Bind

Prerequisites

 * A fixed IP address

Vocabulary

 * Glue Record
 * It is possible for a zone to be the authority for its own name server. For example, the name servers for the zone google.com are ns1.google.com, ns2.google.com... This causes a chicken egg problem where to get the IP of ns1.google.com, you need to ask ns1.google.com. To solve this, it is possible to use glue records. These are additional records in the parent zone that contain the IP of the child zone name servers.


 * Primary Name Server
 * The primary name server is the source of the data. This is the one that you use to change the data.


 * Record
 * A record is an entry in a zone. Records have both a type that categories the kind of data that it contain. Some common types are
 * A: used for IPv4 addresses
 * AAAA: used for IPv6 addresses
 * SOA(Start of Authority): contain technical info about a zone
 * TXT: General purpose record that can contain freetext
 * NS: Indicate authoritative name servers for a zone
 * MX: Contain the mail server of a domain
 * CNAME: this record is an alias to another record.


 * Secondary Name Server
 * Secondary name server are used for redundancy and load balancing. They hold a complete copy of the data from the primary server and can answer to the same queries.


 * Zone
 * A DNS zone is a portion of the DNS space. For example, if you look at example.org hierarchy, you see 3 zones. One for .(the root), one for .org and one for .example.org. Each zone contains the records for the part of the DNS space it control. For example, the last zone will contain the record for www.example.org.

Limit Information Disclosure
Version might be useful to an attacker that is searching known vulnerabilities on your server. Let’s make its life more difficult by hiding it.

Note that it is not an excuse to run old vulnerable software. The goal is just to slow down attacker in case of newly published security exploit, so you have enough time to update before getting pwned.

To prevent the information being returned edit the file  and add the version and hostname lines

Response Rate Limiting (RRL)
DNS servers can be abused to perform DoS attacks on other innocent victims. This are several issues for that For more details, read the quick introduction to response rate limiting from ISC (Bind author).
 * attacker will waste your bandwidth while attacking other servers
 * you are seen by the victim as the source of the attack. You can then appear in blacklists which will be an issue for you
 * you are making DoS attacks easier for the attackers and contribute to the problem

Rate limiting allows to render such attacks ineffective while still answering legitimate responses. To enable this, add the block  in file

Listen on public IP
By default, Bind will only reply to queries from localhost. To use it as an authoritative server, you must make it listen on a public IP. Once again the file to modify is  The 3 options to modify are (these should already be there in the file):
 * : List of IPv4 addresses to listen on.  means all. Otherwise you can list IPs:
 * : Same as above for IPv6 addresses
 * : IPs to witch the server will reply to recursive queries (when it need to contact other severs to get the response). This must never contain any public IP.

Firewall
Bind will listen on port 53, on both TCP and UDP.

Reload Configuration
Bind9 can be told to reload its configuration using Warning: This command is working asynchronously. It is recommended to verify that everything was fine using This will show you the last lines of the log. If anything went wrong, it should appear in red.

Test for open recursion
Open recursive DNS servers are really BAD. You can test your server at http://openresolver.com.

Adding a Zone
Let's add a zone for  to our server.

Secondary Name Server
To ensure the resilience the service hosted on your domain, you must use one or several secondary name servers. The criteria to choose a secondary name server are
 * Geographic location: This is important for the speed of your DNS queries. Servers far away mean slow DNS responses and will slow down your full product
 * IPV6: This is becoming more and more important. Make sure your DNS server support it
 * DNSSEC: If you care about security and plan to enable DNSSEC, you need to make sure that your secondary server support it as well
 * Support Notify: This is a feature where the master DNS server notify the secondary in case of change. This allows to speed up change propagation

If you are hosting your primary name server on a server that you are renting, there is good chance that your provider provides you with a free secondary name server. Otherwise, search for secondary name server online. They are several free or paid options available.

Zone File
First create a file
 * $ORIGIN
 * Default suffix for the entries bellow. Eg.  will be read as  . Note that the dot at the end is important. Entries that end with a dot don't get the origin added to them.


 * $TTL
 * Default Time To Live for entries. This is the amount of time a cache will keep a response.


 * SOA Record (Start of Authority)
 * This record define the global parameters of the zone. It contains the following information.
 * Name Server
 * Any authoritative name server for the zone. Typically, you will put your primary name server.
 * Email Address
 * Email address of the person responsible for the zone. Here the value will be expanded to . Then the first dot is replaced by a   giving  . RFC 2142 recommend to use the value   here.
 * Serial Number
 * This represent the version number of your zone file. This is used for synchronization between your primary and secondary servers.
 * Recommended format is  where   = year,   = month,   = day and   = a sequence number in case you update your zone more than once in the day.
 * Refresh
 * How often a secondary will poll the primary server to see if the serial number for the zone has increased. RFC 1912 recommends between 20 minutes and 12 hours. Keep it to 12 hours if your secondary name servers support notify.
 * Retry
 * If a secondary was unable to contact the primary at the last refresh, wait the retry value before trying again.
 * Expire
 * How long a secondary will still treat its copy of the zone data as valid if it can't contact the primary.
 * Negative TTL
 * Time during which response for non existent records are cached.


 * NS Record
 * We declare two name servers here  and.


 * A and AAAA Records
 * Then we declare IP addresses for our name servers.

Activate Zone File
Edit file  and add the following

Reload Bind Config
Reload bind and check for any error in logs using

Register Name Servers in Parent Zone
The parent zone in the DNS system in the zone directly above yours in the DNS tree.

For example, if you are configuring, the parent zone will be. If you are configuring, the parent zone will be.

Configure With a Registrar
If your zone is for a domain and you don't control the parent zone, you need to configure this in your domain name registrar (the person you bought your domain name from).

Go to the interface of your domain name registrar and register your name servers ( and  ).

If your name server address is a subdomain of your zone (here  and  ) you also need to register a glue record with your registrar.

Configure With Your Own Parent Zone
Assuming your zone is  and the name servers for it are   and , you need to add these records to the   zone In case your name servers are part of the sub zone (eg.  ), you also need glue records

Register your Zone with Secondary Server
Now go to the configuration for your secondary server and register your domain name.

Validate your Zone
To validate your zone, you can use the following tools

Zonemaster

DNSViz

Freeze the Zone
If your zone is dynamic, you first need to freeze the zone If you are unsure, run the command anyway, it will show an error in case the zone is not dynamic

Update the Zone Serial Number
Edit the file of your zone (eg. )

The serial is the number in the  record that looks like. The format is  where   = year,   = month,   = day and   = a sequence number in case you update your zone more than once in the day.

This number must increase at every zone update to make sure secondary name servers get the update properly. Otherwise you will create a desynchronization between your primary and secondary servers. This mean that some user will get the new data while some will get the old.

If the date of your serial number has changed since last update, just change it to today's date and reset the sequence to.

If you are doing same day update, add 10 to the sequence number. For DNSSEC enabled zones, bind will automatically increase the serial number when performing signing operations. While the +10 above will work for most cases, it might not when you just created or updated your zone key. In this case, check the current serial by running

Reload the Zone
For a non dynamic zone, use And for a dynamic one, use In both case check the log for errors using

Activate Signing for your Zone
Modify your zone in  and and the following three lines

Validate Zone
At this point your zone should be signing. Wait a few minutes for your primary server to sign all records and for your secondary to get all updates.

You can then validate your zone using the tools mentioned above.

Since you didn't registered our key to the parent zone yet, you will get warnings about non-secure delegation or missing DS records. But everything else should be ok.

Publish Key
Generate a DS Record using The output is a DS record that must be registered in your parent zone.

DDNS
Dynamic DNS allows you to change the entries in your name server in real time. It is often used to maintain records for hosts with dynamic IP.

Since dynamic zones are harder to maintain in Bind, you will create a separated subzone separated from our main zone. For this example the zone will be  and the dynamic.

Create a Subzone
Create the zone  following the instructions above.

If you want DNSSEC for the subzone, follow also instructions to enable DNSSEC.

Make the Zone Dynamic
Now modify the file  and add the   part And activate config using