DNS is one of the services that can be configured and maintained by the IPA domain. DNS is critical to the performance of the IPA domain; DNS is used for the Kerberos services and SSL connections for all servers and clients and for connections to domain services like LDAP.

While IPA can use an external DNS service, there is a lot more flexibility and control over IPA — DNS interactions when the DNS service is configured within the domain. For example, DNS records and zones can be managed within the domain using IPA tools, and clients can update their own DNS records dynamically. When a host is added to IPA, a DNS record is automatically created in IPA's DNS service for that host machine.

IPA stores all DNS information as LDAP entries. Every resource record for each machine is stored for the domain. For example, the client1 resource has three IPv4 (A) records and one IPv6 (AAAA) record:

dn: idnsname=client1,idnsname=example.com,cn=dns,dc=example,dc=com
idnsname: client1
arecord: 10.0.0.1
arecord: 10.0.0.2
arecord: 10.0.0.3
aaaarecord: fc00::1
objectclass: top
objectclass: idnsrecord

The schema used to define the DNS entries is in the /usr/share/ipa/60basev2.ldif schema file^[1].

The BIND service communicates with the Directory Server using the system bind-dyndb-ldap plug-in. When Identity Management is configured to manage DNS (Section 8.2, “Configuring DNS in Identity Management”), IPA creates a dynamic-db configuration section in the /etc/named.conf file for the BIND service. This configures the bind-dyndb-ldap plug-in for the BIND (named) service.

When this plug-in is properly configured, it delivers the DNS records from the Directory Server to the named service. The configuration can be changed to adapt the behavior of the plug-in and, therefore, the LDAP-BIND interactions.

The ipa command has several subcommands to manage the DNS service.