Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 2. Managing DNS zones in IdM

Manage Identity Management (IdM) DNS zones to control how the network resolves names. You can add, remove, and configure primary zones to maintain a healthy DNS infrastructure.

2.1. Prerequisites
Copy link

2.2. Adding a primary DNS zone in IdM Web UI
Copy link

Create a new primary DNS zone using the Identity Management (IdM) Web UI. This graphical interface provides an intuitive way to name and initialize subdomains within the IdM environment.

Prerequisites

  • You are logged in as IdM administrator.

Procedure

  1. In the IdM Web UI, click Network Services DNS DNS Zones.

    Managing IdM DNS primary zones

    A screenshot showing that a user has navigated to the Network Services tab and has selected DNS Zones from the DNS submenu.
  2. Click Add at the top of the list of all zones.

  3. Provide the zone name.

    Entering an new IdM primary zone

    A screenshot showing that a user has entered a Zone name such as zone.example.com. in the Zone name field of the
  4. Click Add.

2.3. Adding a primary DNS zone in IdM CLI
Copy link

Add new subdomains to the DNS domain by executing the ipa dnszone-add command. This command allows for direct input of the zone name or provides interactive prompts for missing details.

Prerequisites

  • You are logged in as IdM administrator.

Procedure

  • The ipa dnszone-add command adds a new zone to the DNS domain. Adding a new zone requires you to specify the name of the new subdomain. You can pass the subdomain name directly with the command: 

    $ ipa dnszone-add newzone.idm.example.com

    If you do not pass the name to ipa dnszone-add, the script prompts for it automatically.

2.4. Removing a primary DNS zone in IdM Web UI
Copy link

Delete unnecessary DNS zones through the Network Services section of the IdM Web UI. Removing a zone permanently deletes its associated records from the Identity Management database.

Prerequisites

  • You are logged in as IdM administrator.

Procedure

  1. In the IdM Web UI, click Network Services DNS DNS Zones.

  2. Select the check box by the zone name and click Delete.

    Removing a primary DNS Zone

    A screenshot of the
  3. In the Remove DNS zones dialog window, confirm that you want to delete the selected zone.

2.5. Removing a primary DNS zone in IdM CLI
Copy link

Remove a primary DNS zone by using the ipa dnszone-del command. Specifying the target zone name instantly deletes the entry and its configuration from the IdM server.

Prerequisites

  • You are logged in as IdM administrator.

Procedure

  • To remove a primary DNS zone, enter the ipa dnszone-del command, followed by the name of the zone you want to remove. For example: 

    $ ipa dnszone-del idm.example.com

2.6. DNS configuration priorities
Copy link

IdM applies DNS settings based on a specific hierarchy. Zone-specific settings take the highest priority, followed by per-server and global configurations, while manual entries in /etc/named.conf carry the lowest weight.

Zone-specific configuration
The level of configuration specific for a particular zone defined in IdM has the highest priority. You can manage zone-specific configuration by using the ipa dnszone-* and ipa dnsforwardzone-* commands.
Per-server configuration
You are asked to define per-server forwarders during the installation of an IdM server. You can manage per-server forwarders by using the ipa dnsserver-* commands. If you do not want to set a per-server forwarder when installing a replica, you can use the --no-forwarder option.
Global DNS configuration
If no zone-specific configuration is defined, IdM uses global DNS configuration stored in LDAP. You can manage global DNS configuration using the ipa dnsconfig-* commands. Settings defined in global DNS configuration are applied to all IdM DNS servers.
Configuration in /etc/named.conf

Configuration defined in the /etc/named.conf file on each IdM DNS server has the lowest priority. It is specific for each server and must be edited manually.

The /etc/named.conf file is usually only used to specify DNS forwarding to a local DNS cache. Other options are managed using the commands for zone-specific and global DNS configuration mentioned above.

You can configure DNS options on multiple levels at the same time. In such cases, configuration with the highest priority takes precedence over configuration defined at lower levels.

Identity Management (IdM) initializes zones with default settings for refresh periods, transfers, and caching. You can modify these attributes to control SOA record behavior and update frequency via the CLI or Web UI.

In IdM DNS zone attributes, you can find the attributes of the default zone configuration that you can modify using one of the following options:

Along with setting the actual information for the zone, the settings define how the DNS server handles the start of authority (SOA) record entries and how it updates its records from the DNS name server.

Expand
Table 2.1. IdM DNS zone attributes
AttributeCommand-Line OptionDescription

Authoritative name server

--name-server

Sets the domain name of the primary DNS name server, also known as SOA MNAME.

By default, each IdM server advertises itself in the SOA MNAME field. Consequently, the value stored in LDAP using --name-server is ignored.

Administrator e-mail address

--admin-email

Sets the email address to use for the zone administrator. This defaults to the root account on the host.

SOA serial

--serial

Sets a serial number in the SOA record. Note that IdM sets the version number automatically and users are not expected to modify it.

SOA refresh

--refresh

Sets the interval, in seconds, for a secondary DNS server to wait before requesting updates from the primary DNS server.

SOA retry

--retry

Sets the time, in seconds, to wait before retrying a failed refresh operation.

SOA expire

--expire

Sets the time, in seconds, that a secondary DNS server will try to perform a refresh update before ending the operation attempt.

SOA minimum

--minimum

Sets the time to live (TTL) value in seconds for negative caching according to RFC 2308.

SOA time to live

--ttl

Sets TTL in seconds for records at zone apex. In zone example.com, for example, all records (A, NS, or SOA) under name example.com are configured, but no other domain names, like test.example.com, are affected.

Default time to live

--default-ttl

Sets the default time to live (TTL) value in seconds for negative caching for all values in a zone that never had an individual TTL value set before.

BIND update policy

--update-policy

Sets the permissions allowed to clients in the DNS zone.

Dynamic update

--dynamic-update=TRUE|FALSE

Enables dynamic updates to DNS records for clients.

Note that if this is set to false, IdM client machines will not be able to add or update their IP address.

Allow transfer

--allow-transfer=string

Gives a list of IP addresses or network names which are allowed to transfer the given zone, separated by semicolons (;).

Zone transfers are disabled by default. The default --allow-transfer value is none.

Allow query

--allow-query

Gives a list of IP addresses or network names which are allowed to issue DNS queries, separated by semicolons (;).

Allow PTR sync

--allow-sync-ptr=1|0

Sets whether A or AAAA records (forward records) for the zone will be automatically synchronized with the PTR (reverse) records.

Zone forwarders

--forwarder=IP_address

Specifies a forwarder specifically configured for the DNS zone. This is separate from any global forwarders used in the IdM domain.

To specify multiple forwarders, use the option multiple times.

Forward policy

--forward-policy=none|only|first

Specifies the forward policy. For information about the supported policies, see DNS forward policies in IdM.

Modify zone configuration attributes such as TTL and refresh intervals through the Settings tab in the IdM Web UI. Changes to most attributes take effect immediately across the IdM environment.

Prerequisites

  • You are logged in as IdM administrator.

Procedure

  1. In the IdM Web UI, click Network Services DNS DNS Zones.

    DNS primary zones management

    A screenshot showing that a user has navigated to the Network Services tab and has selected DNS Zones from the DNS submenu

  2. In the DNS Zones section, click on the zone name in the list of all zones to open the DNS zone page.

    Editing a primary zone

    A screenshot highlighting an entry for a DNS zone displayed on the left side of the DNS Zones page

  3. Click Settings.

    The Settings tab in the primary zone edit page

    A screenshot highlighting the Settings tab in the primary zone edit page

  4. Change the zone configuration as required.

    For information about the available settings, see IdM DNS zone attributes.

  5. Click Save to confirm the new configuration.

    Note

    If you are changing the default time to live (TTL) of a zone, restart the named service on all IdM DNS servers to make the changes take effect. All other settings are automatically activated immediately.

Update existing DNS zone settings with the ipa dnszone-mod command. This tool overwrites current values or adds new ones for specific attributes like retry intervals and update policies.

Prerequisites

  • You are logged in as IdM administrator.

Procedure

  • To modify an existing primary DNS zone, use the ipa dnszone-mod command. For example, to set the time to wait before retrying a failed refresh operation to 1800 seconds: 

    $ ipa dnszone-mod --retry 1800

    For more information about the available settings and their corresponding CLI options, see IdM DNS zone attributes.

    If a specific setting does not have a value in the DNS zone entry you are modifying, the ipa dnszone-mod command adds the value. If the setting does not have a value, the command overwrites the current value with the specified value.

    Note

    If you are changing the default time to live (TTL) of a zone, restart the named service on all IdM DNS servers to make the changes take effect. All other settings are automatically activated immediately.

2.10. Zone transfers in IdM
Copy link

Zone transfers copy resource records between name servers to ensure data consistency. Identity Management (IdM) supports the AXFR and IXFR standards to distribute authoritative data to servers outside the primary zone.

In an Identity Management (IdM) deployment that has integrated DNS, you can use zone transfers to copy all resource records from one name server to another. Name servers maintain authoritative data for their zones. If you make changes to the zone on a DNS server that is authoritative for zone A DNS zone, you must distribute the changes among the other name servers in the IdM DNS domain that are outside zone A.

Important

The IdM-integrated DNS can be written to by different servers simultaneously. The Start of Authority (SOA) serial numbers in IdM zones are not synchronized among the individual IdM DNS servers. For this reason, configure your DNS servers outside the to-be-transferred zone to only use one specific DNS server inside the to-be-transferred zone. This prevents zone transfer failures caused by non-synchronized SOA serial numbers.

IdM supports zone transfers according to the RFC 5936 (AXFR) and RFC 1995 (IXFR) standards.

2.11. Enabling zone transfers in IdM Web UI
Copy link

Authorize specific name servers to receive zone records by updating the Allow Transfer settings in the IdM Web UI. This creates a secure list of IP addresses permitted to request full zone data.

Prerequisites

  • You are logged in as IdM administrator.

Procedure

  1. In the IdM Web UI, click Network Services DNS DNS Zones.
  2. Click Settings.

  3. Under Allow transfer, specify the name servers to which you want to transfer the zone records.

    Figure 2.1. Enabling zone transfers

    A screenshot of the
  4. Click Save at the top of the DNS zone page to confirm the new configuration.

2.12. Enabling zone transfers in IdM CLI
Copy link

Use the ipa dnszone-mod command with the --allow-transfer option to enable data distribution. This defines which external name servers can synchronize with the BIND service on the IdM host.

Prerequisites

  • You are logged in as IdM administrator.
  • You have root access to the secondary DNS servers.

Procedure

  • To enable zone transfers in the BIND service, enter the ipa dnszone-mod command, and specify the list of name servers that are outside the to-be-transferred zone to which the zone records will be transferred using the --allow-transfer option. For example: 

    $ ipa dnszone-mod --allow-transfer=192.0.2.1;198.51.100.1;203.0.113.1 idm.example.com

Verification

  1. SSH to one of the DNS servers to which zone transfer has been enabled: 

    $ ssh 192.0.2.1

  2. Transfer the IdM DNS zone using a tool such as the dig utility: 

    # dig @ipa-server zone_name AXFR

If the command returns no error, you have successfully enabled zone transfer for zone_name.

Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2026 Red HatBack to top