Bernhard Bock

Home

Dynamic DNS with BIND

In the last couple of years, I made my home server reachable in the internet via a dynamic DNS provider (no-ip.org). While this worked pretty painless for a number of years, it has one big drawback: My host is in a foreign domain. DNS CNAMEs can reduce this problem, but I want my hosts to be in my own DNS domain.

So, I decided to use dynamic DNS updates with my BIND DNS server and TSIG (Transaction Signatures). Here’s a short howto:

I created a DNS cryptographic key with dnssec-keygen.
I allowed the key to remotely update my DNS server. For this, you need this line in your zone definition of bind.
“mykey” refers to the file where the key definition is stored.
```
allow-update { key "mykey"; };
```
On my home server, I created a short script to update the DNS whenever my
home IP address changes. With Ubuntu, this is easy by placing the script in
/etc/network/if-up.d/.
The script calls the tool nsupdate, which is included with bind. I issue the commands
```
server A.B.C.D
zone bock.nu.
update delete my.host.name.
update add my.host.name. 5 A $4
send
```
One caveat: On the DNS server, which is also Ubuntu-based, I needed to make /etc/bind group-writable with SGID bit, in order to allow BIND to create journal files and update zone files. Otherwise, it would return SERVFAIL and log “journal creation failed”.
Done! Now my home host is always reachable at the same name in bock.nu, even if the IP addess changes on each DSL dialup session.

The howto by Dag Wieers helped me a lot. Go there for more details.

— Jul 15, 2009