Install Bind as an authoritative DNS server

Prerequisites

A fixed IP address

Vocabulary

Glue Record

It is possible for a zone to be the authority for its own name server. For example, the name servers for the zone google.com are ns1.google.com, ns2.google.com... This causes a chicken egg problem where to get the IP of ns1.google.com, you need to ask ns1.google.com. To solve this, it is possible to use glue records. These are additional records in the parent zone that contain the IP of the child zone name servers.

Primary Name Server

The primary name server is the source of the data. This is the one that you use to change the data.

Record

A record is an entry in a zone. Records have both a type that categories the kind of data that it contain. Some common types are

A: used for IPv4 addresses
AAAA: used for IPv6 addresses
SOA(Start of Authority): contain technical info about a zone
TXT: General purpose record that can contain freetext
NS: Indicate authoritative name servers for a zone
MX: Contain the mail server of a domain
CNAME: this record is an alias to another record.

Secondary Name Server: Secondary name server are used for redundancy and load balancing. They hold a complete copy of the data from the primary server and can answer to the same queries.
Zone: A DNS zone is a portion of the DNS space. For example, if you look at example.org hierarchy, you see 3 zones. One for .(the root), one for .org and one for .example.org. Each zone contains the records for the part of the DNS space it control. For example, the last zone will contain the record for www.example.org.

Install

# apt install bind9

Configure

Limit Information Disclosure

Version might be useful to an attacker that is searching known vulnerabilities on your server. Let’s make its life more difficult by hiding it.

Note that it is not an excuse to run old vulnerable software. The goal is just to slow down attacker in case of newly published security exploit, so you have enough time to update before getting pwned.

To prevent the information being returned edit the file /etc/bind/named.conf.options and add the version and hostname lines

options {
    
    version none;
    hostname none;
    
}

Response Rate Limiting (RRL)

DNS servers can be abused to perform DoS attacks on other innocent victims. This are several issues for that

attacker will waste your bandwidth while attacking other servers
you are seen by the victim as the source of the attack. You can then appear in blacklists which will be an issue for you
you are making DoS attacks easier for the attackers and contribute to the problem

For more details, read the quick introduction to response rate limiting from ISC (Bind author).

Rate limiting allows to render such attacks ineffective while still answering legitimate responses. To enable this, add the block rate-limit in file /etc/bind/named.conf.options

options {

        rate-limit {
                responses-per-second 10;
                exempt-clients { 127.0.0.1; ::1; };
        };

}

Listen on public IP

By default, Bind will only reply to queries from localhost. To use it as an authoritative server, you must make it listen on a public IP. Once again the file to modify is /etc/bind/named.conf.options

options {

        listen-on { any; };
        listen-on-v6 { any; };
        allow-recursion { 127.0.0.1; ::1; };

}

The 3 options to modify are (these should already be there in the file):

listen-on: List of IPv4 addresses to listen on. any; means all. Otherwise you can list IPs: listen-on { 203.0.113.23; 127.0.0.1; }
listen-on-v6: Same as above for IPv6 addresses
allow-recursion: IPs to witch the server will reply to recursive queries (when it need to contact other severs to get the response). This must never contain any public IP.

Firewall

Bind will listen on port 53, on both TCP and UDP.Assuming that you configured nftables as described, you can edit file /etc/nftables/main_config.conf and add

# Bind
add element  inet main  tcp_port_in { 53 }
add element  inet main  udp_port_in { 53 }

and activate it using

$ sudo /etc/nftables/reload_main.conf

Reload Configuration

Bind9 can be told to reload its configuration using

$ sudo rndc reload

Warning: This command is working asynchronously. It is recommended to verify that everything was fine using

$ sudo systemctl status bind9.service 
● bind9.service - BIND Domain Name Server
   Loaded: loaded (/lib/systemd/system/bind9.service; enabled)
  Drop-In: /run/systemd/generator/bind9.service.d
           └─50-insserv.conf-$named.conf
   Active: active (running) since Mon 2016-08-08 19:30:41 UTC; 1 weeks 5 days ago
     Docs: man:named(8)
  Process: 6086 ExecStop=/usr/sbin/rndc stop (code=exited, status=0/SUCCESS)
 Main PID: 6091 (named)
   CGroup: /system.slice/bind9.service
           └─6091 /usr/sbin/named -f -u bind

Aug 21 09:10:12 server.example.org named[6091]: zone example.org/IN (signed): reconfiguring zone keys
Aug 21 09:10:12 server.example.org named[6091]: zone example.org/IN (signed): next key event: 21-Aug-2016 10:10:12.300
Aug 21 09:10:12 server.example.org named[6091]: reloading zones succeeded
Aug 21 09:10:12 server.example.org named[6091]: all zones loaded
Aug 21 09:10:12 server.example.org named[6091]: zone example.org/IN (unsigned): loaded serial 2016082100
Aug 21 09:10:12 server.example.org named[6091]: running
Aug 21 09:10:12 server.example.org named[6091]: zone example.org/IN (signed): serial 2016082100 (unsigned 2016082100)
Aug 21 09:10:12 server.example.org named[6091]: zone example.org/IN (signed): sending notifies (serial 2016082100)
Aug 21 09:10:12 server.example.org named[6091]: client 203.0.113.199#38278 (example.org): transfer of 'example.org/IN': IXFR started
Aug 21 09:10:12 server.example.org named[6091]: client 203.0.113.199#38278 (example.org): transfer of 'example.org/IN': IXFR ended

This will show you the last lines of the log. If anything went wrong, it should appear in red.

Test for open recursion

Open recursive DNS servers are really BAD. You can test your server at http://openresolver.com.

Adding a domain

Let's add a domain example.org to our server.

Secondary Name Server

To ensure the resilience the service hosted on your domain, you must use one or several secondary name servers. The criteria to choose a secondary name server are

Geographic location: This is important for the speed of your DNS queries. Servers far away mean slow DNS responses and will slow down your full product
IPV6: This is becoming more and more important. Make sure your DNS server support it
DNSSEC: If you care about security and plan to enable DNSSEC, you need to make sure that your secondary server support it as well
Support Notify: This is a feature where the master DNS server notify the secondary in case of change. This allows to speed up change propagation

If you are hosting your primary name server on a server that you are renting, there is good chance that your provider provides you with a free secondary name server. Otherwise, search for secondary name server online. They are several free or paid options available.

Zone File

First create a file /etc/bind/master/example.org

$ORIGIN example.org.
$TTL 1d ; Time a cache will keep responses

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;                     Zone                                 ;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

@                      SOA    ns1 hostmaster (
                                2016123100 ; serial
                                12h   ; Frequency of zone transfer from slave
                                15m   ; delay before slave retries after a zone transfer failure
                                4w    ; Time a slave will keep the data in case it cannot contact the master
                                1h    ; Time a cache will keep negative responses (NXDOMAIN)
                              )
@                      NS     ns1
@                      NS     ns2

ns1                    A      198.51.100.42
                       AAAA   2001:db8:57:12::1
ns2                    A      203.0.113.42
                       AAAA   2001:db8:af9b:d72e::1

$ORIGIN

Default suffix for the entries bellow. Eg. ns1 will be read as ns1.example.org. Note that the dot at the end is important. Entries that end with a dot don't get the origin added to them.

$TTL

Default Time To Live for entries. This is the amount of time a cache will keep a response.

SOA Record (Start of Authority)

This record define the global parameters of the zone. It contains the following information.

Name Server: Any authoritative name server for the zone. Typically, you will put your primary name server.
Email Address: Email address of the person responsible for the zone. Here the value will be expanded to hostmaster.example.com. Then the first dot is replaced by a @ giving hostmaster@example.com. RFC 2142 recommend to use the value hostmaster here.
Serial Number: This represent the version number of your zone file. This is used for synchronization between your primary and secondary servers.; Recommended format is yyyymmddnn where yyyy = year, mm = month, dd = day and nn = a sequence number in case you update your zone more than once in the day.
Refresh: How often a secondary will poll the primary server to see if the serial number for the zone has increased. RFC 1912 recommends between 20 minutes and 12 hours. Keep it to 12 hours if your secondary name servers support notify.
Retry: If a secondary was unable to contact the primary at the last refresh, wait the retry value before trying again.
Expire: How long a secondary will still treat its copy of the zone data as valid if it can't contact the primary.
Negative TTL: Time during which response for non existent records are cached.

NS Record: We declare two name servers here ns1.example.org and ns2.example.org.
A and AAAA Records: Then we declare IP addresses for our name servers.

Activate Zone File

Edit file /etc/bind/master/named.conf.local and add the following

zone "example.org" {
    type master;
    file "/etc/bind/master/example.org";
    
    # List of servers that can copy the zone data
    # Check the documentation of your secondary servers to know the IP list that they use
    allow-transfer {
        203.0.113.42;
    };

    # Notify secondary servers when zone is changed
    notify yes;
};

Reload Bind

Reload bind and check for any error in logs using

$ sudo systemctl reload bind9.service
$ sudo journalctl -n 100 -u bind9.service

Register Name Servers in Parent Zone

Go to the interface of your domain name registrar and register your name servers (ns1.example.org and ns2.example.org).

If your name server address is a subdomain of your zone (here ns1.example.org and example.org) you also need to register a glue record with your registrar.

Register your Zone with Secondary Server

Now go to the configuration for your secondary server and register your domain name.

Validate your Zone

To validate your zone, you can use the following tools

Zonemaster

DNSViz

Sign a Zone with DNSSEC

Activate Signing for your Zone

Modify your zone in /etc/bind/named.options.local and and the following three lines

zone "example.org" {
    ...

    key-directory "/etc/bind/keys";
    auto-dnssec maintain;
    inline-signing yes;

    ...
};

Generate key

$ sudo dnssec-keygen -K /etc/bind/keys/ -a ECDSAP256SHA256 -3 -f KSK example.org
Generating key pair.
Kexample.org.+013+74295
$ sudo chmod 640 /etc/bind/keys/*

Reload zone

$ sudo rndc reload

Generate NSEC3 Parameters

$ sudo rndc signing -nsec3param 1 0 10 $(head -c 512 /dev/urandom | sha1sum | cut -b 1-16) example.org
request queued

Validate Zone

At this point your zone should be signing. Wait a few minutes for your primary server to sign all records and for your secondary to get all updates.

You can then validate your zone using the tools mentioned above.

Since you didn't registered our key to the parent zone yet, you will get warnings about non-secure delegation or missing DS records. But everything else should be ok.

Publish Key

Genrate a DS Record using

$ sudo dnssec-dsfromkey -2 /etc/bind/keys/Kexample.org.+013+74295.key
example.org. IN DS 74295 13 2 B4ECD847264AD849F1038EB837483DE74F710EAB47F62EF2B224DA6E55294E4F

Now log into the interface of your domain name registrar and register the generated DS key.

DDNS

Dynamic DNS allows you to change the entries in your name server in real time. It is often used to maintain records for hosts with dynamic IP.

Create Subzone

Warning:

This page is a work in progress and is not completed. Important informations might be missing or wrong.

Configure Zone

zone "dyn.example.org" {
    type master;
    file "/etc/bind/master/dyn.example.org";
    
    update-policy {
        grant local-ddns name home.dyn.example.org A;
    };
};

Anonymous

Search

Install Bind as an authoritative DNS server

Namespaces

More

Page actions

Contents

Prerequisites

Vocabulary

Install

Configure

Limit Information Disclosure

Response Rate Limiting (RRL)

Listen on public IP

Firewall

Reload Configuration

Test for open recursion

Adding a domain

Secondary Name Server

Zone File

Activate Zone File

Reload Bind

Register Name Servers in Parent Zone

Register your Zone with Secondary Server

Validate your Zone

Sign a Zone with DNSSEC

Activate Signing for your Zone

Generate key

Reload zone

Generate NSEC3 Parameters

Validate Zone

Publish Key

DDNS

Create Subzone

Configure Zone

Navigation

Navigation

Wiki tools

Wiki tools

Anonymous

Search

Install Bind as an authoritative DNS server

Prerequisites

Vocabulary

Install

Configure

Limit Information Disclosure

Response Rate Limiting (RRL)

Listen on public IP

Firewall

Reload Configuration

Test for open recursion

Adding a domain

Secondary Name Server

Zone File

Activate Zone File

Reload Bind

Register Name Servers in Parent Zone

Register your Zone with Secondary Server

Validate your Zone

Sign a Zone with DNSSEC

Activate Signing for your Zone

Generate key

Reload zone

Generate NSEC3 Parameters

Validate Zone

Publish Key

DDNS

Create Subzone

Configure Zone

Navigation

Wiki tools

Page tools

Categories