Hostname Naming Compliance

Danny Thomas d.thomas at its.uq.edu.au
Mon Feb 23 21:54:34 UTC 2009


Eric C. Davis wrote:
 > Are there plans for Bind to enforce hostname compliance according
 > to RFC's or is this going to be left up to each DNS operator?

the question of benefit always arises when considering the
application of RFCs. It's probably better not enforcing things
just for the sake of complying to some RFC unless the
issue is known to cause problems.

For records not created through DDNS, it's better that your
dns administration mechanisms do this, plus they can enforce
more restrictive naming policies particular to your organization.
For the hack of it, I did implement something in our system
which would reject names not matching a regex. What's more the
regex could be specific to the sub-groups, so hostnames in the
SI group would have to begin "si-...". It was never enabled
as there would have been some effort involved in cleaning up
the existing entries.

A document discussing hostnames written 7 years ago
  http://www.its.uq.edu.au/choosing-hostnames

One of the zones we secondary has very little sub-structure
and basically thousands of desktops were registering themselves
with DDNS. Several years ago when developing my dnswalk2 script,
it reported roughly a hundred bad names like
  137
  botany_ew     (underscores were common)
  jb's\0329200  (spaces were common)

I just checked and the situation is no better. Probably quite a few
of these are machines not owned by the organization, though they
they could insist on a valid hstname for connection to their network.

Apart from zones we secondary, the only time we disable the check
is for the _msdcs part of AD. Specifically only the gc records
involve A records. I know it's not specified in the RFCs, but
a pragmatic approach would be to have an option reporting bad
hostnames ... except those A records matching "^gc\._msdcs\.".
NB we always have AD a sub-zones, so it's easy to liberalize
hostname checking just for that part of dns space, but that's
not possible if the AD records exist in the main zone.

Danny




More information about the bind-users mailing list