DNS
Requires the dns module. IPA's own DNS: zones, records, forward zones and forward policy, per-server forwarders, global config; how host records are maintained automatically, and why this group is meaningless with IPA_SETUP_DNS=false.
Requires the dns module and IPA_SETUP_DNS=true at install time (see Configuration). IPA's bundled BIND reads zone data from LDAP; these pages edit the LDAP records and BIND follows without a reload. On a deployment without DNS the pages address no service: the navigation still shows them, changes do nothing.
Zones
The installer creates the forward zone (the domain itself, e.g. linux.ipa.test.); a reverse zone is optional at install time. Zone names carry the trailing dot.
| Field | Meaning |
|---|---|
| Authoritative nameserver / Administrator e-mail | SOA MNAME / RNAME |
| SOA serial | bumped automatically on every record change |
| SOA refresh / retry / expire / minimum | timers for secondaries, if any; IPA replicas share data through LDAP replication, not AXFR |
| Dynamic update / BIND update policy | let clients update their own records with GSS-TSIG. ipa-client-install enables nsupdate and relies on the policy grant LINUX.IPA.TEST krb5-self * A; ... |
| Allow query / Allow transfer | ACLs; transfer defaults to none |
| Allow PTR sync | changing an A record also changes the PTR, provided the reverse zone is in IPA |
| DNSSEC | sign the zone; enable the key master on the DNS servers page first |
Records
One record name may hold several types (@ has NS, A and SOA). _kerberos, _ldap._tcp and the other SRV / URI / TXT records are maintained by the installer; clients discover servers through them, leave them alone.
Host records maintain themselves:
| Action | Effect |
|---|---|
ipa host-add --ip-address= | creates A (and PTR if the reverse zone exists) |
ipa-client-install | the client writes its own A / AAAA through nsupdate; later IP changes are pushed by sssd's dyndns_update |
ipa host-del | keeps the records; --updatedns removes them |
Forward zones and forward policy
A forward zone ("DNS forward zones") says "hand queries for this name to that server": forwarding ad.ipa.test. to the AD DC is a prerequisite of the AD trust (AD trust prerequisites › DNS).
The global config and every DNS server carry forwarders and a forward policy:
| Policy | Meaning |
|---|---|
| Forward first | ask the forwarders, recurse on failure |
| Forward only | ask the forwarders only, fail otherwise |
| Forwarding disabled | recurse |
Per-server settings override the global ones. The IPA server's own /etc/resolv.conf should point at 127.0.0.1, with the forwarders here handing external queries on.
Boundaries
- IPA DNS is not a general-purpose authoritative server: no views, no geo answers. Keep business domains on the corporate DNS and delegate the IPA domain to it.
- Zone data lives in LDAP;
ipa-backupcovers it,named's zone files do not exist. - Deleting a zone is irreversible and breaks SRV discovery for clients joining afterwards.
Certificate mapping
Requires the ca module. How a client certificate or smart card is matched to a user: matching and mapping rule syntax, priority, the global "prompt for username" switch, and checking a rule on the match page.
Automount locations
Requires the automount module. The location / map / key structure, the standard on-demand home directory setup, enabling clients, and why the UI stops at locations.