is a great guide that tells you everything you need
to know about setting up and configuring named, the Berkeley Internet Name Daemon (BIND).Bonjour is a networking technology that allows devices to automatically discover each other without any configuration. In the first release, Bonjour operated on the local network to provide ad-hoc discovery for applications and devices. Starting in Mac OS X v10.4 Tiger and Bonjour for Windows, a network administrator can set up a Bonjour name server to enable wide-area capable devices and applications to discover services anywhere in the world. This document will explain how to set up a machine running Mac OS X to act as a Bonjour name server to facilitate wide-area discovery on your network. You can also use Linux, Solaris, or any other Unix-style operating system that can run the BIND name server. If you want clients to be able to browse to discover specific services of your choosing, but you don't want to allow individual machines to dynamically register their services, you can also manually add Bonjour service discovery records to your existing name server.
Wide-Area Bonjour uses DNS Service Discovery [DNS-SD] along with DNS Update [RFC 2136] and TSIG security [RFC 2845]. Like most Linux distributions, Mac OS X includes the standard BIND DNS Server (named), which supports DNS Update. It's also recommended that you run the dnsextd daemon (also included in Mac OS X). The dnsextd daemon implements two DNS extensions that enhance service discovery:
You can use wide-area Bonjour without running dnsextd, and it will still work, but with the two limitations above.
The instructions below should be enough for someone experienced with DNS to set up a DNS server configured for Wide Area Bonjour,
but if you've never set up a DNS server at all before and you find it a little confusing,
DNS
and BIND, Fourth Edition
dnssec-keygen -a HMAC-MD5 -b 128 -n ZONE <your zone>The following shows how to generate a shared secret for the "bonjour.example.com" domain.
# dnssec-keygen -a HMAC-MD5 -b 128 -n ZONE bonjour.example.com. Kbonjour.example.com.+157+55295 # cat Kbonjour.example.com.+157+55295.key bonjour.example.com. IN KEY 256 3 157 CnMMp/xdDomQZ4TelKIHeQ== # rm Kbonjour.example.com.+157+55295.*
For the domain "bonjour.example.com", our shared secret is "CnMMp/xdDomQZ4TelKIHeQ==". For more information about the dnssec-keygen command, please see the manual page.
/etc/named.conf):
options {
// tell named where to find zone files
directory "/var/named";
// these answer DNS queries outside of the bonjour.example.com. zone.
// insert address(es) of your normal DNS servers or caches here.
// On Mac OS X, you can find the address(es) via the "scutil --dns" command.
forwarders { 1.2.3.4; 5.6.7.8; };
};
// entry for our new zone
zone "bonjour.example.com." {
type master;
file "db.bonjour.example.com";
allow-update { key bonjour.example.com.; };
};
// key for updating our zone
key bonjour.example.com. {
algorithm hmac-md5;
secret "CnMMp/xdDomQZ4TelKIHeQ==";
};
// If you don't wish to use a shared secret, replace the line
// allow-update { key bonjour.example.com.; };
// with
// allow-update { any; };
// and omit the key definition.
// If you wish to create a key per user, and don't want to have to include
// the entire list of keys explicitly in the "allow-update" declaration,
// you can use an "update-policy" declaration instead, like this:
// update-policy { grant * wildcard *.bonjour.example.com.; };
$TTL 3600 ; One hour default TTL
; Replace wab.example.com. below with your machine's hostname
@ IN SOA wab.example.com. unused-email (
1 ; serial
10800 ; refresh (3 hours)
3600 ; retry (1 hour)
604800 ; expire (1 week)
60 ; minimum (1 minute)
)
; Specify your server as the nameserver for your zone,
; substituting your machine's hostname.
@ IN NS wab.example.com.
; Specify the server which handles DNS updates for your zone,
; typically port 53 on the same server as above.
; If you're going to be running dnsextd (see below) then the port number is typically 5352
_dns-update._udp IN SRV 0 0 53 wab.example.com.
; Add PTR records telling clients that they can browse and register here
b._dns-sd._udp IN PTR @ ; "b" = browse domain
lb._dns-sd._udp IN PTR @ ; "lb" = legacy browse domain (include domain in empty-string browses)
r._dns-sd._udp IN PTR @ ; "r" = registration domain
bonjour.example.com. 86400 IN NS wab.example.com.Your network administrator may be able to do this for you. If you do not have access to the parent zone's DNS server, a temporary alternative while testing is to simply add the IP address of the new server to the "DNS Servers" field of the Networking Preference Pane in each client computer. However, manually entering the IP address on the clients is a short-term solution, not really suitable for long-term use. The whole point of DNS is that clients learn the DNS server for a given domain, not by manual configuration, but by following the chain of delegation (NS records) from the root. Likewise, for reliable operation, your subdomain should be properly delegated from its parent.
; Add for applications to discover your domain as a potential place to browse b._dns-sd._udp.example.com. 3600 IN PTR bonjour.example.com. ; Add if you want your domain to be chosen as the default ; browse domain in the Bonjour Preference Pane db._dns-sd._udp.example.com. 3600 IN PTR bonjour.example.com. ; Add for this domain to show up in the list of potential registration domains r._dns-sd._udp.example.com. 3600 IN PTR bonjour.example.com. ; Add if you want your domain to be chosen as the default ; registration domain in the Bonjour Preference Pane dr._dns-sd._udp.example.com. 3600 IN PTR bonjour.example.com. ; Add the following line so that applications that do empty-string ; domain browses will browse your zone in addition to "local." lb._dns-sd._udp.example.com. 3600 IN PTR bonjour.example.com.If you don't have administrative control of that domain, as a last resort, you can manually force a client to "discover" your new "bonjour.example.com" domain by adding it to the "Search Domains" field in the Network Preference Pane on each client. This will only work if you have the domain enumeration PTR records in the bonjour.example.com zone as shown in the "db.bonjour.example.com" zone file above.
You should create a backup of the zone file before running named for the first time. Once you run your server with DNS Update turned on,
you cannot edit the zone files by hand. If you need to reset your zone for any reason, simply revert to the saved copy, delete any .jnl files,
and restart named and dnsextd.
named normally runs with no arguments:
# named
Check the syslog (/var/log/system.log) for errors. You can ignore any errors that say "/private/etc/rndc.key: file not found" or "couldn't add command channel". If any other errors occur, make sure that you put periods in exactly the right places in all files. See examples for correct usage of trailing dots. For debugging, you may wish to run it in the foreground, with enhanced logging:
# named -g -d 5
The dnsextd daemon configuration file is /etc/dnsextd.conf. Typically the only thing you need to edit in this file is the
name of the zone you want dnsextd to handle:
zone "my-dynamic-subdomain.company.com." {
type public;
};
You can run dnsextd with no arguments:
# dnsextd
To run in the foreground with verbose logging for debugging, add "-vf".
# dnsextd -vf
Run with a single argument, "-h", for help and a full list of options.
Once you have verified that your configuration files are correct, you can set named and dnsextd to start automatically on boot. Fist stop named and dnsextd if they are already running, and then execute the following commands:
# launchctl load -w /System/Library/LaunchDaemons/org.isc.named.plist # launchctl load -w /System/Library/LaunchDaemons/com.apple.dnsextd.plist
The "launchctl load" command tells the system to start that daemon; the "-w" option tells the system to make the change permanent so the daemon will be automatically started on boot too.