Chapter 9. Updating DNS records when using external DNS

• Your IdM deployment uses an external DNS server rather than integrated DNS.
• The bind-utils package is installed on the system running nsupdate.

Procedure

• To generate a file with the DNS records for nsupdate, use the `ipa dns-update-system-records --dry-run command with the --out option. The --out option specifies the path of the file to generate:

  $ ipa dns-update-system-records --dry-run --out dns_records_file.nsupdate
   IPA DNS records:
     _kerberos-master._tcp.example.com. 86400 IN SRV 0 100 88 ipa.example.com.
     _kerberos-master._udp.example.com. 86400 IN SRV 0 100 88 ipa.example.com.
  [... output truncated ...]

  The generated file contains the required DNS records in the format accepted by the nsupdate utility.

  For example:

  $ cat dns_records_file.nsupdate
  zone example.com.
  server 192.0.2.1
  ; IPA DNS records
  update delete _kerberos-master._tcp.example.com. SRV
  update add _kerberos-master._tcp.example.com. 86400 IN SRV 0 100 88 ipa.example.com.
  [... output truncated ...]

  The generated records rely on:

  • Automatic detection of the zone in which the records are to be updated.

  • Automatic detection of the zone’s authoritative server.

    If you are using an atypical DNS setup or if zone delegations are missing, nsupdate might not be able to find the right zone and server. In this case, add the following options to the beginning of the generated file:

  • server: specify the server name or port of the authoritative DNS server to which nsupdate sends the records.
  • zone: specify the name of the zone where nsupdate places the records.

Prerequisites

• Your DNS server must be configured for TSIG.
• Both the DNS server and its client must have the shared key.

Procedure

• Run the nsupdate command and provide the shared secret using one of these options:

  • -k to provide the TSIG authentication key:

    $ nsupdate -k tsig_key.file dns_records_file.nsupdate

  • -y to generate a signature from the name of the key and from the Base64-encoded shared secret:

    $ nsupdate -y algorithm:keyname:secret dns_records_file.nsupdate

Prerequisites

• Your DNS server must be configured for GSS-TSIG.