DNS configuration on Ubuntu, part II: configuring a local nameserver

So, now that I've explained why it's practical to run a local caching nameserver, let me explain my home setup. I'm currently using BIND-9.3.2 (the bind9 package in Ubuntu), but I'll be soon giving PowerDNS a try. Since I've had to play with BIND at the previous two places I've worked in, it's the one I'm most familiar with.

The Ubuntu package supplies a default configuration file which defines some zones, just so that you won't query nameservers on the internet about them. On SuSE 9.1, this only includes the reverse zone (the one that maps IP addresses to domain names) for the loopback address - 127.x.x.x. On Ubuntu, this includes the zones for 0.x.x.x and 255.x.x.x, besides the loopback. As far as I know, this is useful because a lot of the root nameservers see brain damaged queries for the domain name corresponding to either loopback or RFC1918 private addresses. Come to think of it, Ubuntu doesn't include those RFC1918 zones, because they're not that useful if you don't have a local network at home, using private (RFC1918) IP addresses.

Now, I usually make two changes in the configuration for BIND when used as a local resolver for a desktop machine:

• add listen-on { 127.0.0.1; }; to the options section, since we don't want to reply to queries from outside - the nameserver will be for local use only; if you have a local network set up, you might want to also listen on the interface facing the local network, if you want to use the respective box as a caching nameserver


• especially for BIND 9.2, add listen-on-v6 { none; }; if you don't have IPv6 connectivity; in this case, remember to also disable IPv6 DNS lookups in Firefox


• since there are a lot of idiot DNS admins out there, there are also many lame nameservers; BIND warns you about them by default, but if you hit many domains that are misconfigured like this, you will see many messages about them in the logs; you can disable them by adding the following to the logging section;
  

  
         # Don't log lame server messages.
         category lame-servers { null; };
  

  
  That's the easy way. However, I like to redirect the messages to a different file, so that I could at least notify the lame DNS admins about their problems. As some people say, DNS is a collaborative effort, it being a distributed database, and you know that most things which aren't idiot proof are bound to be broken...
  

Then again, there's another problem: what if I get my IP address and list of nameservers with DHCP? How can I automatically update my named.conf file to include those nameservers? They are always the same, but if you decide to hardcode them and the provider changes them, you're screwed.