DNS Enabler for High Sierra
DNS Enabler on a private local network
Scenario - imagine that you've set up a local network behind a router or an Airport Base Station, e.g., for doing testing or web development.
Let's say that the local network is on subnet 10.0.1.x and you've decided to have a web server, a mail server, and an ftp server on a static IP address 10.0.1.201, plus other servers on 10.0.1.202 and 203. To simulate real world conditions and not have to change your code when you move to a production environment, you want to access the servers via domain names, e.g., lifeassets.com, as shown above.
So this is what you do. You run DNS Enabler on the 10.0.1.201 machine and set it up as shown.
You can now point all the other machines on the local network to use 10.0.1.201 as their name server (via the DNS Server setting in their Network Preferences). This way, all the local machines can now access the mail, web, and ftp servers via their domain names. If you've also set up an alias like www for the main server at 10.0.1.201, you can also hit that server by typing something like www.lifeassets.com into a web browser.
This is a simple thing to do and it takes only a couple of minutes to set up, but it can be made even more useful. For example, you may have a few other machines containing projects at various stages of development. You can switch your machines around and test each machine in turn as www.lifeassets.com, say, just by changing the name-address assignments in DNS Enabler.
Or, since this is a private local network, you can simulate more than one domain, e.g., to test the effect of sending mail from one server to another, say, from roadstead.com to cutedgesystems.com. You can set up DNS Enabler as shown here:
Another Scenario : This happens quite often - you may have set up a web or mail server behind a router, broadband modem, or wireless base station when you noticed that machines on the local network cannot "see" the server via its domain name, while machines outside the network can (e.g., you've used dyndns.org or some such service to obtain your own domain name).
In this case, you can use DNS Enabler to broadcast the domain name to all the local machines (using the simple configuration outlined above) and help them find their way to your server.
A Configuration for the Public Network
DNS Enabler on a public network. Introducing MX records.
An example company, Kemper, has been given a range of 64 public IP addresses from 220.127.116.11 to 18.104.22.168. It sets its DNS server at 22.214.171.124 and gives it a name, pridns.kemper.com.sg. Its backup secondary name server is at the ISP, secdns.cyberway.com.sg.
The machine that runs the name server is also the mail server and ftp server. Therefore, we give it the aliases, mail and ftp. We also add the label MX to indicate that pridns.kemper.com.sg, alias mail.kemper.com.sg, is providing the mail service for the domain kemper.com.sg.
If we have a secondary backup mail server among our machines, say at backup.kemper.com.sg, we can assign it by adding the MX label to that machine. The number in the bracket, as in MX and MX, denotes the precedence.
Across the firewall from the public network, the company runs a private local network (in the 192.168.0.x range). DNS Enabler can handle the setup of the name service for this local network within the same window. Because it is a private network, it can be given any domain name, which we enter into the Virtual Domains field. In our case, we use local.com, and we have two servers, accounting.local.com and keystone.local.com, that are used (and seen) only by the local users.
MX records :
If our ISP provides us with a backup mail server in case our whole domain is down, we can specify this backup mail server, as in the example above (with its IP number denoted by a dash - since we probably wouldn't know its physical address) :
This is how our MX records will be ordered :
kemper.com.sg IN MX 10 pridns.kemper.com.sg.
kemper.com.sg IN MX 20 backup.kemper.com.sg.
kemper.com.sg IN MX 30 mailHost.cyberway.com.sg.
The following screenshot shows DNS Enabler handling the data entry for the domain described in Paul Albitz and Cricket Liu's DNS and BIND book. It shows computers on two networks, 192.249.249.x and 192.253.253.x, for the domain movie.edu, with the router between the two networks at 126.96.36.199 and 188.8.131.52. The router is given the name wormhole.movie.edu, alias wh.movie.edu and serves as a backup for the primary name server terminator.movie.edu while providing the name service for the 192.253.253.x network. [Download the configuration, here, and open it in DNS Enabler].
Two other computers have aliases - terminator.movie.edu, which is known as bigt.movie.edu, and diehard.movie.edu, also known as dh.movie.edu.
In the example above, DNS Enabler should be installed on the machine named terminator.movie.edu, which is the primary name server for the domain movie.edu. When you hit the Start DNS button, DNS Enabler will read in the name-address mappings, start up name services so that other computers can get answers to these name-address queries (and keep these running across reboots).
DNS Zone Files
This is the zone file created by DNS Enabler for the above configuration:
DNS Enabler will also create the reverse pointer records.
What about MX Records, TXT Records, and Forwarders?
The following picture shows how you would handle MX and TXT records and Forwarders for the domain movie.edu :
misery.movie.edu and shining.movie.edu are the mail servers for the domain movie.edu, with misery.movie.edu ranking higher in priority as the target to receive mail for the domain. The Mail eXchanger role that both of these machine perform are denoted by the MX[xx] notation.
You can leave a note that shining.movie.edu, the backup mail server, is located at the math lab by adding a TXT[string containing a description] label to the shining.movie.edu record.
Forwarders are useful if you need to shunt name resolution to a particular external name server. e.g., your ISP's, to keep off-site search for domain name resolution to a minimum, so as to improve network traffic. In the example above, 184.108.40.206 and 220.127.116.11 are the site's forwarders, and you list them in the Forwarders field, separated by commas.
The configuration, above, can be downloaded from here. The zone file that DNS Enabler produces from that configuration is shown below :
Actually, you can set up quite complicated MX and CNAME record combinations, like that shown below :
where you can set up an alias record for your domain, like testApp.yakcat.com above, that actually points to apple.com (i.e., it's a CNAME for apple.com) and googleffffffffd07f4431.yakcat.com is a CNAME for google.com.
The example above also shows how you can indicate to the DNS system that an external mail host (mailstore.secureserver.net) is providing mail services for two machines in separate domains under your care, where one of them is the main domain, yakcat.com (you can leave out the domain name in the MX specification, if that is for the main domain), and the other is calvary.org (which has a fall-back mail server provided by calvary.com).
IP Addresses in CIDR Format
DNS Enabler now allows you to enter IP addresses in CIDR format, e.g. if your ISP has delegated control of a sub-block (or two) of addresses to your name server and you need to create reverse pointer records in CIDR format so that when other mail servers do a reverse name lookup on your IP addresses, your name server will return the correct answers.
The picture below shows how CIDR-type addresses can be entered :
DNS Enabler can handle the general case where more than one block of IP addresses in the same sub-net can possibly be delegated to your name server.
This is how DNS Enabler will create the reverse pointer records :
A reverse lookup on the IP address 18.104.22.168 will go first to the root servers which then pass the query on to the ISP name server that is known to control the address range that 22.214.171.124 sits in.
Having delegated a sub-block from of IP addresses (from 126.96.36.199 to 188.8.131.52 to you (which is what 184.108.40.206/29 really means), the ISP will re-direct that query on to your name server, whose job is to say which host name was mapped to that particular position 35. In this case, your name server's answer would be "smtp.domainName.com".
A normal lookup of the name "smtp.domainName.com" will still work correctly as DNS Enabler would have created the name-to-IP address mappings as usual :
So with things set up this way, a suspicious destination mail server will have its checks confirmed that your smtp server is really what it purports to be, which is (probably) what this whole exercise had been meant to serve.
Setting up a Secondary Name Server
DNS Enabler also allows you to set up a secondary slave name server. In the example below, besides running DNS Enabler on the Primary Name server, terminator.movie.edu, you can also install it on a Secondary Name Server, wormhole.movie.edu.
First, use the Save menu item in the File Menu on the Primary Name server, to make a copy of the configuration. Then copy this to the machine that will act as the Secondary Name Server (in our case, wormhole.movie.edu).
Run DNS Enabler on this secondary machine, and use it to open the configuration you've just copied over.
Then click on the radio button next to the label "Secondary Name Server" :
When you hit the Start/Restart DNS button, wormhole.movie.edu will now run in slave mode. It will monitor the zone files for updates coming in from the primary server. So when you make a change to the primary server (terminator.movie.edu in our example), you will see the change show up automatically on the screen of the machine running the secondary server.
DNS Enabler can also set up multiple secondary slave name servers for a single primary name server. Just enter the list of slave server host names into the Secondary Name Server field of the machine acting as the primary server and this will tell the primary name server to notify all of these secondary servers whenever there is a change in the zone data that it is managing and it will transfer these updates to the slave servers automatically.
Support for Dynamic DNS Updates
DNS Enabler will allow client host machines with dynamically assigned IP addresses (or machines on the move) to update the DNS Server automatically with their latest IP address, keeping their domain name-to-IP address mapping in sync at all times.
To set up the DNS Server to listen to DNS update requests coming in from dynamic DNS clients, click on the "Allow Dynamic DNS Updates" check-box, below :
A dynamic DNS client, whose host name-to-IP address mapping is tracked by the DNS Server above, needs to run a special piece of software that will monitor the state of its IP address for changes. This service is provided by a companion application to DNS Enabler called DNS Agent (in El Capitan, Yosemite, Mavericks, Mountain Lion, Lion, Snow Leopard versions). Whenever the IP address changes, DNS Agent will call home to the DNS Server to update it with the latest value.
In order to establish that it has the necessary authorisation to update the DNS Server, the DNS Agent needs to have an authorisation key installed that it has obtained from the server.
Transferring the Authorisation Key to DNS Agent is very simple. Click on the question mark icon next to the "Allow Dynamic DNS Updates" check-box. It'll open up the dialog box, below, which provides more details about the way dynamic DNS updates work, as implemented by DNS Enabler :
Drag the Authorisation Key, as represented by the icon on the bottom-right hand corner of the dialog box, to the machine running DNS Agent, whose IP address is being tracked. You can drag the key file to the server's desktop and transfer it to the client machine via file-sharing or via email.
Once on the client machine, if you have the DNS Agent application there, you can simply double-click on the key and it will open the DNS Agent app. Save the key and follow the instructions on the DNS Agent web page. In a couple more steps (which involves entering values for the address of the DNS Server and the host name you are updating for), you are done, and you can quit the DNS Agent, which leaves a daemon running, even across shut-downs and reboots, that will always update the DNS Server with that client's current IP address.
The Log Panel
The Log Panel shows the contents of the DNS Server log file at /Library/Logs/named.log, in reverse order, with the latest entries listed first. It also shows the current version number of the name server.
DNS Enabler will rotate the logs when it gets too big and keep up to 5 previously archived versions of the log file.
De-Installing DNS Enabler
You can de-install DNS Enabler by using the last menu item in the Help menu. It will shut down the DNS Server, if it is running, and remove all files installed by DNS Enabler.
DNS Enabler works from its own folder in /usr/local/cutedge/named, in which are stuffed the named.conf and the db files used by DNS Enabler. DNS Enabler leaves your system in its original state after de-installation.
11.0 October 2nd 2017. DNS Enabler for High Sierra released.
11.0.1 October 5th 2017. This version installs SSL libraries inside /usr/local/ssl, to allow DNS Enabler’s named server to work, because the system-provided ssl libraries are no longer accessible by 3rd party apps.
11.0.2 October 7th 2017. Moved the SSL libraries used by the named server (set up by DNS Enabler) inside /usr/local/cutedge from /usr/local/ssl, so that it doesn’t clash with custom ssl libraries that the user might already have installed in /usr/local/. To complete this update (from previous versions of DNS Enabler for High Sierra), the user has to do a De-Install from DNS Enabler’s Help menu (save your config first, so that you can quickly reload the existing config), and then restart all named services.
11.0.3 September 23rd 2017. Supports TXT (DKIM and SPF) records. Fixed a bug where sub-domains are truncated during a zone transfer, when the DNS server is acting as a secondary name server.
11.0.4 June 15th 2020. Fixed a bug in the Aliases field when a CNAME in one domain is an alias for a host record in another domain.