BIND9 / NAMED DNS Server – Complete Administration Guide

At a glance#

• Purpose: Install, configure and administer a BIND9 authoritative DNS server, including zones and troubleshooting.
• Applies to: BIND9 on Ubuntu and RHEL-family distributions.
• Risk: High - DNS errors take services offline across the estate.
• Time: 2-3 hours for a full deployment.

1. Overview#

BIND (Berkeley Internet Name Domain) is the most widely used DNS server software on Linux.

This document covers:

• Installation
• Forward & reverse zone creation
• Configuration files
• ACL & allow-queries
• Forwarders
• Validation & troubleshooting
• Common production issues

2. Key BIND Configuration Files#

3. Installing BIND9#

apt update
apt install bind9 bind9utils bind9-doc -y

Enable and start:

systemctl enable bind9
systemctl start bind9

4. Main Configuration – named.conf.options#

Edit:

nano /etc/bind/named.conf.options

Standard Production Template#

options {
    directory "/var/cache/bind";

    recursion yes;
    allow-recursion { trusted; };

    allow-query { trusted; };

    forwarders {
        8.8.8.8;
        1.1.1.1;
    };

    dnssec-validation auto;

    listen-on { any; };
    listen-on-v6 { any; };
};

5. Access Control Lists (ACL)#

Used to control query and recursion access.

acl "trusted" {
    127.0.0.1;
    10.0.0.0/8;
    192.168.0.0/16;
};

Place this above the options block in named.conf.options.

6. Forward Zone Configuration#

6.1 Create Zone Entry#

Edit:

nano /etc/bind/named.conf.local

Add:

zone "example.com" IN {
    type master;
    file "/etc/bind/db.example.com";
};

6.2 Create Forward Zone File#

cp /etc/bind/db.local /etc/bind/db.example.com
nano /etc/bind/db.example.com

Forward Zone Template#

$TTL    86400
@   IN  SOA ns1.example.com. admin.example.com. (
        2025120801
        3600
        1800
        604800
        86400
)

@       IN  NS      ns1.example.com.
ns1     IN  A       198.51.100.10

www     IN  A       198.51.100.20
mail    IN  A       198.51.100.30

7. Reverse Zone Configuration#

7.1 Add Reverse Zone Entry#

Example for 198.51.100.0/24:

zone "0.221.10.in-addr.arpa" IN {
    type master;
    file "/etc/bind/reverse-KP-DC.sl";
};

7.2 Reverse Zone File Template#

$TTL 86400
@   IN  SOA ns1.example.com. admin.example.com. (
        2025120801
        3600
        1800
        604800
        86400
)

@       IN  NS      ns1.example.com.

10      IN  PTR     ns1.example.com.
20      IN  PTR     www.example.com.
30      IN  PTR     mail.example.com.

8. Multiple Reverse Zones Using One File#

It is valid to map multiple zone entries to a single zone file as long as:

• Each zone has a valid SOA
• There are no duplicate PTR conflicts
• BIND loads all zones without duplication errors

9. File Ownership & Permissions#

chown root:bind /etc/bind/*.sl
chmod 644 /etc/bind/*.sl

10. Configuration Validation (MANDATORY BEFORE RESTART)#

10.1 Validate Global Configuration#

named-checkconf

Expected output:

No output means clean.

10.2 Validate Zone Files#

Forward:

named-checkzone example.com /etc/bind/db.example.com

Reverse:

named-checkzone 0.221.10.in-addr.arpa /etc/bind/reverse-KP-DC.sl

11. Restart & Reload#

Restart (full service restart):

systemctl restart bind9

Reload zones only:

rndc reload

12. Log Monitoring#

Live monitoring:

journalctl -fu named

Full error review:

journalctl -xeu named

13. Common Errors & Solutions#

Duplicate Zone Error#

Error:

zone already exists previous definition

Root Cause:

• Same zone defined twice in named.conf.local

Fix:

• Remove one duplicate block

Service Fails to Start#

Check:

named-checkconf
journalctl -xeu named

Most common causes:

• Missing semicolon ;
• Missing curly brace }
• Invalid zone file path
• Wrong SOA format
• Permission issues

No Reverse Lookup Working#

Check:

• PTR record exists
• Correct subnet zone name
• Reverse zone loaded successfully
• Client is querying correct DNS server

14. DNS Testing Commands#

Forward Lookup#

dig example.com
nslookup example.com

Reverse Lookup#

dig -x 198.51.100.20
nslookup 198.51.100.20

15. Production Best Practices#

• Always increase SOA serial on every change
• Never edit live zones without backup
• Use named-checkconf before restart
• Never run open recursion
• Keep log monitoring active
• Restrict zone transfer using allow-transfer

Example:

allow-transfer { 198.51.100.2; };

16. Backup Strategy#

Daily Backup Command:

tar -czvf /backup/bind_$(date +%F).tar.gz /etc/bind

17. Service Control Commands Summary#