Provided by: nslint_2.1a3-2_i386
nslint - perform consistency checks on dns files
nslint [ -d ] [ -b named.boot ] [ -B nslint.boot ]
nslint [ -d ] [ -c named.conf ] [ -C nslint.conf ]
Nslint reads the nameserver configuration files and performs a number
of consistency checks on the dns records. If any problems are
discovered, error messages are displayed on stderr and nslint exits
with a non-zero status.
Here is a short list of errors nslint detects:
Records that are malformed.
Names that contain dots but are missing a trailing dot.
PTR records with names that are missing a trailing dot.
Names that contain illegal characters (rfc1034).
A records without matching PTR records
PTR records without matching A records
Names with more than one address on the same subnet.
Addresses in use by more than one name.
Names with CNAME and other records (rfc1033).
Unknown service and/or protocol keywords in WKS records.
-b Specify an alternate named.boot file. The default is
-c Specify an alternate named.conf file. The default is
-B Specify an alternate nslint.boot file. The default is
nslint.boot in the last directory line processed in
named.boot (or the current working directory). This file
is processed like a second named.boot. The most common
use is to tell nslint about A records that match PTR
records that point outside the domains listed in
-C Specify an alternate nslint.conf file. The default is
nslint.conf in the last directory line processed in
named.conf (or the current working directory). This file
is processed like a second named.conf.
-d Raise the debugging level. Debugging information is
displayed on stdout.
Nslint knows how to read old style named.boot and BIND 8’s new
named.conf files. If both files exist, nslint will prefer
named.conf (on the theory that you forgot to delete named.boot
when you upgraded to BIND 8).
There are some cases where it is necessary to use the advanced
configuration features of nslint. Advanced configuration is
done with the nslint.boot file.
The most common is when a site has a demilitarized zone (DMZ).
The problem here is that the DMZ network will have PTR records
for hosts outside its domain. For example lets say we have
1.1 604800 in ptr gateway.lbl.gov.
2.1 604800 in ptr gateway.es.net.
Obviously we will define an A record for gateway.lbl.gov
pointing to 22.214.171.124 but we will get errors because there is no
A record defined for gateway.es.net. The solution is to create
a nslint.boot file (in the same directory as the other dns
primary es.net nslint.es.net
And then create the file nslint.es.net with:
gateway 1 in a 126.96.36.199
Another problem occurs when there is a CNAME that points to a
host outside the local domains. Let’s say we have info.lbl.gov
pointing to larry.es.net:
info 604800 in cname larry.es.net.
In this case we would need:
primary es.net nslint.es.net
in nslint.boot and:
larry 1 in txt "place holder"
One last problem when a pseudo host is setup to allow two more
more actual hosts provide a service. For, let’s say that lbl.gov
server 604800 in a 188.8.131.52
server 604800 in a 184.108.40.206
tom 604800 in a 220.127.116.11
tom 604800 in mx 0 lbl.gov.
jerry 604800 in a 18.104.22.168
jerry 604800 in mx 0 lbl.gov.
In this case nslint would complain about missing PTR records and
ip addresses in use by more than one host. To suppress these
warnings, add you would the lines:
primary lbl.gov nslint.lbl.gov
primary 0.128.in-addr.arpa nslint.128.0.rev
to nslint.boot and create nslint.lbl.gov with:
server 1 in allowdupa 22.214.171.124
server 1 in allowdupa 126.96.36.199
and create nslint.128.0.rev with:
6.6 604800 in ptr server.lbl.gov.
94.6 604800 in ptr server.lbl.gov.
In this example, the allowdupa keyword tells nslint that it’s ok
for 188.8.131.52 and 184.108.40.206 to be shared by server.lbl.gov,
tom.lbl.gov, and jerry.lbl.gov.
One last nslint feature helps detect hosts that have mistakenly
had two ip addresses assigned on the same subnet. This can
happen when two different people request an ip address for the
same hostname or when someone forgets an address has been
assigned and requests a new number.
To detect such A records, add a nslint section to your
nslint.conf containing something similar to:
network "128.0.6 255.255.252.0";
The two network lines in this example are equivalent ways of
saying the same thing; that subnet 128.0.6 has a 22 bit wide
If you are using nslint.boot, the syntax would be:
network 128.0.6 255.255.252.0
Again this shows two ways of saying the same thing.
Using information from the above network statement, nslint would
would flag the following A records as being in error:
server 1 in a 220.127.116.11
server 1 in a 18.104.22.168
Note that if you specify any network lines in your nslint.conf
or nslint.boot files, nslint requires you to include lines for
all networks; otherwise you might forget to add network lines
for new networks.
/etc/named.boot - default named configuration file
nslint.boot - default nslint configuration file
named(8), rfc1033, rfc1034
Craig Leres of the Lawrence Berkeley National Laboratory,
University of California, Berkeley, CA.
The current version is available via anonymous ftp:
Please send bug reports to email@example.com.
Not everyone is guaranteed to agree with all the checks done.