This extension brings a DNS dimension to TeemIp. It allows DDI administrators to manage DNS views, zones and their DNS records in close relation with TeemIp objects already defined in the IP space and in the CMDB.

Next to the management of IP and domain spaces, the DNS Zone Management extension allows Hostmasters to manage DNS zones within TeemIp:

• Document Views and manage DNS zones, including classless in-addr.arpa ones, within their respective views,
• Document authoritative DNS servers,
• Register DNS Resource Records (A, AAAA, CNAME, MX, NS, PTR, SRV, TXT, CAA, DS, OPENPGPKEY, SSHFP and TLSA) in relation with IP addresses or CIs stored in TeemIp CMDB,
• Document any other type of records through a generic container,
• Automatically or manually create, update or delete Resource Records when an IP is created, updated or deleted.
• Force creation, update or deletion of Resources Records at subnet level
• According to configuration parameters, records associated to obsolete IPs may be automatically removed
• Export zone data or retrieve them through WEB services from DNS master servers.

The TeemIp Zone Management extension is licensed under the terms of the GNU Affero General Public License Version 3 as published by the Free Software Foundation. This gives you legal permission to copy, distribute and/or modify TeemIp Zone Management under certain conditions. Read the ’license.txt’ file in the TeemIp distribution. TeemIp Zone Management is provided AS IS with NO WARRANTY OF ANY KIND, INCLUDING THE WARRANTY OF DESIGN, MERCHANTABILITY, AND FITNESS FOR A PARTICULAR PURPOSE.

This extension manages zones. It doesn't drive DNS servers.

There is no specific requirement with that extension. TeemIp DNS Zone Management is anyway already embedded in TeemIp standalone starting with TeemIp 2.4.

When installed on an iTop application, make sure that 'IPAM for iTop' is installed as well.

Installation on a TeemIp standalone is done with the application itself, through the setup.

When adding the module on an iTop application, use the Standard installation process for extensions.

DNS and Zone management parameters are grouped under the “Domain Information” section of the Global IP Settings of an organization.

Once installed, the extension will add a menu group called DNS Management where DNS Objects will be managed from.

The DNS Space menu provides some information on the DNS structural objects and summarizes the different DNS records under 8 badges:

These objects modelize the well known domains from the Domain Name Service.

Domain objects belong already to TeemIp core modules as documented in the Data model documentation. The DNS Zone Management extension alter them with a new tab that lists the related zones, ie the zones which name includes the domain name.

Details of a Domain can be accessed from the specific shortcut available under the DNS Management menu.

TeemIp handles DNS views, the solution offered by DNS to handle different communities of hosts that may require specific DNS answers according to the network where their resolution is requested from.

Details of a view can be accessed from the specific shortcut available under the DNS Management menu.

A given hostname may be resolved into different IPs according to the view it belongs to. This is modelized in TeemIp by making the View an attribute of IP addresses.

This changes the properties tab of an IP address as follows:

This is the key object of the DNS world around which everything is built. By definition, the zone is the domain minus what has been delegated from it.

Under the DNS management module, clicking on the “Create a new Zone” button available under the Name Space menu or clicking on the “New” button available with Zones lists will display the Zone creation form:

TeemIp DNS Zone Management allows you to generate zones data files. These text files follow the format defined by BIND and can be used as zone master data files in BIND master servers. A zone file can be sorted by records or by alphabetical order.

From the detailed menu of a zone, click on the “Display data file” action:

Output file will be displayed in a text box and can easily be copied and pasted to be used within a name servers.

The TeemIp Zone Management extension handles classless delegations for IPv4 reverse zones. It implements a method that is widely described in the DNS literature. The following lines explain you how to handle it.

As the owner of a standard class C reverse zone (like for instance the zone 54.205.3.in-addr.arpa.), you may decide to delegate the management of a subset of if, ie let a third party manage the PTR records of a contiguous subset of IP Addresses contained in the class C (say, 3.205.54.0 to 3.205.54.127).

• First of all, you need to set the delegation of the classless zone in its parent class C reverse zone. This is a standard delegation :

• Within the class C reverse zone, a CNAME record has to be created for every PTR that should be handled by the classless zone, like:

• Create the classless zone :

• And finally, create a PTR record for each of the IP addresses that the classless zone should handle:

TeemIp handles the most commonly used DNS Resource Records: A, AAAA, CNAME, MX, NS, PTR, SRV and TXT, plus a set of security dedicated Records: CAA, DS, OPENPGPKEY, SSHFP and TLSA as well as a generic record container to register any other type of Record. These are implemented through standard objects and belong to the data model. They all share the same following attributes:

• The “zone” attribute points to a forward or reverse zone, according to the record type, filtered by the organization that the zone belongs to.
• The “RR Name” is just the name of the record, known as the owner in the specialized literature.
• The default TTL of the zone that the record belongs to, may be overwritten by a specific value specified at the record level. This behaviour is driven by the “Overwrite zone TTL” boolean and the TTL duration.

This object is used to document the IPv4 Address record.

Details of a A Record can be accessed from the specific “A” shortcut menu of the DNS Management module.

This object is used to document the IPv6 Address record.

An AAAA record may be updated from the detailed view of the object.

This object is used to specify which Certificate Authorities (CAs) are allowed to issue certificates for the domain defined by the RR name.

A new CAA record may be created from the specific “CAA” shortcut menu of the DNS Management module.

This object is used to document the Canonical Name record.

A new CNAME record may be created from the specific “CNAME” shortcut menu of the DNS Management module.

This object is used to document Delegation Signer (DS) records required by DNSSEC to allow the transfer of trust from a parent zone to a child zone.

Details of a DS Record can be accessed from the specific “DS” shortcut menu of the DNS Management module.

This object is used to document the Mail Exchanger record.

Details of a MX Record can be accessed from the specific “MX” shortcut menu of the DNS Management module.

This object is used to document the Name Server record.

Details of a NS Record can be accessed from the specific “NS” shortcut menu of the DNS Management module.

This object is used to document the OPENPGPKEY record. Such record stores the OpenPGP public keys used to encrypt or sign email messages and files.

A new OPENPGPKEY record may be created from the specific “OPENPGPKEY” shortcut menu of the DNS Management module.

This object is used to document the Pointer record.

Details of a NS Record can be accessed from the specific “NS” shortcut menu of the DNS Management module.

This object is used to document the Secure Shell fingerprint records, a type of resource record which identifies SSH keys associated with a host name.

Details of a SSHFP record can be accessed from the specific “SSHFP” shortcut menu of the DNS Management module.

This object is used to document the Locate Services record.

A new SRV record may be created from the specific “SRV” shortcut menu of the DNS Management module.

This object is used to document the TLSA records which hold Certificate Association data. They specify the keys used in a domain's TLS servers.

Details of a TLSA record can be accessed from the specific “TLSA” shortcut menu of the DNS Management module.

This object is used to document the Text record.

A TXT record may be updated from the detailed view of the object.

Most popular or usefull DNS resource records have been documented in TeemIp. However, in the case where Hostmasters need to do document other types of records, a generic class has been created. It enables the raw edition of any type of records by opening to edition the whole payload of a DNS resource record.

A Generic record may be displayed from the specific “GENERIC” shortcut menu of the DNS Management module.

Resource Record types are typological elements. They are managed from the “IP space typology configuration” section of the main “Data administration” menu.

There is an obvious link between IP addresses and DNS records: an IP has a FQDN and aliases may point to that FQDN. As a consequence, A / AAAA, PTR and CNAME records may be associated with IPs. This is what the extension does by adding a “DNS Records” tab to IP Address objects.

The resource records associated to an IP address can be manually created, updated or deleted from the specific actions listed under the “Other Actions”.

A “DNS Records” tab within subnets' details screen lists the DNS records of all the IP addresses that belong to the subnet.

Starting with revision 3.0.1, audit rules are embedded within the extension. Here is the list.

This rule checks that, for a given zone, the master server, ie the one defined within the SOA record, is set as authoritative and master servers for the zone.

This rule checks that, for a given zone, all servers that appear in the NS record list are set as authoritative servers for the zone.

The TeemIp DNS Zone Management extension brings a new profile dedicated to the management of DNS objects: domains, zones, views and associated resource records: “Hostmaster - DNS”, a “Person handling the DNS space”. It has all rights on the DNS objects.

This profile extends capabilities and must be used together with other profiles like ConfigurationManager.