The bind-dyndb-ldap system plug-in contains a DNS record cache for zones and a history of successful DNS resolutions. Maintaining the cache improves lookup performance in the Directory Server because it is not necessary to query the directory services every time there is a new DNS request.

When this plug-in is installed and IPA is configured to manage DNS, then a new configuration section is added to the plug-in configuration.

dynamic-db "ipa" {
        library "ldap.so";
        arg "uri ldapi://%2fvar%2frun%2fslapd-EXAMPLE-COM.socket";
        arg "base cn=dns, dc=example,dc=com";
        arg "fake_mname server.example.com.";
        arg "auth_method sasl";
        arg "sasl_mech GSSAPI";
        arg "sasl_user DNS/server.example.com";
};

This configuration uses implied default values for other plug-in behaviors, like how long it maintains the cache. The assumed, default configuration can be changed by adding arguments to the dynamic-db "ipa" entry.

arg "argument value";

The additional parameters are listed in Table 8.2, “Additional bind-dyndb-ldap Configuration Parameters”.

# rndc reload

To improve DNS performance, it may be necessary to change the cache setting. By default, DNS records are kept in cache and considered valid for 120 seconds. This means that if a DNS record changes, it will not (necessarily) be propagated to the name server for up to 120 seconds. If the Directory Server has a high traffic volume or if records do not change frequently, then the cache time can be increased to improve performance by adding the cache_ttl parameter.

dynamic-db "ipa" { 
... 
    arg "cache_ttl 1800"; 
};

The other configurable behavior defines how the BIND service receives updates about new zones. The DNS service receives its information through the bind-dyndb-ldap plug-in. The plug-in resolves only zones that were configured and enabled in the Directory Server when the name server started. When the name service restarts, the plug-in reloads its configuration and identifies any new zones. However, the plug-in can be used to search for zone changes actively either by refreshing the zone data on a schedule.

Periodically checking for new zones is the same as refreshing the zone configuration. This is set in the zone_refresh argument.

dynamic-db "ipa" { 
... 
        arg "zone_refresh 30"; 
};