Download your favorite Linux distribution at LQ ISO.
Go Back > Forums > Linux Forums > Linux - Networking
User Name
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.


  Search this Thread
Old 06-03-2008, 02:36 AM   #1
Registered: Nov 2006
Posts: 91

Rep: Reputation: 27
Run two instances of a dlz engine in BIND 9.5?

I've been messing with the DLZ engines in Bind to move my DNS system to a MySQL database. I've run up against a snag in this process.

I want to run two separate instances of the mysql dlz engine. Why? Because I am also using my DNS server as an effective network-wide spam-blocker. I have a mySQL database containing a list of domain names of known spam sites. Basically, I have a dlz configuration wherein it simply looks up the domain to see if it's in the list; if so, it returns static values redirecting accesses to Additionally, I then want a "real" DNS database with actual IPs and hostnames for my local network.

Take a look at this setup:

options {
   directory "/home/named";
   pid-file "/var/run/named/";
   forwarders {;;
   recursion yes;

dlz "AdBlockZone" {
   database "mysql
   {socket=/var/run/mysql/mysql.sock host=localhost dbname=dns user=dns pass=***}
   {select d from spam_domains where d = '%zone%'}
   {select '' /* null address '%record%', '%zone%' */}
   {select ttl, type, data, resp, serial, refresh, retry, expire, minimum from spam_auth /* pseudo authority for %zone% */}

dlz "MySQLMain" {
   database "mysql
   {socket=/var/run/mysql/mysql.sock host=localhost dbname=dns user=dns pass=***}
   {select d from domains where d = '%zone%'}
   {select ttl,type,data from records where domain = '%zone%' and host = '%record%'}
   {select ttl, type, data, resp, serial, refresh, retry, expire, minimum from records where host = '%host%' and (type = 'SOA$
The first dlz definition is for my ad blocking database. Notice how it simply requests if the domain exists in the "spam" table; if so, it returns the IP of the local host. (The spam_auth table is a static table of a pseudo-authority recordset to satisfy named.) The second dlz definition is for my actual DNS records.

(By the way, those comments on the sql statements for the adblocking zone are to satisfy the engine's need to find the reference tokens in the SQL statement. It wouldn't start if I didn't put those there, stating "couldn't find required token %zone%" or whatever)

To help people understand, spam_domains is simply a table like thos:
| d                        |
|       |
| |
(except that it's 10,000+ records long!)

When I try to run named with this configuration, I get:

Jun  3 01:21:44 millions named[10963]: starting BIND 9.5.0 -u named
Jun  3 01:21:44 millions named[10963]: loading configuration from '/etc/named.conf'
Jun  3 01:21:44 millions named[10963]: /etc/named.conf:19: 'dlz' redefined near 'dlz'
Jun  3 01:21:44 millions named[10963]: loading configuration: already exists
Jun  3 01:21:44 millions named[10963]: exiting (due to fatal error)
Me being big on efficiency, it seems pointless to add a huge load of records to my MySQL databases just to represent the over 10,000 blocked ad domains, and still use that same database to store my actual DNS records. Not to mention being a serious PITA to manage my own DNS records, this would slow down access to actual DNS records.

What I'd expect is that BIND would try the first dlz def; if it can't get a result from it, try the second, and so on. Is BIND really limited to just one dlz definition? If so, what's my solution? I thought about running *two* BINDs and forwarding one to the other but this seems inefficient as well.

If I remove either dlz definition the other one works without problems. I simply want it to first look at my own domains, if it doesn't find it there look in the ad blocking set, if it doesn't find it there hit the forwarders.

So, to sum it up: Can BIND 9 accept two external dynamic DNS lookups in one server?

Thanks for your help,

Last edited by fmillion; 06-03-2008 at 02:38 AM.
Old 06-03-2008, 07:19 AM   #2
Registered: Jun 2005
Location: Odenton, MD
Distribution: Gentoo
Posts: 290

Rep: Reputation: 30
I'm guessing you probably have, but have you checked this?

It looks to me like you could specify multiple databases in on DLZ, but not multiple DLZ's. Just a thought.
Old 06-03-2008, 09:49 AM   #3
Registered: Nov 2006
Posts: 91

Original Poster
Rep: Reputation: 27
This is because the Postgres driver supports threads and can use more than one database connection at a time. The MySQL driver DOES NOT support threads, and can only use 1 database connection per driver instance.
It looks like PostgreSQL can do it but not MySQL. I lookd into using views but you have to specify a matching IP range or something. Don't know if you can have views drop down through each other in case of failure on one view but I'm guessing not.
Old 06-14-2008, 02:48 AM   #4
Registered: Nov 2006
Posts: 91

Original Poster
Rep: Reputation: 27
Ended up just running a second BIND to solve the problem, making it listen only on localhost to a specific port then setting my primary BIND to forward to it first then to my other nameservers.

Thankfully right now I only feel a need for two specific MySQL setups. I an hoping that someday BIND adds the ability for fall-through on views or multiple DLZ's.


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
How to run BIND behind a router JD50 Linux - Networking 9 04-07-2008 05:30 PM
How to run multiple mail client instances on KDE desktop Raishan Linux - Desktop 4 12-16-2006 12:57 PM
Can I run 2 instances of Firefox? BDiddy Linux - Software 3 09-01-2005 05:05 AM
Can't run two instances of a java program audibel Linux - Software 0 02-19-2005 05:01 PM
Those of you who run Mandrake 9.2 and BIND Rotwang Mandriva 0 05-17-2004 08:45 PM > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 01:13 AM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration