Maximum Cache TTL Microsoft DNS Server MSDNS

Open up regedit and navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters

Create a new DWORD "MaxCacheTtl" with a DECIMAL setting of 300 (for 300 seconds)

Then restart the DNS service (not required)

Negative Caching Microsoft DNS Server MSDNS

Open up regedit and navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNSCache\Parameters

Create a new DWORD "NegativeCacheTime" with a DECIMAL setting of 30 (for 30 seconds)

Then restart the DNS service

Enabled Query Logging BIND/NAMED/DNS

1) Add a new logging channel to /etc/named.conf before the closing '};'

channel querylog{
            file "/var/log/querylog";
            severity debug 10;
            print-category yes;
            print-time yes;
            print-severity yes;
            };
category queries { querylog;};

2) Create the log file

touch /var/log/querylog
chown named.named /var/log/querylog

3) Reload named.conf

service named reload

4) Enable the logging channel

rndc querylog on

5) View the log

tail -f /var/log/querylog

To save disk space you should disable logging once you've completed your log inspection

rndc querylog off
echo > /var/log/querylog

DKIM Key 1024 2048 Bits Causes BIND NAMED Error

By default BIND can only handle 255 characters per line for record length, however it can handle values up to 65,536 characters.

The trick to getting a DKIM key (or any zone record for that matter) to wrap within this limit you do the following:

_domainKey.domain.com. IN  TXT ( "p=part of your key"
                                  "another part of your key"
                                  "last part of your key" )

By wrapping the entire value in brackets we keep it tied to one record and by quoting each line individually it allows us to surpass the line limit.

Common errors with this:

dns_rdata_fromtext: near eol: unbalanced quotes
dns_master_load: label too long
dns_master_load: syntax error
zone: loading master file: ran out of space

Increase File Descriptor Limit For NAMED/BIND/DNS

BIND/NAMED is compiled with a hard limit of 4,096 file descriptors and sockets and as a result if you have alot of IP's on a server you may see the following errors in /var/log/messages.

socket: file descriptor exceeds limit (4096/4096)
could not listen on UDP socket: not enough free resource

To increase that limit, add the following:

ulimit -HSn 200000
OPTIONS="-4 -S 8096"

to:

/etc/sysconfig/named

and then run:

service named restart

Verify in /var/log/messages that you are no longer seeing those errors and also run:

service named status

...to ensure NAMED is running properly.