Address (A) must
be entered for every terminal device to be addressed.
The entries needed in record type SOA include the name and address of the
zone supervisor. The default setting for this address is root..
The settings for the synchronisation behaviour of the secondary name servers
are also made in record type SOA.
The refresh validity period determines the time within which a secondary
name server continues to reply to queries from hosts after it has tried
unsuccessfully to contact the primary name server. The shorter this time is set
to, the lower the likelihood that the secondary name server will send invalid
DNS entries and thus prevent name resolution. To make the system fail-safe,
this time should not be set too short since, if the primary name server should
fail, the Domain Name System for this zone will then no longer work. A
compromise must be found for this parameter between the probability of being
unable to resolve individual host names and - if too short a period is set - the
probability of being unable to address any terminal devices by individual host
names.
The minimum caching interval determines the time for which information
from queries is retained in the cache of the primary name server. If too short a
time is selected, this can increase the load on the network where the same
hosts are queried frequently and delay resolution of the host names into IP
addresses. On the other hand, if too long a minimum caching interval is
defined, this can result in out-of-date information being passed on.
Connection to the external DNS hierarchy
Queries involving host addresses outside the local domain are automatically
executed as long as the DNS server is running. The DNS server receives
information about the DNS hierarchy from the file
SYS:ETC\DNS\ROOT.DB, which contains a list of name servers of the US
Top Level Domains. Manage Services - DNS - Administer DNS - Link to
existing DNS Hierarchy provides access to two different methods of building
a direct connection to other domains, namely Link Direct and Link Indirect via
Forwarder. If certain domains are accessed frequently, these procedures can
speed up host name resolution.
Checking of name servers
The menu option Manage Services - DNS - Administer DNS - Query Remote
Name Server allows checking of what information is held on other name
servers as well as allowing one to determine whether a particular name server
is responding to queries. In either case, the name or IP address of the server
must be entered. The resource record type which is being interrogated and the
domain from which the information is required must also be specified.
Backing up the DNS database
The DNS database should be backed up at regular intervals. Such backups can
be used, for example,
- to restore a DNS database which has become unusable,
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Direct connections to
speed up name
resolution