Table of Contents

DNS Zone Management

name:
DNS Zone Management
description:
Provides zone management features within TeemIp
version:
3.1.2
release:
2024-06-26
TeemIp:
3.1+
iTop:
3.1+
code:
teemip-zone-mgmt
localization:
English, French
state:
stable
keyword:
dns, zone
dependencies:
teemip-framework, teemip-ip-mgmt, teemip-ipv6-mgmt, teemip-network-mgmt
download:
teemip-zone-mgmt-3.1.2-708.zip
github:
teemip-zone-mgmt
php-max:
8.3

This extension brings a DNS dimension to TeemIp. It allows DDI administrators to manage DNS views, zones and their DNS records in close relation with TeemIp objects already defined in the IP space and in the CMDB.

Vocabulary: by “TeemIp solution” or “TeemIP”, it should be understood: TeemIp standalone or the iTop solution on top of which TeemIp as a module has been installed.

Revision History

Version Release Date Status iTop
Min
IPAM for iTop
Min
Comments
3.1.2 2024-06-26 Supported 3.1.0 3.1.0 - Long TXT records are supported.
- Audits have been grouped under the “DNS management” audit domain.
- DNS Views are taken into consideration when duplicate IPs are checked.
- Data samples have been added
- Zone serial # can be increased following 3 methods
3.1.1 2023-12-11 Supported 3.1.0 3.1.0 - Add Chinese (simplified) translation
- Background task is not processed when activity status is checked
3.1.0 2023-06-21 Obsolete 3.0.0 3.1.0 - New records have been added: CAA, DS, OPENPGPKEY, SSHFP, TLSA as well as a generic record to accommodate other types of records.
- Resource records attached to IPs may be automatically deleted when the IP become obsolete (released or unassigned, for instance).
- A new dedicated background task, controlled be configuration parameters, may handle regular cleanup of such records.
- Authoritative DNS servers can now be Application Solutions, Network Devices and Network Clusters next to Servers and Virtual Machines.
3.0.1 2022-09-09 Obsolete 2.7.0 3.0.1 - Adopt 3.x icon style
- Enhance overview menu
- Support classless delegation
- Add audit rules
3.0.0 2022-01-05 Obsolete 2.7.0 3.0.0 - TeemIp / iTop 3.x compatible version
2.7.1 2021-04-01 Obsolete 2.7.0 2.6.0 - Allow @ in RRs associated to IPs with an empty short name
- Wildcards can be set on RRs
- Addresses like claude.monet@demo.com are handled in SOA records
- Authoritative servers can now be servers or virtual machines
- Details screen of a subnet displays a tab listing RRs associated to all subnet IPs
- Align extension structure with new guidelines
2.7.0 2020-12-11 Obsolete 2.7.0 2.6.0 - Move some DisplayBare methods to iApplicationUIExtension API
2.6.2 2020-06-22 Obsolete 2.7.0 2.6.0 - Correct bug within data file generation
2.6.1 2020-05-08 Obsolete 2.7.0 2.6.0 - Correct Hostmaster DNS profile
- Adapt handling of AAAA records to new IPv6 modelization
2.6.0 2020-04-14 Obsolete 2.7.0 2.6.0 - Revision compatible with TeemIp 2.6 / iTop 2.7
1.2.0 2019-12-10 Obsolete 2.6.0 2.4.0 - Update resource records from subnets
- Allow @ in RRs
- Document authoritative servers
1.1.0 2019-09-24 Obsolete 2.6.0 2.4.0 - Management of IP addresses and resource records are now linked
1.0.0 2019-02-09 Obsolete 2.6.0 2.4.0 - Initial revision

Features

Next to the management of IP and domain spaces, the DNS Zone Management extension allows Hostmasters to manage DNS zones within TeemIp:

Licensing

The TeemIp Zone Management extension is licensed under the terms of the GNU Affero General Public License Version 3 as published by the Free Software Foundation. This gives you legal permission to copy, distribute and/or modify TeemIp Zone Management under certain conditions. Read the ’license.txt’ file in the TeemIp distribution. TeemIp Zone Management is provided AS IS with NO WARRANTY OF ANY KIND, INCLUDING THE WARRANTY OF DESIGN, MERCHANTABILITY, AND FITNESS FOR A PARTICULAR PURPOSE.

Limitations

This extension manages zones. It doesn't drive DNS servers.

Requirements

There is no specific requirement with that extension. TeemIp DNS Zone Management is anyway already embedded in TeemIp standalone starting with TeemIp 2.4.

When installed on an iTop application, make sure that 'IPAM for iTop' is installed as well.

Installation

Installation on a TeemIp standalone is done with the application itself, through the setup.

When adding the module on an iTop application, use the Standard installation process for extensions.

Configuration

DNS and Zone management parameters are grouped under the “Domain Information” section of the Global IP Settings of an organization.

Parameter Type Allowed values Default value Extension Description
Domain Information
Delegate domains to children organizations only Boolean Yes / No No IPAM for iTop Allow delegation of domains to all organizations or to children organizations only.
Automatically update DNS records Boolean Yes / No No DNS Zone Management Enables or disables the automatic creation, modification or deletion of DNS records when an IP address is created, modified or deleted.
Remove DNS records from obsolete IPs Boolean Yes / No No DNS Zone Management Remove Resource Records associated to IP addresses that become obsolete.
Serial update method Enum Increment by one /
Date, in ISO 8601 basic format, followed by a two-digit counter /
Date expressed as the number of seconds since the UNIX epoch
Increment by one DNS Zone Management Method used to update the serial number of a zone

DNS Management Menu

Once installed, the extension will add a menu group called DNS Management where DNS Objects will be managed from.

The DNS management menu is hidden to the users that don't have the administrator profile, the Hostmaster - DNS profile or r/o privileges on the Zone objects.

The DNS Space menu provides some information on the DNS structural objects and summarizes the different DNS records under 8 badges:

Domains

These objects modelize the well known domains from the Domain Name Service.

Domain objects belong already to TeemIp core modules as documented in the Data model documentation. The DNS Zone Management extension alter them with a new tab that lists the related zones, ie the zones which name includes the domain name.

Tabs

Tab Description
Related zones All the zones related to the domain

Details

Details of a Domain can be accessed from the specific shortcut available under the DNS Management menu.

Views

TeemIp handles DNS views, the solution offered by DNS to handle different communities of hosts that may require specific DNS answers according to the network where their resolution is requested from.

Properties

Name Type Mandatory?
Organization Foreign key to a(n) Organization Yes
Name Alphanumeric string Yes
Description Multiline character string No

Details

Details of a view can be accessed from the specific shortcut available under the DNS Management menu.

A given hostname may be resolved into different IPs according to the view it belongs to. This is modelized in TeemIp by making the View an attribute of IP addresses.

IP Address Properties

Name Type Mandatory?
DNS Information
DNS View Foreign key to a(n) View No

This changes the properties tab of an IP address as follows:

Zones

This is the key object of the DNS world around which everything is built. By definition, the zone is the domain minus what has been delegated from it.

Zone Properties

Name Type Mandatory?
General Information
Organization Foreign key to a(n) Organization Yes
View Foreign key to a(n) View No
Mapping type Possible values: Forward, IPv4 Reverse, IPv6 Reverse Yes
Zone Name Alphanumeric string Yes
TTL Duration (days / hours / minutes /seconds) Yes
Comment Alphanumeric string No
Requestor Foreign key to a(n) Person No
Start Of Authority
Master server Alphanumeric string Yes
Hostmaster mailbox Email address (both formats claude@demo.com or claude.monet@demo.com are supported) Yes
Serial Number Yes
Refresh Duration (days / hours / minutes /seconds) Yes
Rettry Duration (days / hours / minutes /seconds) Yes
Expire Duration (days / hours / minutes /seconds) Yes
Minimum Duration (days / hours / minutes /seconds) Yes

Tabs

Tab Description
Authoritative servers All servers (class Application Solution, Network Device, Network Cluster, Server or VirtualMachine) from the CMDB that are authoritative for the zone
These can be flagged as Master, Slave, Hidden Master or Hidden Slave
NS records All the NS records of the zone
A Records All the A records of the zone
AAAA Records All the AAAA records of the zone
CNAME Records All the CNAME records of the zone
Other Records All the Other records of the zone
According to the Serial update method parameter, the serial # of a zone can be updated following 3 methods:
  • Increment by one
  • Date, in ISO 8601 basic format, followed by a two-digit counter
  • Date expressed as the number of seconds since the UNIX epoch

Creating a new Zone

Under the DNS management module, clicking on the “Create a new Zone” button available under the Name Space menu or clicking on the “New” button available with Zones lists will display the Zone creation form:

Displaying data file

TeemIp DNS Zone Management allows you to generate zones data files. These text files follow the format defined by BIND and can be used as zone master data files in BIND master servers. A zone file can be sorted by records or by alphabetical order.

From the detailed menu of a zone, click on the “Display data file” action:

Output file will be displayed in a text box and can easily be copied and pasted to be used within a name servers.

Zone data files can be retrieved through a specific WEB service, as documented in the REST/JSON chapter. This feature can be used from a DNS server to build its master data files for the zones it handles.

Classless Reverse Delegation

The TeemIp Zone Management extension handles classless delegations for IPv4 reverse zones. It implements a method that is widely described in the DNS literature. The following lines explain you how to handle it.

As the owner of a standard class C reverse zone (like for instance the zone 54.205.3.in-addr.arpa.), you may decide to delegate the management of a subset of if, ie let a third party manage the PTR records of a contiguous subset of IP Addresses contained in the class C (say, 3.205.54.0 to 3.205.54.127).

DNS Resource Records

TeemIp handles the most commonly used DNS Resource Records: A, AAAA, CNAME, MX, NS, PTR, SRV and TXT, plus a set of security dedicated Records: CAA, DS, OPENPGPKEY, SSHFP and TLSA as well as a generic record container to register any other type of Record. These are implemented through standard objects and belong to the data model. They all share the same following attributes:

Name Type Mandatory?
Organization Foreign key to a(n) Organization Yes
Zone Foreign key to a(n) Zone Yes
RR Name Alphanumeric string Yes
Overwrite zone TTL Yes or No No
TTL d/h/m/s N/A
RR Name attribute accepts:
- the ' @ ' character to denote the current origin, i.e. the name of the zone the RR belongs to
- the wildcard ' * ' character

A Records

This object is used to document the IPv4 Address record.

Properties

Name Type Mandatory?
Organization Foreign key to a(n) Organization Yes
Zone Foreign key to a(n) Zone Yes
RR Name Alphanumeric string (@ and *.<domain> accepted) Yes
Overwrite zone TTL Yes or No No
TTL d/h/m/s N/A
IPv4 Address Foreign key to a(n) IPv4 Address Yes
Comment Alphanumeric string No

Details

Details of a A Record can be accessed from the specific “A” shortcut menu of the DNS Management module.

AAAA Records

This object is used to document the IPv6 Address record.

Properties

Name Type Mandatory?
Organization Foreign key to a(n) Organization Yes
Zone Foreign key to a(n) Zone Yes
RR Name Alphanumeric string (@ and *.<domain> accepted) Yes
Overwrite zone TTL Yes or No No
TTL d/h/m/s N/A
IPv6 Address Foreign key to a(n) IPv6 Address Yes
Comment Alphanumeric string No

Update

An AAAA record may be updated from the detailed view of the object.

CAA Records

This object is used to specify which Certificate Authorities (CAs) are allowed to issue certificates for the domain defined by the RR name.

Properties

Name Type Mandatory?
Organization Foreign key to a(n) Organization Yes
Zone Foreign key to a(n) Zone Yes
RR Name Alphanumeric string (@ and *.<domain> accepted) Yes
Overwrite zone TTL Yes or No No
TTL d/h/m/s N/A
Flag Integer Yes
Tag Possible values: Iodef, Issue, Issue Wild
Value Strings associated with tags
Comment Alphanumeric string No

Creation

A new CAA record may be created from the specific “CAA” shortcut menu of the DNS Management module.

CNAME Records

This object is used to document the Canonical Name record.

Properties

Name Type Mandatory?
Organization Foreign key to a(n) Organization Yes
Zone Foreign key to a(n) Zone Yes
RR Name Alphanumeric string (@ and *.<domain> accepted) Yes
Overwrite zone TTL Yes or No No
TTL d/h/m/s N/A
CNAME Alphanumeric string Yes
Comment Alphanumeric string No

Creation

A new CNAME record may be created from the specific “CNAME” shortcut menu of the DNS Management module.

DS Records

This object is used to document Delegation Signer (DS) records required by DNSSEC to allow the transfer of trust from a parent zone to a child zone.

Properties

Name Type Mandatory?
Organization Foreign key to a(n) Organization Yes
Zone Foreign key to a(n) Zone Yes
RR Name Alphanumeric string (@ and *.<domain> accepted) Yes
Overwrite zone TTL Yes or No No
TTL d/h/m/s N/A
Key tag A short numeric value which can help quickly identify the referenced DNSKEY-record No
Algorithm The algorithm of the referenced DNSKEY-record No
Digest Type Cryptographic hash algorithm used to create the Digest value No
Digest A cryptographic hash value of the referenced DNSKEY-record Yes
Comment Alphanumeric string No

Details

Details of a DS Record can be accessed from the specific “DS” shortcut menu of the DNS Management module.

MX Records

This object is used to document the Mail Exchanger record.

Properties

Name Type Mandatory?
Organization Foreign key to a(n) Organization Yes
Zone Foreign key to a(n) Zone Yes
RR Name Alphanumeric string (@ and *.<domain> accepted) Yes
Overwrite zone TTL Yes or No No
TTL d/h/m/s N/A
Preference Integer No
Exchange Server Alphanumeric string Yes
Comment Alphanumeric string No

Details

Details of a MX Record can be accessed from the specific “MX” shortcut menu of the DNS Management module.

NS Records

This object is used to document the Name Server record.

Properties

Name Type Mandatory?
Organization Foreign key to a(n) Organization Yes
Zone Foreign key to a(n) Zone Yes
RR Name Alphanumeric string (@ and *.<domain> accepted) Yes
Overwrite zone TTL Yes or No No
TTL d/h/m/s N/A
Name Server Alphanumeric string Yes
Comment Alphanumeric string No

Details

Details of a NS Record can be accessed from the specific “NS” shortcut menu of the DNS Management module.

OPENPGPKEY records

This object is used to document the OPENPGPKEY record. Such record stores the OpenPGP public keys used to encrypt or sign email messages and files.

Properties

Name Type Mandatory?
Organization Foreign key to a(n) Organization Yes
Zone Foreign key to a(n) Zone Yes
RR Name Alphanumeric string Yes
Overwrite zone TTL Yes or No No
TTL d/h/m/s N/A
OpenPGP Public Key Multiline character string Yes
Comment Alphanumeric string No

Creation

A new OPENPGPKEY record may be created from the specific “OPENPGPKEY” shortcut menu of the DNS Management module.

PTR Records

This object is used to document the Pointer record.

Properties

Name Type Mandatory?
Organization Foreign key to a(n) Organization Yes
Zone Foreign key to a(n) Zone Yes
RR Name Alphanumeric string (compliant with IPv4 or IPv6 reverse format) Yes
Overwrite zone TTL Yes or No No
TTL d/h/m/s N/A
Hostname Alphanumeric string Yes
Comment Alphanumeric string No

Details

Details of a NS Record can be accessed from the specific “NS” shortcut menu of the DNS Management module.

SSHFP Records

This object is used to document the Secure Shell fingerprint records, a type of resource record which identifies SSH keys associated with a host name.

Properties

Name Type Mandatory?
Organization Foreign key to a(n) Organization Yes
Zone Foreign key to a(n) Zone Yes
RR Name Alphanumeric string Yes
Overwrite zone TTL Yes or No No
TTL d/h/m/s N/A
Algorithm Integer No
Digest Type Integer No
Fingerprint Alphanumeric string Yes
Comment Alphanumeric string No

Details

Details of a SSHFP record can be accessed from the specific “SSHFP” shortcut menu of the DNS Management module.

SRV Records

This object is used to document the Locate Services record.

Properties

Name Type Mandatory?
Organization Foreign key to a(n) Organization Yes
Zone Foreign key to a(n) Zone Yes
RR Name Alphanumeric string Yes
Overwrite zone TTL Yes or No No
TTL d/h/m/s N/A
Priority Integer No
Weight Integer No
Port Integer No
Target Alphanumeric string Yes
Comment Alphanumeric string No

Creation

A new SRV record may be created from the specific “SRV” shortcut menu of the DNS Management module.

TLSA Records

This object is used to document the TLSA records which hold Certificate Association data. They specify the keys used in a domain's TLS servers.

Properties

Name Type Mandatory?
Organization Foreign key to a(n) Organization Yes
Zone Foreign key to a(n) Zone Yes
RR Name Alphanumeric string Yes
Overwrite zone TTL Yes or No No
TTL d/h/m/s N/A
Certificate Usage Integer No
Selector Integer No
Matching Type Integer No
Certificate Association Data Alphanumeric string Yes
Comment Alphanumeric string No

Details

Details of a TLSA record can be accessed from the specific “TLSA” shortcut menu of the DNS Management module.

TXT Records

This object is used to document the Text record.

Properties

Name Type Mandatory?
Zone
Organization Foreign key to a(n) Organization Yes
Zone Foreign key to a(n) Zone Yes
RRs attributes
RR Name Alphanumeric string (@ and *.<domain> accepted) Yes
Overwrite zone TTL Yes or No No
TTL d/h/m/s N/A
Text Alphanumeric string Yes
Comment Alphanumeric string No
Chaining
Previous segment Foreign key to a(n) TXT Record No
Next segment Foreign key to a(n) TXT Record No

Update

A TXT record may be updated from the detailed view of the object.

TXT Records with a payload over 255 chars

A TXT record may have more than 255 characters of data, but not more than 255 characters in a single string, which is problematic for long chains like DKIM keys. RFC 4408 defines how to get around this limitation : a TXT record is allowed to contain multiple strings which should then be concatenated together by the reading application. TeemIP implements this concept through a chaining mechanism.

When a segment is set in a given TXT record, its counter part is automatically updated.
  • If Previous segment of record R1 is set to R0, then TeemIP will set Next segment of record R0 to R1
  • If Next segment of record R1 is set to R2, then TeemIp will set Previous segment of record R2 to R1
In a chain, only the RR Name of the first segment is relevant. It is considered as the reference for the TXT Record when the db file is built. The name of the following records of the chain are just used to name the objects.

The tool that generates Zone data files will take the chain into consideration and will create the proper entry in the db file as shown in the exemple below:

Generic Records

Most popular or usefull DNS resource records have been documented in TeemIp. However, in the case where Hostmasters need to do document other types of records, a generic class has been created. It enables the raw edition of any type of records by opening to edition the whole payload of a DNS resource record.

Properties

Name Type Mandatory?
Organization Foreign key to a(n) Organization Yes
Zone Foreign key to a(n) Zone Yes
RR Name Alphanumeric string (@ and *.<domain> accepted) Yes
Overwrite zone TTL Yes or No No
TTL d/h/m/s N/A
Type Foreign key to a(n) Resource Record Type Yes
Payload Alphanumeric string No
Comment Alphanumeric string No

Details

A Generic record may be displayed from the specific “GENERIC” shortcut menu of the DNS Management module.

Resource Record types are typological elements. They are managed from the “IP space typology configuration” section of the main “Data administration” menu.

There is an obvious link between IP addresses and DNS records: an IP has a FQDN and aliases may point to that FQDN. As a consequence, A / AAAA, PTR and CNAME records may be associated with IPs. This is what the extension does by adding a “DNS Records” tab to IP Address objects.

The resource records associated to an IP address can be manually created, updated or deleted from the specific actions listed under the “Other Actions”.

If enabled from the “Automatically update DNS records” parameter set in the Global IP Settings of a given organization, the DNS records can be as well automatically created, modified or deleted when an IP address is created, modified or deleted.

A “DNS Records” tab within subnets' details screen lists the DNS records of all the IP addresses that belong to the subnet.

Audit Rules

Starting with revision 3.0.1, audit rules are embedded within the extension. Here is the list.

Master server of Zone is not an authoritative server

This rule checks that, for a given zone, the master server, ie the one defined within the SOA record, is set as authoritative and master servers for the zone.

One server in NS Record of Zone is not an authoritative server

This rule checks that, for a given zone, all servers that appear in the NS record list are set as authoritative servers for the zone.

User Profiles

The TeemIp DNS Zone Management extension brings a new profile dedicated to the management of DNS objects: domains, zones, views and associated resource records: “Hostmaster - DNS”, a “Person handling the DNS space”. It has all rights on the DNS objects.

This profile extends capabilities and must be used together with other profiles like ConfigurationManager.

The DNS management menu is hidden to the users that don't have read capabilities on zones.