--- title: "Creating DNS Config Profiles" canonical: "https://docs.infoblox.com/space/BloxOneDDI/186681371/Creating%20DNS%20Config%20Profiles" format: markdown --- > ⚠️ **Note** > ⚠️ > ⚠️ The values for the DNS Config profiles are inherited from the Global DNS Configuration. To override the values, slide the **Inherit** toggle to **Override**. For additional information on inheritance, see *[DNS Inheritance](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneDDI/pages/609320975)*. To configure a DNS config profile, complete the following: 1. From the Infoblox Portal, click **Network** > **DNS** > **DNS Config Profiles **> **Create DNS Config Profile.** 2. On the *Create DNS Config Profiles *page, specify the following: - **Name**: Enter a name for the DNS config profile**.** - **Description**: Enter additional details about the DNS config profile. 3. **Tags**: For information about tags, see *[Managing Tags](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneDDI/pages/186745865)*. 4. In the **ALLOW QUERIES FROM** section, click **Add** to add or click **Remove** to remove the entries. Select one of the following from the **TYPE** drop-down list: - **Any Address/Network**: Select this option to allow or deny queries from any IP addresses or networks. The application replies to queries from all clients. The **PERMISSION** column displays **Allow** by default. You can change it to **Deny** by clicking the field and selecting **Deny** from the drop-down list. - **IPv4 Address**: Select this option to add an IPv4 address. Click the **VALUE** field and enter the IP address of the client from which the query originates. The **PERMISSION** column displays **Allow** by default. You can change it to **Deny** by clicking the field and selecting **Deny** from the drop-down list. - **IPv4 Network**: Select this option to add a network to the list. Click the **VALUE** field and enter an IPv4 network address and type a netmask. The **PERMISSION** column displays **Allow** by default. You can change it to **Deny** by clicking the field and selecting **Deny** from the drop-down list. - **Named ACL**: Select this option to add a named ACL that you want to use. Click the **VALUE** field and the list of named ACLs are displayed. If you only have one named ACL, the application automatically displays the named ACL. When you select this, the application replies to DNS queries from clients matching the ACL. You can click **Clear** to remove the selected named ACL. - **TSIG Key**: Select an existing TSIG. For more information, see *[Configuring TSIG Keys](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneDDI/pages/186778455)*. 5. In the **AAAA FILTERING** section, configure the following: - **Filtering**: Choose one of the following options for filtering AAAA records: - **Enabled**: Choose this option of you want to enable AAAA filtering. - **Disabled**: Choose this option if you want to disable AAAA filtering. - **Break DNSSEC**: Enabling **Break DNSSEC** for AAAA filtering means that AAAA records are removed from DNS responses, even if they are DNSSEC-signed, which can cause DNSSEC validation to fail. 6. In the **REMOVE AAAA RECORDS IN RESPONSE TO** section, click **Add** to add or click **Remove** to remove the entries. Select one of the following from the **TYPE** drop-down list: - **Any Address/Network**: Select this option to allow or deny queries from any IP addresses or networks. The application replies to queries from all clients. The **PERMISSION** column displays **Allow** by default. You can change it to **Deny** by clicking the field and selecting **Deny** from the drop-down list. - **IPv4 Address**: Select this option to add an IPv4 address. Click the **VALUE** field and enter the IP address of the client from which the query originates. The **PERMISSION** column displays **Allow** by default. You can change it to **Deny** by clicking the field and selecting **Deny** from the drop-down list. - **IPv4 Network**: Select this option to add a network to the list. Click the **VALUE** field and enter an IPv4 network address and type a netmask. The **PERMISSION** column displays **Allow** by default. You can change it to **Deny** by clicking the field and selecting **Deny** from the drop-down list. - **IPv6 Address**: Select this option to add an IPv6 address. Click the **VALUE** field and enter the IP address of the client from which the query originates. The **PERMISSION** column displays **Allow** by default. You can change it to **Deny** by clicking the field and selecting **Deny** from the drop-down list. - **IPv6 Network**: Select this option to add a network to the list. Click the **VALUE** field and enter an IPv6 network address and type a netmask. The **PERMISSION** column displays **Allow** by default. You can change it to **Deny** by clicking the field and selecting **Deny** from the drop-down list. - **Named ACL**: Select this option to add a named ACL that you want to use. Click the **VALUE** field and the list of named ACLs are displayed. If you only have one named ACL, the application automatically displays the named ACL. When you select this, the application replies to DNS queries from clients matching the ACL. You can click **Clear** to remove the selected named ACL. - **TSIG Key**: Select an existing TSIG. For more information, see *[Configuring TSIG Keys](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneDDI/pages/186778455)*. 7. In the **FAULT TOLERANT CACHING** section, configure the following settings: - **Enable Fault Tolerant Caching**: Select the check box to enable the DNS Server (NIOS-X Server or NIOS-X as a Service) to respond to DNS queries when the server is down. When you enable this option, the DNS server (NIOS-X Server or NIOS-X as a Service) retains the expired records in the recursive cache. Whenever recursive queries times out or returns a SERVFAIL response, the NIOS-X Server or NIOS-X as a Service returns the cached response to the client instead of the SERVFAIL response. This option is disabled by default.When you enable DNS fault tolerant cache, you can also specify the TTL (time-to-live) and timeout settings for the expired records. TTL specifies the time duration for which the expired record is retained in the recursive cache. Setting a high TTL might cause the client to use incorrect data for a longer duration. Conversely, setting a low TTL renders more current cached data, but also increases the traffic on your network. The expired record is deleted from the recursive cache after the specified timeout duration. For more information, see *[Best Practices for Fault Tolerant Caching](http://infoblox-docs.atlassian.net/wiki/spaces/ddiadminguidensdraft/pages/1396342900)*. - **Expired Record TTL**: Specify the time duration that the DNS server must serve the expired records from the recursive cache before attempting to refresh the records. The default is five seconds. Select the time period in minutes, hours, or days from the drop-down list. - **Expired Record Timeout**: Specify the time duration that the DNS server waits before deleting the expired records from recursive cache. The default is 24 hours. Select the time period in minutes, hours, or days from the drop-down list. 8. In the **ACCEPT ZONE TRANSFER REQUESTS FROM** section, click **Add** to add or click **Remove** to remove the entries. Select one of the following from the **TYPE** drop-down list: - **Any Address/Network**: Select this option to allow or deny the application to send zone transfers to any IP address or network. The **PERMISSION** column displays **Allow** by default. You can change it to **Deny** by clicking the field and selecting **Deny** from the drop-down list. - **IPv4 Address**: Select this option to add an IPv4 address. Click the **VALUE** field and enter the IP address of the remote server. The **PERMISSION** column displays Allow by default. You can change it to **Deny** by clicking the field and selecting **Deny** from the drop-down list. - **IPv4 Network**: Select this option to add an IPv4 network address to the list. Click the **VALUE** field and enter an IPv4 network address and type a netmask. The **PERMISSION** column displays **Allow** by default. You can change it to **Deny** by clicking the field and selecting **Deny** from the drop-down list. - **Named ACL**: Select this option to add a named ACL. Click the **VALUE** field and the list of named ACLs are displayed. If you have only one named ACL, it is displayed automatically. When you select this, the application allows servers that have the **Allow** permission to send and receive DNS zone transfer data. You can click **Clear** to remove the selected named ACL. - **TSIG Key**: Select an existing TSIG. For more information, see *[Configuring TSIG Keys](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneDDI/pages/186778455)*. 9. In the **DNS Sort Lists** section, create DNS sort lists to prioritize A and AAAA records on certain networks when they are returned in DNS responses. For more information, see *[DNS Sort Lists](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneDDI/pages/291865120)**.* 10. In the **ALLOW DYNAMIC UPDATES FROM** section, click **Add** to add or click **Remove** to remove the entries. Select one of the following from the **TYPE** drop-down list: - **Any Address/Network**: Select this option to allow or deny the application to send zone transfers to any IP address or network. The **PERMISSION** column displays **Allow** by default. You can change it to **Deny** by clicking the field and selecting **Deny** from the drop-down list. - **IPv4 Address**: Select this option to add an IPv4 address. Click the **VALUE** field and enter the IP address of the remote server. The **PERMISSION** column displays Allow by default. You can change it to **Deny** by clicking the field and selecting **Deny** from the drop-down list. - **IPv4 Network**: Select this option to add an IPv4 network address to the list. Click the **VALUE** field and enter an IPv4 network address and type a netmask. The **PERMISSION** column displays **Allow** by default. You can change it to **Deny** by clicking the field and selecting **Deny** from the drop-down list. - **Named ACL**: Select this option to add a named ACL. Click the **VALUE** field and the list of named ACLs are displayed. If you have only one named ACL, it is displayed automatically. When you select this, the application allows servers that have the **Allow** permission to send and receive DNS zone transfer data. You can click **Clear** to remove the selected named ACL. - **TSIG Key**: Select an existing TSIG. For more information, see *[Configuring TSIG Keys](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneDDI/pages/186778455)*. 11. In the **Recursion** section, click **Allow** **recursion** to enable recursion, and specify the following: - **Allow GSS-TSIG–signed updates**: To allow GSS-TSIG–signed updates, select this checkbox. GSS-TSIG (Generic Security Service Algorithm for Secret Key Transaction) is used to authenticate DDNS updates. For more information, see *[Configuring GSS-TSIG](https://docs.infoblox.com/display/ddiadminguidensdraft/Configuring+GSS-TSIG)*. - In the **GSS-TSIG CONFIGURATION** section, choose one of the following options: - **New GSS-TSIG Keytab File**: Click **Select File**, find the keytab file, and click **Add**. - **Existing GSS-TSIG Keytab File**: Select the keytab file from the drop-down, and click **Add**. The following read-only information is shown: - **PRINCIPAL**: The principal name that is mapped to the keytab file - **DOMAIN**: The name of the domain that is mapped to the keytab file - **VERSION**: The version of the keytab file - **ENCRYPTION TYPE**: The encryption type of the key - **LAST UPDATED**: The timestamp of the key's last upload 12. In the **Recursion** section, click **Allow** **recursion** to enable recursion, and specify the following: - **Resolver query timeout**: Specify the maximum time allowed for a recursive query to wait for a response before timing out. You can enter a value between 10 and 30 seconds. The default value is 10 seconds. - **Lame TTL**: Specify the duration of time to cache a lame delegation or lame server. Select the period in seconds, minutes, or hours from the drop-down list. The default value is 600 seconds (ten minutes) and the maximum value is 3600 seconds (one hour). The value 0 (zero) disables lame caching and is not recommended. - **Max Cache TTL**: Specify the maximum duration of time for which the name server caches positive responses. Select the period in seconds, minutes, hours, days, or weeks from the drop-down list. The minimum value is 1 second and the maximum value is 604800 seconds (7 days). The default value is 604800 seconds (7 days). - **Max Negative Cache TTL**: Specify the maximum duration of time for which the name server caches negative responses. Select the period in seconds, minutes, hours, days, or weeks from the drop-down list. The default value is 10800 seconds (3 hours), minimum value is 1 second and the maximum value is 604800 seconds (7 days). 13. In the **Local** **Logging** section, configure a local syslog server. For more information, see *[Local Logging (DNS)](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneDDI/pages/186714477)*. The logs can also be accessed using the *[Data Connector](https://docs.infoblox.com/display/BloxOneThreatDefense/Data+Connector)*. 14. In the Local DNS Updates section create and manage DNS record updates directly on NIOS-X Servers during situations where connectivity to the Infoblox Portal is unavailable. For more information Local DNS Updates and configuration steps, see *[Configuring Local DNS Updates](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneDDI/pages/2282192910)*. 15. In the **DNSSEC Validation** section, you can configure DNSSEC to protect your DNS infrastructure protected. For more information on configuring DNSSEC, see *[DNSSEC Validation](https://infoblox-docs.atlassian.net/wiki/pages/createpage.action?spaceKey=bloxoneddi&title=DNSSEC%20Validation&linkCreation=true&fromPageId=186681371)*. 16. In the **ALLOW RECURSIVE QUERIES FROM **section, select one of the following from the **TYPE** drop-down list: - **Any Address/Network**: Select this option to allow or deny queries from any IP addresses. The **PERMISSION** column displays **Allow** by default. You can change it to **Deny** by clicking the field and selecting **Deny** from the drop-down list. - **IPv4 Address**: Select this option to add an IPv4 address. Click the **VALUE** field and enter the IP address of the remote clients. The **PERMISSION** column displays **Allow** by default. You can change it to **Deny** by clicking the field and selecting **Deny** from the drop-down list. - **IPv4 Network**: Select this option to add an IPv4 network address to the list. Click the **VALUE** field and enter an IPv4 network address and type a netmask. The **PERMISSION** column displays **Allow** by default. You can change it to **Deny** by clicking the field and selecting **Deny** from the drop-down list. - **Named ACL**: Select this option to add a named ACL. Click the **VALUE** field and the list of named ACLs are displayed. If you have only one named ACL, it is displayed automatically. When you select this option, the application allows clients with valid permission to perform recursive queries. - **TSIG Key**: Select an existing TSIG. For more information, see *[Configuring TSIG Keys](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneDDI/pages/186778455)*. 17. In the **ROOT NAME SERVERS** section, select one of the following options: - **Use Internet root name servers**: This option is selected by default. - **Use custom root name servers**: Select this option to use custom root name servers instead of the default name servers. Click **Add **and enter the following information when a new row appears: - **Name**: Enter a name for the root name server. - **Address**: Enter an IPv4 address for the root name server. 18. In the **FORWARDERS** section, click **Add** to add or click **Remove** to remove the entries under the **FORWARDERS**, and enter an IP address in the **ADDRESS **column. The field supports only IPv4 values. Select the respective check box and click **Remove** to remove a forwarderSelect the **Enable DNSSEC** check box and complete the following: - **Enable Validation**: If you allow the application to respond to recursive queries, you can select this check box to enable the application to validate responses to recursive queries for domains that you specify. - **Accept expired signature**: Click this check box to enable the application to accept responses with signatures that have expired. Though enabling this feature might be necessary to work temporarily with zones that have not had their signatures updated in a timely fashion, note that it could also increase the vulnerability of your network to replay attacks. - **TRUST ANCHORS**: Configure the DNSKEY record that holds the KSK as a trust anchor for each zone for which the application returns validated data. Click **Add** and complete the following: - **ZONE**: Enter the FQDN of the domain for which the application validates responses to recursive queries. - **SECURE ENTRY POINT (SEP)**: This check box is enabled by default to indicate that you are configuring a KSK. - **ALGORITHM TYPE**: Select the algorithm of the DNSKEY record: - RSAMD5 - Diffie-Hellman (This is not supported by BIND and Infoblox Universal DDI.) - DSA - RSASHA1 - DSA-NSEC3-SHA1 - RSASHA1-NSEC3-SHA1 - RSASHA-256 - RSASHA-512 - ECDSAP256SHA256 - ECDSAP384SHA384 - **PUBLIC KEY**: Paste the key into this text box. You can use either of the following commands to retrieve the key: - **dig . dnskey +multiline:** This command retrieves root zone keys and is the only public key you require for full chain of trust validation. - **dig [@server_address] dnskey +multiline +dnssec: **This command retrieves public keys from the zone you specify on the server and can be used if the parent zone is not signed. Note that the aforementioned command provides you with a key you need to cross validate against other servers to ensure you have an identical key. As an alternative, you can use [http://data.iana.org/root-anchors/](http://data.iana.org/root-anchors/) to retrieve signed public keys. You can find the trust anchors in formats like XML and CSR. For more information, refer to *[https://data.iana.org/root-anchors/old/2015-04-03/draft-icann-dnssec-trust-anchor.tx](https://data.iana.org/root-anchors/old/2015-04-03/draft-icann-dnssec-trust-anchor.txt)**[t](http://data.iana.org/root-anchors/draft-icann-dnssec-trust-anchor.txt)**.* 19. In the ** Server **section, complete the following: - **Query Port**: The source port for outbound DNS queries. When you set this port to 0, it will use any available port for outbound DNS queries. The default value is 0. - **Secondary AXFR query limit**: The maximum concurrent number of inbound full zone or AXFR transfers. It indicates the maximum number of DNS messages the primary server can send containing only the changed zone data, or the entire data set. The default value is 0. The minimum value is 0 and the maximum value is 65535. When you set the value to 0, the server uses a NIOS-X Server-dependent default value. - **Secondary SOA query limit**: The maximum number of concurrent queries a secondary name server sends to the primary server to find out if the zone serial numbers have been changed. The default value is 0. The minimum value is 1 and the maximum value is 65535. 20. In the **EDNS Client Subnet Configuration **section, complete the following: - **Enable Recursive EDNS Client Subnet**: Select this check box to enable recursive resolution using EDNS client subnet. This is disabled by default. If recursive EDNS client subnet is enabled, the application applies EDNS client subnet handling for queries that meet both of the following criteria: - If the source prefix length is not set to zero. - If the query zone name is listed in the whitelisted domains. - **Enable EDNS Client Subnet Forwarding**: Select this check box to enable EDNS client subnet forwarding. If you enable ECS forwarding, all queries containing a valid EDNS client subnet option will be forwarded to the authoritative server. - **QUERY ZONE PERMISSIONS**: Click **Add** to add a list of query zone names that are subject to ECS recursion and the corresponding permission. The application adds a row to the table. Complete the following: - **Zone**: Enter the zone name. - **Permission**: Select **Allow** or **Deny** from the drop-down list. - **IPv4 Source Prefix**: Specify the IPv4 source prefix length. You can enter a value between 1 and 24. The default value is 24. - **IPv6 Source Prefix**: Specify the IPv6 source prefix length. You can enter a value between 1 and 56. The default value is 56. 21. In the **Zone Settings Defaults** section, the **Use default forwarders to resolve queries for delegated subzones** check box is selected by default. Select this check box to use the default forwarders to resolve queries for delegated subzones. Clear the check box to create custom forwarders to resolve queries for delegated subzones. 22. Click **Save & Close**.