ip domain-name [domain]
Configures the default domain name appended to incomplete hostnames during DNS resolution, enabling the router to resolve unqualified names into fully qualified domain names.
Definition: ip domain-name [domain] is a Cisco IOS global config command. Configures the default domain name appended to incomplete hostnames during DNS resolution, enabling the router to resolve unqualified names into fully qualified domain names.
Overview
The `ip domain-name` command in global configuration mode sets a default domain name that the router appends to any hostname that does not contain a dot (i.e., an unqualified name). This is critical for DNS resolution because DNS queries require fully qualified domain names (FQDNs). When a user pings 'server1' instead of 'server1.example.com', the router automatically adds the configured domain name to form 'server1.example.com' before sending the DNS query.
This command is foundational for network services that rely on name resolution, such as SSH, Telnet, SNTP, and AAA authentication. Without it, the router would fail to resolve short names, leading to connectivity failures and administrative overhead. The command is typically used in conjunction with `ip name-server` to specify DNS servers.
It is also a prerequisite for generating RSA keys for SSH (via `crypto key generate rsa`), which requires a hostname and domain name. The domain name is stored in the running configuration and can be removed with `no ip domain-name`. The command does not affect already configured FQDNs; it only applies to names entered without a dot.
In terms of IOS behavior, the domain name is also used by the router to generate its own FQDN for certificates and key generation. The privilege level required is 15 (privileged EXEC). The command is available in all IOS versions and is a basic building block for network identity and security.
ip domain-name [domain]When to Use This Command
- Setting a domain name for a small office router so that pinging 'server1' resolves to 'server1.example.com'.
- Configuring a domain name for SSH key generation, as the domain name is required for RSA key pair creation.
- Defining a domain name for a branch office router to simplify hostname resolution in a corporate network.
- Using with 'ip name-server' to ensure DNS queries use the correct domain suffix.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| domain | WORD (1-64 characters) | Specifies the default domain name to be appended to unqualified hostnames. Valid values are any alphanumeric string, typically a registered domain like 'example.com' or 'lab.local'. Common mistakes include using a leading dot (e.g., '.example.com') which is incorrect, or including spaces. The domain name must not exceed 64 characters. |
Command Examples
Basic domain name configuration
ip domain-name example.comNo output is generated; the command sets the domain name to 'example.com' in the running configuration.
Verifying domain name configuration
show running-config | include ip domain-nameip domain-name example.com
The output displays the configured domain name. If missing, DNS resolution for unqualified names will fail.
Understanding the Output
The 'ip domain-name' command does not produce output upon execution. To verify the configuration, use 'show running-config | include ip domain-name' which displays the domain name if set. If no domain name is configured, the line will be absent, and the router will not append a domain suffix to unqualified hostnames.
This can cause DNS resolution failures for names like 'server1' unless a fully qualified domain name is used.
Configuration Scenarios
Configure DNS resolution for a small office network
A small office has a local DNS server at 192.168.1.10 that resolves internal hostnames. The network uses the domain 'office.internal'. The router must be configured to append this domain to short names so that users can ping 'printer1' instead of 'printer1.office.internal'.
Topology
R1(Gi0/0)---192.168.1.0/24---DNS Server (192.168.1.10)Steps
- 1.Step 1: Enter global configuration mode: configure terminal
- 2.Step 2: Set the domain name: ip domain-name office.internal
- 3.Step 3: Specify the DNS server: ip name-server 192.168.1.10
- 4.Step 4: (Optional) Enable DNS resolution if disabled: ip domain-lookup
- 5.Step 5: Exit and save: end, write memory
! configure terminal ip domain-name office.internal ip name-server 192.168.1.10 ip domain-lookup end write memory
Verify: Use `show hosts` to verify the domain name and name servers. Expected output includes 'Default domain is office.internal' and 'Name servers: 192.168.1.10'. Then test by pinging 'printer1' – the router should resolve to 'printer1.office.internal'.
Watch out: If the domain name is set after generating RSA keys, the keys will not include the domain. Always set the domain name before generating keys for SSH.
Prepare router for SSH access by setting domain name and generating RSA keys
A network engineer needs to enable SSH on a Cisco router for secure remote management. SSH requires a hostname and domain name to generate RSA keys. The router's hostname is 'R1' and the domain is 'securenet.com'.
Topology
R1 (management interface)---192.168.10.0/24---Admin PCSteps
- 1.Step 1: Set hostname: hostname R1
- 2.Step 2: Set domain name: ip domain-name securenet.com
- 3.Step 3: Generate RSA keys: crypto key generate rsa modulus 2048
- 4.Step 4: Configure SSH version: ip ssh version 2
- 5.Step 5: Configure VTY lines for SSH: line vty 0 4, transport input ssh, login local
! hostname R1 ip domain-name securenet.com crypto key generate rsa modulus 2048 ip ssh version 2 line vty 0 4 transport input ssh login local end
Verify: Use `show crypto key mypubkey rsa` to verify the key was generated with the domain. Use `show ip ssh` to confirm SSH is enabled. Expected output includes 'SSH Enabled - version 2.0'.
Watch out: If the domain name is not set before generating RSA keys, the key label will not include the domain, and SSH may not function correctly. Always set domain-name first.
Troubleshooting with This Command
When troubleshooting DNS resolution issues, the `ip domain-name` command is often a suspect. Start by verifying the domain name is set with `show hosts`. If the output shows 'Default domain is not set', the router will not append any domain to unqualified names.
This can cause 'Translating "hostname"...% Unrecognized host or address' errors. Another common issue is a typo in the domain name; check for extra spaces or incorrect characters. Use `debug ip domain` to see DNS queries in real time; the debug output will show the FQDN being queried.
If the domain name is correct but resolution fails, check the name servers with `show hosts` and ensure they are reachable. Also verify that `ip domain-lookup` is enabled (default). In scenarios where the router is also a DNS server (using `ip dns server`), the domain name is used to answer queries for local hosts.
If the domain name is changed after DNS entries are configured, the old entries may still be cached. Clear the DNS cache with `clear host *`. For SSH-related issues, if RSA key generation fails with 'No domain name configured', set the domain name and regenerate the keys.
Note that the domain name is also used in certificate generation; if certificates are used for VPN or HTTPS, ensure the domain name matches the certificate's subject. Finally, remember that the domain name is case-insensitive but stored as entered; consistency is key.
CCNA Exam Tips
CCNA exam tip: The 'ip domain-name' command is required before generating RSA keys with 'crypto key generate rsa'.
CCNA exam tip: Without a domain name, the router will not append a suffix to hostnames, so 'ping server1' will fail unless 'server1' is in the hosts table.
CCNA exam tip: The domain name is stored in the running configuration and can be verified with 'show running-config | include domain'.
CCNA exam tip: The command is global configuration mode; ensure you are in the correct mode before entering it.
Common Mistakes
Mistake 1: Forgetting to configure 'ip domain-name' before generating SSH keys, leading to an error 'No domain name configured'.
Mistake 2: Using 'ip domain-name' with a trailing dot (e.g., 'example.com.') which is incorrect and may cause DNS issues.
Mistake 3: Confusing 'ip domain-name' with 'ip domain-list' which adds multiple domain suffixes for DNS resolution.
ip domain-name [domain] vs crypto key generate rsa
Both commands are essential for SSH configuration on Cisco IOS, but they serve distinct purposes: ip domain-name sets the default domain for DNS resolution and influences the key label, while crypto key generate rsa creates the RSA key pair required for SSH encryption. They are often confused because both are prerequisites for SSH, and the domain name is used during key generation.
| Aspect | ip domain-name [domain] | crypto key generate rsa |
|---|---|---|
| Purpose | Configures default domain for DNS resolution and key labeling | Generates RSA key pair for SSH and encryption |
| Configuration Mode | Global configuration | Global configuration |
| Persistence | Saved in running-config and startup-config | Stored in NVRAM, persists across reloads |
| Impact on SSH | Provides domain part for key label, but not required for SSH operation | Required to enable SSH server after key generation |
| Prerequisite | None | Hostname should be set; domain-name recommended for unique key label |
Use ip domain-name [domain] when you need to set a default domain name for DNS resolution or to ensure unique RSA key labels during key generation.
Use crypto key generate rsa when you need to create RSA keys to enable SSH server or for other cryptographic functions on the router.
Platform Notes
In IOS-XE, the `ip domain-name` command behaves identically to classic IOS. However, in NX-OS (Cisco Nexus switches), the equivalent command is `ip domain-name` as well, but it is configured under the 'configure terminal' mode. NX-OS also supports `ip domain-lookup` and `ip name-server` similarly.
On Cisco ASA firewalls, the command is `domain-name` (without the 'ip' prefix) in global configuration mode. For example: `domain-name example.com`. ASA also uses `dns domain-lookup` and `dns name-server` commands.
In IOS-XR, the command is `domain name` (two words) under the 'configure' mode. For example: `domain name example.com`. Additionally, IOS-XR uses `domain name-server` to specify DNS servers.
There are no significant differences in output format across platforms for this command. In older IOS versions (12.x), the command is the same. In newer versions (15.x, 16.x), the behavior is unchanged.
The command is available in all IOS versions and is a fundamental part of network configuration.
Related Commands
crypto key generate rsa
Generates RSA key pairs used to enable SSH on Cisco IOS devices. The modulus size determines key strength — minimum 768 bits for SSH version 1, 1024 bits recommended for SSH version 2.
show running-config
Displays the current active configuration in DRAM, showing all non-default settings.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions