D. J. Bernstein
Internet publication

How to run an external cache in place of an existing BIND cache, strategy 2

These instructions assume that your network already has a computer using BIND to find addresses of Internet hosts (BIND as a ``DNS cache'') and to publish addresses of your own hosts (BIND as a ``DNS server''). Here is how to use dnscache instead of BIND to find addresses of Internet hosts.

If you have taken the recommended approach of having different computers (or at least different IP addresses) for your DNS caches (listed in /etc/resolv.conf) and your DNS servers (listed in NS records), use strategy 3 instead. Strategy 3 is simpler than strategy 2.

If you can easily change /etc/resolv.conf on all your client machines, use strategy 1 instead. Strategy 2 is more complicated but avoids changing /etc/resolv.conf. If you're an ISP and you've given your cache IP address to thousands of client computers, use strategy 2.

Separating DNS service from DNS caching

For concreteness, let's say you're running BIND on two computers, dns1.panic.mil and dns2.panic.mil, with IP addresses and These computers have two functions: Before you upgrade from BIND, you will have to put these two different functions on different IP addresses, as explained here.

1. Allocate two new public IP addresses in your network, let's say and

2. On dns1.panic.mil, as root: Set up as an IP alias. Restart BIND.

3. On dns2.panic.mil, as root: Set up as an IP alias. Change to in the masters lines in named.conf. Restart BIND.

4. On dns1.panic.mil, as root: In your BIND zone files, change the IP address of dns1.panic.mil from to, create a new dnscache1.panic.mil name with IP address, change the IP address of dns2.panic.mil from to, and create a new dnscache2.panic.mil name with IP address Tell BIND to read the new zone files.

5. Contact the .mil parent server to make the same changes in the IP addresses of dns1.panic.mil and dns2.panic.mil.

6. If you have other NS names pointing to BIND (for example, if dns1.panic.mil is also known as dns1.panic.edu), repeat steps 4 and 5 for those names.

7. Wait a few days for the modified DNS records to spread through the Internet.

Upgrading the cache

Here's the current situation: You can now follow the strategy 3 instructions. Those instructions will switch the DNS-cache software from BIND to dnscache, leaving BIND in place as the DNS-server software.