BIND9 Deployment | Advanced Linux Administration

# Update package index first sudo apt update # Install BIND9 and utilities sudo apt install -y bind9 bind9utils bind9-doc # bind9 -- the named daemon and startup scripts # bind9utils -- rndc, named-checkconf, named-checkzone, nsupdate # bind9-doc -- manpages and documentation # Disable systemd-resolved stub listener (conflicts with BIND on port 53) sudo sed -i 's/#DNSStubListener=yes/DNSStubListener=no/' /etc/systemd/resolved.conf sudo systemctl restart systemd-resolved # Verify named is running sudo systemctl status named sudo ss -tulnp | grep ':53' # named should own port 53 # Verify named starts on boot sudo systemctl enable named

# Primary configuration directory /etc/bind/ named.conf # main config -- usually just includes others named.conf.options # global options: forwarders, recursion, ACLs named.conf.local # your zones go here named.conf.default-zones # root hints, localhost zones (do not edit) db.local # zone file for localhost (reference example) db.127 # reverse zone file for 127.0.0.1 db.root # root hints -- list of root server addresses rndc.key # authentication key for rndc commands # Runtime directory (writable by named user) /var/cache/bind/ # journal files, secondary zone data /var/run/named/ # PID file and control socket # Logging /var/log/syslog # BIND9 logs here by default (named category) # Process user grep bind /etc/passwd # bind:x:117:122::/var/cache/bind:/usr/sbin/nologin

// /etc/bind/named.conf.options // Define trusted networks that may recurse acl "trusted" { 127.0.0.1; 10.0.0.0/8; 192.168.0.0/16; }; options { directory "/var/cache/bind"; // working directory for named recursion yes; allow-recursion { trusted; }; // only trusted clients may recurse allow-query { trusted; }; // only trusted clients may query allow-transfer { none; }; // deny all zone transfers by default // Forwarders: upstream resolvers for names we don't own forwarders { 8.8.8.8; 1.1.1.1; }; forward only; // don't recurse independently -- use forwarders dnssec-validation auto; // validate DNSSEC responses listen-on { any; }; // listen on all interfaces listen-on-v6 { any; }; };

// /etc/bind/named.conf.local // Forward zone -- name to IP zone "matrix.internal" { type master; // this server is authoritative file "/etc/bind/db.matrix.internal"; // zone file path allow-transfer { 10.0.1.11; }; // allow ns2 to transfer notify yes; // notify ns2 on zone change also-notify { 10.0.1.11; }; }; // Reverse zone for 10.0.1.0/24 zone "1.0.10.in-addr.arpa" { type master; file "/etc/bind/db.10.0.1"; allow-transfer { 10.0.1.11; }; notify yes; }; // Secondary zone -- pulls from primary via AXFR zone "partner.example" { type slave; masters { 10.0.2.10; }; // primary server IP file "/var/cache/bind/db.partner.example"; // stored in cache dir };

; /etc/bind/db.matrix.internal ; Semicolons begin comments in zone files $TTL 3600 ; default TTL for all records without explicit TTL $ORIGIN matrix.internal. ; appended to unqualified names (optional -- set by zone name) ; SOA record -- required, must be first @ IN SOA ns1.matrix.internal. admin.matrix.internal. ( 2026040901 ; serial 3600 ; refresh (secondary polls primary every 1 hour) 900 ; retry (on refresh failure, retry after 15 min) 604800 ; expire (secondary stops answering after 7 days without refresh) 300 ; minimum TTL (negative cache TTL) ) ; NS records -- required, define authoritative name servers @ IN NS ns1.matrix.internal. @ IN NS ns2.matrix.internal. ; A records ns1 IN A 10.0.1.10 ns2 IN A 10.0.1.11 ops IN A 10.0.1.50 db1 IN A 10.0.1.60 ; MX record @ IN MX 10 mail.matrix.internal. mail IN A 10.0.1.70

; /etc/bind/db.10.0.1 ; Reverse zone for 10.0.1.0/24 ; Zone name: 1.0.10.in-addr.arpa. $TTL 3600 @ IN SOA ns1.matrix.internal. admin.matrix.internal. ( 2026040901 3600 900 604800 300 ) @ IN NS ns1.matrix.internal. @ IN NS ns2.matrix.internal. ; PTR records: only the last octet (zone provides the rest) 10 IN PTR ns1.matrix.internal. 11 IN PTR ns2.matrix.internal. 50 IN PTR ops.matrix.internal. 60 IN PTR db1.matrix.internal. 70 IN PTR mail.matrix.internal. ; Test reverse lookup ; dig -x 10.0.1.50 @127.0.0.1 --> ops.matrix.internal.

# Validate the main configuration file sudo named-checkconf # No output = no errors. Any error is fatal -- do not proceed. # Validate a specific zone file sudo named-checkzone matrix.internal /etc/bind/db.matrix.internal # Expected good output: # zone matrix.internal/IN: loaded serial 2026040901 # OK # Validate reverse zone sudo named-checkzone 1.0.10.in-addr.arpa /etc/bind/db.10.0.1 # Common errors and what they mean # no SOA RR found -- SOA record is missing or has a syntax error # missing '.' -- FQDN missing trailing dot # out of zone data -- a name resolves outside the zone (missing trailing dot) # CNAME and other data -- a CNAME record coexists with another record type # Validate ALL zones defined in named.conf at once sudo named-checkconf -z

# Reload all configuration and all zones sudo rndc reload # server reload successful # Reload a specific zone only (faster for large deployments) sudo rndc reload matrix.internal # Reload just the configuration file (without zone files) sudo rndc reconfig # Alternative: systemctl reload (sends SIGHUP -- same effect as rndc reload) sudo systemctl reload named # Full restart (only needed after changing listening addresses or port) sudo systemctl restart named # Verify the zone loaded successfully after reload sudo rndc status # shows loaded zones count and version dig SOA matrix.internal @127.0.0.1 # Check serial number in the SOA matches the file

# Status and diagnostics rndc status # server uptime, version, loaded zones, memory rndc zonestatus matrix.internal # detailed status for one zone # Zone management rndc reload # reload all zones and config rndc reload ZONE # reload specific zone rndc reconfig # re-read named.conf without zone reload rndc refresh ZONE # force secondary to re-check primary (on secondary) rndc retransfer ZONE # force full AXFR from primary (on secondary) rndc freeze ZONE # suspend dynamic updates (safe for manual editing) rndc thaw ZONE # resume dynamic updates after freeze # Cache management rndc flush # clear the entire resolver cache rndc flushname NAME # remove specific name from cache rndc dumpdb # dump cache to /var/cache/bind/named_dump.db # Logging rndc querylog on # enable per-query logging (verbose -- use briefly) rndc querylog off # disable query logging rndc trace # increase debug logging level rndc notrace # return to normal logging level

# Always query your server directly -- use @127.0.0.1 not @127.0.0.53 # 127.0.0.53 = systemd-resolved stub (may cache old data) # 127.0.0.1 = BIND9 directly (no caching between you and the zone) # Test forward lookup dig A ops.matrix.internal @127.0.0.1 # Expect: NOERROR, aa flag (authoritative answer), correct IP # Test reverse lookup dig -x 10.0.1.50 @127.0.0.1 # Expect: ops.matrix.internal. # Test SOA -- verify serial matches your zone file dig SOA matrix.internal @127.0.0.1 +multiline # Test NXDOMAIN behavior dig A ghost.matrix.internal @127.0.0.1 # Expect: NXDOMAIN, aa flag, authority section shows SOA # Test recursive forwarding (should resolve external names) dig A google.com @127.0.0.1 # Expect: NOERROR, no aa flag (not authoritative for google.com)

// ns1 (primary) -- named.conf.local zone "matrix.internal" { type master; file "/etc/bind/db.matrix.internal"; allow-transfer { 10.0.1.11; }; // only allow ns2 to transfer notify yes; // NOTIFY ns2 when serial changes also-notify { 10.0.1.11; }; // must list explicitly if not in NS records }; // ns2 (secondary) -- named.conf.local zone "matrix.internal" { type slave; masters { 10.0.1.10; }; // ns1 IP file "/var/cache/bind/db.matrix.internal"; }; # Verify zone transfer occurred on ns2 dig SOA matrix.internal @10.0.1.11 # serial should match ns1 ls -la /var/cache/bind/db.matrix.internal # file should exist and be recent # Force a retransfer on ns2 sudo rndc retransfer matrix.internal # run this on ns2 # Watch the transfer in logs sudo journalctl -u named -f | grep 'transfer'

// Add a logging block to named.conf.options logging { channel default_log { file "/var/log/named/named.log" versions 3 size 20m; print-time yes; print-severity yes; print-category yes; severity dynamic; // controlled by rndc trace }; channel query_log { file "/var/log/named/queries.log" versions 5 size 50m; print-time yes; severity info; }; category queries { query_log; }; category default { default_log; }; category security { default_log; }; category config { default_log; }; category xfer-in { default_log; }; category xfer-out { default_log; }; }; # Create log directory (named must own it) sudo mkdir -p /var/log/named sudo chown bind:bind /var/log/named sudo rndc reconfig

// Named ACLs -- define at top of named.conf.options before options block acl "internal-nets" { 127.0.0.0/8; 10.0.0.0/8; 172.16.0.0/12; 192.168.0.0/16; }; acl "ns2-only" { 10.0.1.11; // only ns2 may transfer zones }; options { allow-query { internal-nets; }; allow-recursion { internal-nets; }; allow-transfer { ns2-only; }; // Blackhole: silently discard queries from these IPs (rate limiters, scanners) blackhole { 203.0.113.99; }; }; // Per-zone transfer override (overrides global allow-transfer) zone "matrix.internal" { type master; file "/etc/bind/db.matrix.internal"; allow-transfer { ns2-only; }; // explicit -- belt and suspenders };

# nsupdate sends dynamic update packets to a zone's primary server # The zone must have allow-update configured in named.conf // In named.conf.local -- allow updates from localhost (for testing) zone "matrix.internal" { type master; file "/etc/bind/db.matrix.internal"; allow-update { 127.0.0.1; }; // ONLY for testing -- use TSIG in prod }; # Interactive nsupdate session nsupdate > server 127.0.0.1 > zone matrix.internal > update add temp.matrix.internal 300 A 10.0.1.99 > send > quit # Verify the update dig A temp.matrix.internal @127.0.0.1 # Delete a record via nsupdate nsupdate <<EOF server 127.0.0.1 zone matrix.internal update delete temp.matrix.internal A send EOF

# Generate a TSIG key sudo tsig-keygen -a hmac-sha256 matrix-transfer-key | sudo tee /etc/bind/tsig-keys.conf # Output added to tsig-keys.conf: # key "matrix-transfer-key" { # algorithm hmac-sha256; # secret "BASE64SECRET=="; # }; # Include the key file in named.conf // named.conf include "/etc/bind/tsig-keys.conf"; // Use TSIG for zone transfer authentication zone "matrix.internal" { type master; file "/etc/bind/db.matrix.internal"; allow-transfer { key "matrix-transfer-key"; }; }; # On ns2 (secondary), reference the same key in masters block zone "matrix.internal" { type slave; masters { 10.0.1.10 key "matrix-transfer-key"; }; file "/var/cache/bind/db.matrix.internal"; };

// Forward-only: delegate all external resolution to upstream options { forwarders { 8.8.8.8; 1.1.1.1; }; forward only; // do not fall back to recursion if forwarder fails }; // Full recursive: walk the tree yourself options { forwarders { }; // empty -- no forwarders recursion yes; dnssec-validation auto; }; // Hybrid: forward most queries but recurse for specific zones zone "partner.internal" { type forward; forwarders { 10.0.2.10; }; // forward only this zone to partner DNS };

// Add rate-limit block inside options { } options { rate-limit { responses-per-second 10; // max responses per client IP per second window 5; // sliding window in seconds slip 2; // 1-in-N responses get TC flag (triggers TCP retry) log-only no; // actually enforce (yes = observe only) exempt-clients { 10.0.0.0/8; }; // trusted networks are exempt }; }; # Monitor RRL in action sudo journalctl -u named | grep 'rate-limit' # Throttled responses are logged with client IP and query type # Test RRL (flood queries and see drops) for i in $(seq 1 20); do dig +short A ops.matrix.internal @127.0.0.1; done

# Is named running and what port is it on? sudo systemctl status named sudo ss -tulnp | grep named # What does named think of its current state? sudo rndc status # Check logs for errors (last 50 lines) sudo journalctl -u named -n 50 # Does the zone load correctly? sudo named-checkconf -z 2>&1 | grep -i error # Is named listening on the right interface? sudo ss -unap sport = :53 # UDP port 53 sudo ss -tnap sport = :53 # TCP port 53 # Enable debug logging briefly sudo rndc trace 3 # level 3 is very verbose dig A ops.matrix.internal @127.0.0.1 sudo journalctl -u named -n 100 sudo rndc notrace # return to normal -- do not leave trace on # AppArmor blocking file access? sudo journalctl -k | grep 'apparmor.*named'

# DNS queries arrive on UDP/53 and TCP/53 # Zone transfers (AXFR) use TCP/53 # Large responses (>512 bytes) fall back to TCP/53 automatically # Allow DNS queries from internal network sudo ufw allow from 10.0.0.0/8 to any port 53 proto udp sudo ufw allow from 10.0.0.0/8 to any port 53 proto tcp # Allow rndc from localhost only sudo ufw allow from 127.0.0.1 to any port 953 proto tcp # Verify firewall status sudo ufw status numbered # Test from a remote host dig A ops.matrix.internal @10.0.1.10 # from another machine on 10.0.0.0/8 # Test TCP fallback explicitly dig +tcp A ops.matrix.internal @10.0.1.10 # If AXFR is needed from ns2: sudo ufw allow from 10.0.1.11 to any port 53 proto tcp # on ns1

// named.conf -- views replace the global zone declarations // All zones must be inside view blocks when views are used view "internal" { match-clients { 10.0.0.0/8; 127.0.0.0/8; }; recursion yes; zone "matrix.internal" { type master; file "/etc/bind/internal/db.matrix.internal"; }; zone "hexworth.com" { type master; file "/etc/bind/internal/db.hexworth.com"; // internal IPs }; include "/etc/bind/named.conf.default-zones"; }; view "external" { match-clients { any; }; recursion no; zone "hexworth.com" { type master; file "/etc/bind/external/db.hexworth.com"; // public IPs only }; };

// /etc/bind/named.conf (the root file -- rarely edited directly) include "/etc/bind/named.conf.options"; // global options, forwarders, ACLs include "/etc/bind/named.conf.local"; // your zone declarations include "/etc/bind/named.conf.default-zones"; // localhost, root hints // /etc/bind/named.conf.default-zones (do not modify) // Contains: root hints zone, localhost forward/reverse, broadcast zones zone "." { // root hints -- how to find root servers type hint; file "/usr/share/dns/root.hints"; }; // You only need to edit two files: // named.conf.options -- global settings // named.conf.local -- your zones # Verify the include chain is valid sudo named-checkconf /etc/bind/named.conf # This recursively validates all included files

#!/bin/bash # zone-update.sh -- safe zone update workflow ZONE="matrix.internal" ZONE_FILE="/etc/bind/db.matrix.internal" # Step 1: Freeze the zone (prevents journal conflicts with dynamic updates) sudo rndc freeze $ZONE # Step 2: Back up current zone file sudo cp $ZONE_FILE ${ZONE_FILE}.bak.$(date +%Y%m%d%H%M%S) # Step 3: Edit the zone file sudo nano $ZONE_FILE # increment serial, make changes # Step 4: Validate sudo named-checkzone $ZONE $ZONE_FILE if [ $? -ne 0 ]; then echo "Zone file invalid -- restoring backup" sudo cp ${ZONE_FILE}.bak.* $ZONE_FILE sudo rndc thaw $ZONE exit 1 fi # Step 5: Thaw and reload sudo rndc thaw $ZONE sudo rndc reload $ZONE # Step 6: Verify dig SOA $ZONE @127.0.0.1 +short

# On ns2 (10.0.1.11): install BIND9 sudo apt install -y bind9 bind9utils // /etc/bind/named.conf.options on ns2 options { directory "/var/cache/bind"; recursion yes; allow-recursion { 10.0.0.0/8; 127.0.0.0/8; }; allow-transfer { none; }; // ns2 is not a transfer source forwarders { 8.8.8.8; 1.1.1.1; }; forward only; }; // /etc/bind/named.conf.local on ns2 zone "matrix.internal" { type slave; masters { 10.0.1.10; }; file "/var/cache/bind/db.matrix.internal"; }; zone "1.0.10.in-addr.arpa" { type slave; masters { 10.0.1.10; }; file "/var/cache/bind/db.10.0.1"; }; # Start named on ns2 -- zone transfer happens automatically sudo systemctl enable --now named sudo journalctl -u named -f # watch transfer in real time

# rndc stats -- dumps detailed counters to /var/cache/bind/named_stats.txt sudo rndc stats cat /var/cache/bind/named_stats.txt | head -60 # Key metrics to watch: # queries received -- total incoming query count # queries answered -- successful responses # NXDOMAIN responses -- high rate = misconfigured clients or enumeration # SERVFAIL responses -- high rate = upstream or zone problems # REFUSED responses -- potential unauthorized query sources # Watch for SERVFAIL spike (forwarder down) sudo journalctl -u named --since "10 min ago" | grep -i servfail # Watch for zone transfer failures sudo journalctl -u named | grep 'transfer.*failed' # Check zone loaded times sudo rndc zonestatus matrix.internal # Memory usage of named ps aux | grep named sudo rndc status | grep -i memory

# Phase 1: Install sudo apt update && sudo apt install -y bind9 bind9utils sudo sed -i 's/#DNSStubListener=yes/DNSStubListener=no/' /etc/systemd/resolved.conf sudo systemctl restart systemd-resolved # Phase 2: Configure options sudo tee /etc/bind/named.conf.options <<'EOF' acl "trusted" { 127.0.0.0/8; 10.0.0.0/8; }; options { directory "/var/cache/bind"; recursion yes; allow-recursion { trusted; }; allow-query { trusted; }; allow-transfer { none; }; forwarders { 8.8.8.8; 1.1.1.1; }; forward only; dnssec-validation auto; }; EOF # Phase 3: Validate and start sudo named-checkconf sudo systemctl enable --now named sudo ss -tulnp | grep named

# +trace shows every step from root through your authoritative server dig +trace A ops.hexworth.com # Expected output sequence: # 1. Queries a root server: gets NS records for .com # . 518400 IN NS a.root-servers.net. # 2. Queries a .com TLD server: gets NS records for hexworth.com # hexworth.com. 172800 IN NS ns1.hexworth.com. # 3. Queries ns1.hexworth.com: gets the A record # ops.hexworth.com. 300 IN A 10.0.1.50 # If delegation is broken, the trace shows exactly where it stops # Common break points: # - .com TLD still shows old NS records (registrar not updated) # - ns1.hexworth.com returns REFUSED (firewall or allow-query) # - ns1.hexworth.com not reachable (glue record wrong IP) # Compare what registrar thinks vs what your server thinks dig NS hexworth.com @a.gtld-servers.net # authoritative TLD view dig NS hexworth.com @ns1.hexworth.com # your server's view

// named.conf.options -- security settings options { // Prevent version disclosure to anonymous queries version "not disclosed"; hostname "not disclosed"; // Limit recursion to known networks allow-recursion { 10.0.0.0/8; 127.0.0.0/8; }; // Block all zone transfers by default allow-transfer { none; }; // Block queries from known bad actors blackhole { badguys; }; // Response rate limiting to prevent amplification DDoS rate-limit { responses-per-second 10; }; // Validate DNSSEC dnssec-validation auto; // Disable CHAOS class queries (version info leakage) allow-query-cache { 10.0.0.0/8; 127.0.0.0/8; }; }; # Verify version is hidden dig CHAOS TXT version.bind @127.0.0.1 # should return "not disclosed"

# Validate then reload (the standard change workflow) sudo named-checkconf -z && sudo rndc reload ZONE # Verify zone loaded correctly dig SOA ZONE @127.0.0.1 +short # Check server status sudo rndc status # Reload only config (no zone reload) sudo rndc reconfig # Flush cache sudo rndc flush # Check zone transfer status on secondary sudo rndc zonestatus ZONE # Force zone refresh on secondary sudo rndc retransfer ZONE # Enable query logging for debugging sudo rndc querylog on sudo journalctl -u named -f sudo rndc querylog off # always turn off when done # Test TCP fallback dig +tcp A NAME @127.0.0.1 # Attempt zone transfer (test allow-transfer) dig AXFR ZONE @127.0.0.1 # should return REFUSED from localhost if configured