How to Use BIND DNS in Linux
Introduction
BIND (Berkeley Internet Name Domain) is the most widely used DNS software on the Internet. It allows you to translate domain names into IP addresses and vice versa. This guide will walk you through setting up a BIND DNS server on a Linux system, including example configuration files for named.conf, a forward zone file, and a reverse zone file.Installing BIND
First, install BIND on your Linux system.On Debian-based systems:
Code:
sudo apt update
sudo apt install bind9 bind9utils bind9-docOn RPM-based systems:
Code:
sudo dnf install bind bind-utilsConfiguration Files
BIND configuration files are typically located in /etc/bind on Debian-based systems and /etc/named on Red Hat-based systems.named.conf
This is the main configuration file for BIND.
Code:
options {
directory "/var/cache/bind";
forwarders {
8.8.8.8; // Google's DNS
8.8.4.4; // Google's DNS
};
dnssec-validation auto;
auth-nxdomain no; # conform to RFC1035
listen-on-v6 { any; };
};
zone "example.com" {
type master;
file "/etc/bind/db.example.com";
};
zone "1.168.192.in-addr.arpa" {
type master;
file "/etc/bind/db.192.168.1";
};Forward Zone File (db.example.com)
This file contains the DNS records for the example.com domain.
Code:
$TTL 86400
@ IN SOA ns1.example.com. admin.example.com. (
2024123001 ; Serial
3600 ; Refresh
1800 ; Retry
1209600 ; Expire
86400 ) ; Minimum TTL
@ IN NS ns1.example.com.
@ IN NS ns2.example.com.
@ IN MX 10 mail.example.com.
@ IN A 192.168.1.1
www IN A 192.168.1.2
mail IN A 192.168.1.3
ftp IN CNAME wwwReverse Zone File (db.192.168.1)
This file contains the reverse DNS records for the 192.168.1.x subnet.
Code:
$TTL 86400
@ IN SOA ns1.example.com. admin.example.com. (
2024123001 ; Serial
3600 ; Refresh
1800 ; Retry
1209600 ; Expire
86400 ) ; Minimum TTL
@ IN NS ns1.example.com.
@ IN NS ns2.example.com.
1 IN PTR example.com.
2 IN PTR www.example.com.
3 IN PTR mail.example.com.Explanation of DNS Records
- SOA (Start of Authority): This record indicates the primary DNS server for the domain, the email of the domain administrator, and various timers relating to refreshing the zone.
- Serial Number: This is a version number for the zone file. It must be incremented each time the zone file is updated to ensure changes propagate to secondary DNS servers.
- NS (Name Server): This record specifies the authoritative DNS servers for the domain.
- A (Address): This record maps a domain name to an IPv4 address.
- PTR (Pointer): This record maps an IP address to a domain name (used in reverse DNS lookups).
- MX (Mail Exchange): This record specifies the mail servers for the domain.
- CNAME (Canonical Name): This record maps an alias name to a true or canonical domain name.
SOA Record Timers
The SOA record includes several important timers:- Refresh: This is the interval (in seconds) at which secondary DNS servers will query the primary DNS server to check for updates to the zone file. For example, a refresh value of 3600 means the secondary server will check for updates every hour.
- Retry: If a secondary server fails to contact the primary server during a refresh attempt, it will wait for the retry interval before trying again. A typical retry value might be 1800 seconds (30 minutes).
- Expire: This is the time (in seconds) that a secondary server will continue to use the zone data if it cannot contact the primary server. After this period, the data is considered stale and will no longer be used. An example value might be 1209600 seconds (14 days).
- Minimum TTL: This value is used for negative caching, which is the time that a DNS resolver will cache a negative response (e.g., a non-existent domain). It can also serve as the default TTL for all records in the zone if not specified individually. A common value is 86400 seconds (1 day).
Internal vs. Public DNS Servers
- Internal Private DNS Server: Used within a private network to resolve internal hostnames and IP addresses. It is not accessible from the public Internet.
- Public Registered DNS Server: Used to resolve domain names on the public Internet. It must be registered with a domain registrar and is accessible globally.
