Bind

NOTE: The below examples are generally for both an Authoritative and Caching DNS Servers but with a little working can become Authoritative Only or Forwarding Only DNS Servers.

Tasks

Installing and configuring

• Install BIND and bind-utils, such as with:

yum install bind bind-utils

• Edit the /etc/named.conf file and add an ACL to a trusted list of instances, this will need to be updated on changes to IP’s or additions of secondaries. An example of this ACL is:

  acl "trusted" {
        172.31.7.46; #IP on this machine
        172.31.33.14; #Secondary DNS Servers IP
        localhost;
  };

• Add into/create a directive for allow-query and list the above ACL or potentially add the any; directive if anyone should be able to access this DNS server though generally this should be locked to a specific subnet for internal communication only and not made public. An example of this configuration with both the ACL and allow any query:

  allow-query     { trusted; any; };

• Configure the listen-on directive to set what ports the DNS Service listens on. An example of this:

  listen-on port 53 { 127.0.0.1; 172.31.7.46; };
  //listen-on-v6 port 53 { ::1; }; # This is commented out as this DNS server isn't configured to listen on IPV6 addresses.

• At the bottom of this global configuration add an include for a secondary configuration file. Example:

  include "/etc/named/named.conf.local";

• In this additional configuration file that you have included add in the required zones/configurations. This is discussed later in this document.

Configure a new Zone

• In a existing/new configuration file a Primary’s configuration, create the listing of the forward and reverse zones you’re creating. A sample of this configuration file is:

  zone "test.marjamis.example.com" {
        type master; # Specifies this DNS Server is the Primary Authoritative for the zone
        file "/etc/named/zones/db.test.marjamis.example.com"; # Location of the file zone db
  };

  zone "31.172.in-addr.arpa" { # Network Octets in reverse order
        type master; # Specifies this DNS Server is the Primary Authoritative for the zone
        file "/etc/named/zones/db.172.31"; # Location of the file zone db
  };

• Change the permissions on the /etc/named directory so that BIND can access the zone files. An example is:

chmod 755 /etc/named

• Now we need to create the db’s for the above listed forward/reverse zones. Each will need a basic configuration similar to the below which configures the basic requirements of a zone though there are plenty of other configuration. The base of each of these files is:

  $TTL 86400 #
  @       IN      SOA     <ns> <email> ( # @ will substitute the set or generated $ORIGIN, ns is the primary name server for this zone and email is for the email address of who's responsible for this zone. **NOTE:** the @ in an email address is substituted for a dot in the configuration file.
              3         ; Serial # Identifier to BIND on whether to use the new settings. Must be higher than the previous version on reload to take effect.
             604800     ; Refresh # This is the refresh interval for the zone. This is the amount of time that the slave will wait before polling the master for zone file changes.
              86400     ; Retry # This is the retry interval for this zone. If the slave cannot connect to the master when the refresh period is up, it will wait this amount of time and retry to poll the master.
            2419200     ; Expire # This is the expiry period. If a slave name server has not been able to contact the master for this amount of time, it no longer returns responses as an authoritative source for this zone.
             604800 )   ; Negative Cache TTL # This is the amount of time that the name server will cache a name error if it cannot find the requested name in this file.

• Once the basics are in place you can now add the required DNS Resource Records(RR’s) as needed. Look at the documentation for specifics but the general format is:

  <URL> IN A <ipv4 address> # A
  <URL> IN AAAA <ipv6 address> # AAAA
  <URL> IN CNAME www.google.com. # CNAME
  IN NS <URL> # NS, beginning URL for an NS isn't required as it's a zone wide parameter
  IN MX <URL> # Mail Record,  beginning URL for an NS isn't required as it's a zone wide parameter
  <URL> IN TXT "Whatever data you want" # TXT
* IN A <ipv4 address> # Resolves anything under the domain that isn't defined explicitly. Like a default.

  <host octets(reversed) IN PTR <URL> # PTR in reverse zone

• Once the configurations are made, you can check the syntax for the named.conf* file/s that we made with:

named-checkconf

• Then check each zone DB file is correct with:

named-checkzone <zone> <location of db file>

• Assuming all these checks pass you can then reload/start the DNS server and check the RR’s in place work.

Configure a Secondary DNS Server

• Install BIND on a second machine
• Edit the /etc/named.conf on the Primary and configure the option allow-transfer to have the IP of the secondary DNS server. Such as:

allow-transfer { 172.31.33.14; };

• Edit the /etc/named.conf file on the Secondary and configure the same base ACL’s, listen-on and options configurations as mentioned above for a primary with any required differences. Also add the additional include for the the additional configuration file.
• Open this included configuration file and add in the zones that we’ve created on the primary but instead of being masters they will be listed as slaves. An example of this configuration is:

zone "test.marjamis.example.com" {
    type slave;
    file "slaves/test.marjamis.example.com";
    masters { <IP_of_Primary>; };
};

zone "31.172.in-addr.arpa" {
    type slave;
    file "slaves/db.172.31";
    masters { <IP_of_Primary>; };
};

• Once again check the configuration files with:

# named-checkconf

• Now reload/restart BIND.

Updating DNS Records

• Log into DNS server
• Backup the current zone files as specified in the configuration file/s which can be found from the file:

  /etc/named.conf

• Edit the required zone file/s with the changes. To get the right zone file check the configuration file/s.
• Once the required alterations are made, change the date/increment in the header Serial number for a unique serial number for named to determine there is a change.
• Do the same for the reverse zones file/s.
• Reload named.

Updating forwarders

• Backup the configuration files for named, the default being:

  /etc/named.conf

• Add a new section, such as:

  zone "new" {
    type forward;
    forwarders { <ip>; <ip>; };
  };

• Reload named.
• Test the new additions/deletions with dig.

Backout Plan

• Restore the files you have backed up, update the serial number again so the change takes effect.
• Reload named.

Reload named

Examples are:

  AIX: # refresh -s named
  Linux: # systemctl reload named

General Information

Configurations / Definitions

Types of DNS

NOTE: For greater details on any configurations use official documentation.

rndc operations

rndc is a BIND server control utility that allows to configure the run-time configurations of BIND. Many, if not all, of these will temporarily change how BIND operates but on a restart of the named process the defaults will be restored so permanent modifications requires updating the named configuration files.

Other commands

Files and their purpose