Domain Name Service (DNS) is an Internet service that maps IP addresses and fully qualified domain names (FQDN) to one another. In this way, DNS alleviates the need to remember IP addresses. Computers that run DNS are called name servers. Ubuntu ships with BIND (Berkley Internet Naming Daemon), the most common program used for maintaining a name server on Linux. InstallationAt a terminal prompt, enter the following command to install dns:
sudo apt install bind9
A very useful package for testing and troubleshooting DNS issues is the
zone "example.com" {
type master;
file "/etc/bind/db.example.com";
};
2 package. Very often these tools will be installed already, but to check and/or install
zone "example.com" {
type master;
file "/etc/bind/db.example.com";
};
2 enter the following:
sudo apt install dnsutils
ConfigurationThere are many ways to configure BIND9. Some of the most common configurations are a caching nameserver, primary server, and secondary server. - When configured as a caching nameserver BIND9 will find the answer to name queries and remember the answer when the domain is queried again.
- As a primary server, BIND9 reads the data for a zone from a file on its host and is authoritative for that zone.
- As a secondary server, BIND9 gets the zone data from another nameserver that is authoritative for the zone.
OverviewThe DNS configuration files are stored in the
zone "example.com" {
type master;
file "/etc/bind/db.example.com";
};
4 directory. The primary configuration file is
zone "example.com" {
type master;
file "/etc/bind/db.example.com";
};
5, which in the layout provided by the package just includes these files. zone "example.com" { type master;
file "/etc/bind/db.example.com";
};
6: global DNS options zone "example.com" { type master;
file "/etc/bind/db.example.com";
};
7: for your zones zone "example.com" { type master;
file "/etc/bind/db.example.com";
};
8: default zones such as localhost, its reverse, and the root hints
The root nameservers used to be described in the file
zone "example.com" {
type master;
file "/etc/bind/db.example.com";
};
9. This is now provided instead by the
sudo cp /etc/bind/db.local /etc/bind/db.example.com
0 file shipped with the
sudo cp /etc/bind/db.local /etc/bind/db.example.com
1 package, and is referenced in the
sudo cp /etc/bind/db.local /etc/bind/db.example.com
2 configuration file above. It is possible to configure the same server to be a caching name server, primary, and secondary: it all depends on the zones it is serving. A server can be the Start of Authority (SOA) for one zone, while providing secondary service for another zone. All the while providing caching services for hosts on the local LAN. Caching NameserverThe default configuration acts as a caching server. Simply uncomment and edit
zone "example.com" {
type master;
file "/etc/bind/db.example.com";
};
6 to set the IP addresses of your ISP’s DNS servers:
forwarders {
1.2.3.4;
5.6.7.8;
};
NoteReplace sudo cp /etc/bind/db.local /etc/bind/db.example.com
4 and sudo cp /etc/bind/db.local /etc/bind/db.example.com
5 with the IP Addresses of actual nameservers. To enable the new configuration, restart the DNS server. From a terminal prompt:
sudo systemctl restart bind9.service
See for information on testing a caching DNS server. Primary ServerIn this section BIND9 will be configured as the Primary server for the domain
sudo cp /etc/bind/db.local /etc/bind/db.example.com
6. Simply replace
sudo cp /etc/bind/db.local /etc/bind/db.example.com
6 with your FQDN (Fully Qualified Domain Name). Forward Zone FileTo add a DNS zone to BIND9, turning BIND9 into a Primary server, first edit
zone "example.com" {
type master;
file "/etc/bind/db.example.com";
};
7:
zone "example.com" {
type master;
file "/etc/bind/db.example.com";
};
NoteIf bind will be receiving automatic updates to the file as with DDNS, then use sudo cp /etc/bind/db.local /etc/bind/db.example.com
9 rather than ;
; BIND data file for example.com
;
$TTL 604800
@ IN SOA example.com. root.example.com. (
2 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
@ IN NS ns.example.com.
@ IN A 192.168.1.10
@ IN AAAA ::1
ns IN A 192.168.1.10
0 both here and in the copy command below. Now use an existing zone file as a template to create the
;
; BIND data file for example.com
;
$TTL 604800
@ IN SOA example.com. root.example.com. (
2 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
@ IN NS ns.example.com.
@ IN A 192.168.1.10
@ IN AAAA ::1
ns IN A 192.168.1.10
0 file:
sudo cp /etc/bind/db.local /etc/bind/db.example.com
Edit the new zone file
;
; BIND data file for example.com
;
$TTL 604800
@ IN SOA example.com. root.example.com. (
2 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
@ IN NS ns.example.com.
@ IN A 192.168.1.10
@ IN AAAA ::1
ns IN A 192.168.1.10
0 and change
;
; BIND data file for example.com
;
$TTL 604800
@ IN SOA example.com. root.example.com. (
2 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
@ IN NS ns.example.com.
@ IN A 192.168.1.10
@ IN AAAA ::1
ns IN A 192.168.1.10
3 to the FQDN of your server, leaving the additional
;
; BIND data file for example.com
;
$TTL 604800
@ IN SOA example.com. root.example.com. (
2 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
@ IN NS ns.example.com.
@ IN A 192.168.1.10
@ IN AAAA ::1
ns IN A 192.168.1.10
4 at the end. Change
;
; BIND data file for example.com
;
$TTL 604800
@ IN SOA example.com. root.example.com. (
2 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
@ IN NS ns.example.com.
@ IN A 192.168.1.10
@ IN AAAA ::1
ns IN A 192.168.1.10
5 to the nameserver’s IP Address and
;
; BIND data file for example.com
;
$TTL 604800
@ IN SOA example.com. root.example.com. (
2 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
@ IN NS ns.example.com.
@ IN A 192.168.1.10
@ IN AAAA ::1
ns IN A 192.168.1.10
6 to a valid email address, but with a
;
; BIND data file for example.com
;
$TTL 604800
@ IN SOA example.com. root.example.com. (
2 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
@ IN NS ns.example.com.
@ IN A 192.168.1.10
@ IN AAAA ::1
ns IN A 192.168.1.10
4 instead of the usual
;
; BIND data file for example.com
;
$TTL 604800
@ IN SOA example.com. root.example.com. (
2 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
@ IN NS ns.example.com.
@ IN A 192.168.1.10
@ IN AAAA ::1
ns IN A 192.168.1.10
8 symbol, again leaving the
;
; BIND data file for example.com
;
$TTL 604800
@ IN SOA example.com. root.example.com. (
2 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
@ IN NS ns.example.com.
@ IN A 192.168.1.10
@ IN AAAA ::1
ns IN A 192.168.1.10
4 at the end. Change the comment to indicate the domain that this file is for. Create an A record for the base domain,
sudo cp /etc/bind/db.local /etc/bind/db.example.com
6. Also, create an A record for
sudo systemctl restart bind9.service
1, the name server in this example:
;
; BIND data file for example.com
;
$TTL 604800
@ IN SOA example.com. root.example.com. (
2 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
@ IN NS ns.example.com.
@ IN A 192.168.1.10
@ IN AAAA ::1
ns IN A 192.168.1.10
You must increment the Serial Number every time you make changes to the zone file. If you make multiple changes before restarting BIND9, simply increment the Serial once. Now, you can add DNS records to the bottom of the zone file. See for details. Note
Many admins like to use the last date edited as the serial of a zone, such as 2020012100 which is yyyymmddss (where ss is the Serial Number) Once you have made changes to the zone file BIND9 needs to be restarted for the changes to take effect:
sudo systemctl restart bind9.service
Reverse Zone FileNow that the zone is setup and resolving names to IP Addresses, a Reverse zone needs to be added to allows DNS to resolve an address to a name. Edit
zone "example.com" {
type master;
file "/etc/bind/db.example.com";
};
7 and add the following:
zone "1.168.192.in-addr.arpa" {
type master;
file "/etc/bind/db.192";
};
NoteReplace sudo systemctl restart bind9.service
3 with the first three octets of whatever network you are using. Also, name the zone file sudo systemctl restart bind9.service
4 appropriately. It should match the first octet of your network. Now create the
sudo systemctl restart bind9.service
4 file:
sudo cp /etc/bind/db.127 /etc/bind/db.192
Next edit
sudo systemctl restart bind9.service
4 changing the same options as
;
; BIND data file for example.com
;
$TTL 604800
@ IN SOA example.com. root.example.com. (
2 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
@ IN NS ns.example.com.
@ IN A 192.168.1.10
@ IN AAAA ::1
ns IN A 192.168.1.10
0:
sudo apt install dnsutils
0 The Serial Number in the Reverse zone needs to be incremented on each change as well. For each A record you configure in
;
; BIND data file for example.com
;
$TTL 604800
@ IN SOA example.com. root.example.com. (
2 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Negative Cache TTL
@ IN NS ns.example.com.
@ IN A 192.168.1.10
@ IN AAAA ::1
ns IN A 192.168.1.10
0, that is for a different address, you need to create a PTR record in
sudo systemctl restart bind9.service
4. After creating the reverse zone file restart BIND9:
sudo systemctl restart bind9.service
Secondary ServerOnce a Primary Server has been configured a Secondary Server is highly recommended in order to maintain the availability of the domain should the Primary become unavailable. First, on the Primary server, the zone transfer needs to be allowed. Add the
zone "1.168.192.in-addr.arpa" {
type master;
file "/etc/bind/db.192";
};
0 option to the example Forward and Reverse zone definitions in
zone "example.com" {
type master;
file "/etc/bind/db.example.com";
};
7:
sudo apt install dnsutils
2 NoteReplace zone "1.168.192.in-addr.arpa" {
type master;
file "/etc/bind/db.192";
};
2 with the IP Address of your Secondary nameserver. Restart BIND9 on the Primary server:
sudo systemctl restart bind9.service
Next, on the Secondary server, install the bind9 package the same way as on the Primary. Then edit the
zone "example.com" {
type master;
file "/etc/bind/db.example.com";
};
7 and add the following declarations for the Forward and Reverse zones:
sudo apt install dnsutils
4 NoteReplace zone "1.168.192.in-addr.arpa" {
type master;
file "/etc/bind/db.192";
};
4 with the IP Address of your Primary nameserver. Restart BIND9 on the Secondary server:
sudo systemctl restart bind9.service
In
zone "1.168.192.in-addr.arpa" {
type master;
file "/etc/bind/db.192";
};
5 you should see something similar to the following (some lines have been split to fit the format of this document):
sudo apt install dnsutils
6 NoteNote: A zone is only transferred if the Serial Number on the Primary is larger than the one on the Secondary. If you want to have your Primary DNS notifying other Secondary DNS Servers of zone changes, you can add zone "1.168.192.in-addr.arpa" {
type master;
file "/etc/bind/db.192";
};
6 to zone "example.com" {
type master;
file "/etc/bind/db.example.com";
};
7 as shown in the example below: sudo apt install dnsutils
7 NoteThe default directory for non-authoritative zone files is zone "1.168.192.in-addr.arpa" {
type master;
file "/etc/bind/db.192";
};
8. This directory is also configured in AppArmor to allow the named daemon to write to it. For more information on AppArmor see Security - AppArmor.
TroubleshootingThis section covers diagnosing problems with DNS and BIND9 configurations. Testing
resolv.confThe first step in testing BIND9 is to add the nameserver’s IP Address to a hosts resolver. The Primary nameserver should be configured as well as another host to double check things. Refer to for details on adding nameserver addresses to your network clients. In the end your
zone "1.168.192.in-addr.arpa" {
type master;
file "/etc/bind/db.192";
};
9 line in
sudo cp /etc/bind/db.127 /etc/bind/db.192
0 should be pointing at
sudo cp /etc/bind/db.127 /etc/bind/db.192
1 and you should have a
sudo cp /etc/bind/db.127 /etc/bind/db.192
2 parameter for your domain. Something like this:
sudo apt install dnsutils
8 To check which DNS server your local resolver is using, run:
sudo apt install dnsutils
9 Note
You should also add the IP Address of the Secondary nameserver to your client configuration in case the Primary becomes unavailable.
digIf you installed the dnsutils package you can test your setup using the DNS lookup utility dig: - After installing BIND9 use dig against the loopback interface to make sure it is listening on port 53. From a terminal prompt:
forwarders { 1.2.3.4;
5.6.7.8;
}; 0
You should see lines similar to the following in the command output: forwarders { 1.2.3.4;
5.6.7.8;
};
1 - If you have configured BIND9 as a Caching nameserver “dig” an outside domain to check the query time:
forwarders { 1.2.3.4;
5.6.7.8;
}; 2
Note the query time toward the end of the command output: forwarders { 1.2.3.4;
5.6.7.8;
}; 3
After a second dig there should be improvement: forwarders { 1.2.3.4;
5.6.7.8;
};
4
pingNow to demonstrate how applications make use of DNS to resolve a host name use the ping utility to send an ICMP echo request:
forwarders {
1.2.3.4;
5.6.7.8;
};
5 This tests if the nameserver can resolve the name
sudo systemctl restart bind9.service
1 to an IP Address. The command output should resemble:
forwarders {
1.2.3.4;
5.6.7.8;
};
6 named-checkzoneA great way to test your zone files is by using the
sudo cp /etc/bind/db.127 /etc/bind/db.192
4 utility installed with the
sudo cp /etc/bind/db.127 /etc/bind/db.192
5 package. This utility allows you to make sure the configuration is correct before restarting BIND9 and making the changes live.
The Serial Number of your zone file will probably be different.
Quick temporary query loggingWith the
sudo cp /etc/bind/db.127 /etc/bind/db.192
6 tool, you can quickly turn query logging on and off, without restarting the service or changing the configuration file. To turn query logging on, run:
sudo systemctl restart bind9.service
1 Likewise, to turn it off, run:
sudo systemctl restart bind9.service
2 The logs will be sent to syslog and will show up in
zone "1.168.192.in-addr.arpa" {
type master;
file "/etc/bind/db.192";
};
5 by default:
sudo systemctl restart bind9.service
3 NoteThe amount of logs generated by enabling sudo cp /etc/bind/db.127 /etc/bind/db.192
8 could be huge!
LoggingBIND9 has a wide variety of logging configuration options available, but the two main ones are channel and category, which configure where logs go, and what information gets logged, respectively. If no logging options are configured the default configuration is:
sudo systemctl restart bind9.service
4 Let’s instead configure BIND9 to send debug messages related to DNS queries to a separate file. We need to configure a channel to specify which file to send the messages to, and a category. In this example, the category will log all queries. Edit
zone "example.com" {
type master;
file "/etc/bind/db.example.com";
};
7 and add the following:
sudo systemctl restart bind9.service
5 Note
The debug option can be set from 1 to 3. If a level isn’t specified, level 1 is the default.
You should see the file
sudo apt install dnsutils
01 fill with query information. This is a simple example of the BIND9 logging options. For coverage of advanced options see . References
Common Record TypesThis section covers some of the most common DNS record types. sudo apt install dnsutils 02 record: This record maps an IP Address to a hostname. sudo systemctl restart bind9.service
8 sudo apt install dnsutils 03 record: Used to create an alias to an existing A record. You cannot create a sudo apt install dnsutils 03 record pointing to another sudo apt install dnsutils 03 record. sudo systemctl restart bind9.service
9 sudo apt install dnsutils 06 record: Used to define where email should be sent to. Must point to an sudo apt install dnsutils 02 record, not a sudo apt install dnsutils -
zone "example.com" { type master;
file "/etc/bind/db.example.com";
};
0 sudo apt install dnsutils 09 record: Used to define which servers serve copies of a zone. It must point to an sudo apt install dnsutils 02 record, not a sudo apt install dnsutils 03. This is where Primary and Secondary servers are defined. zone "example.com" { type master;
file "/etc/bind/db.example.com";
};
1
- Upstream BIND9 Documentation
DNS and BIND is a popular book now in it’s fifth edition. There is now also a DNS and BIND on IPv6 book. |