BIND 9 Authoritative and Recursive DNS

BIND 9 runs the named name server. Its configuration determines whether it answers authoritatively, offers recursion, transfers zones, or accepts dynamic updates. Treat those roles separately because an Internet-facing authoritative server should not become an open recursive resolver.

Server Configuration #

named.conf defines global options, access-control lists, zones, and logging. A minimal authoritative configuration restricts recursion and zone transfer:

acl trusted-recursors { 192.0.2.0/24; 2001:db8:1::/48; };

options {
    directory "/var/named";
    listen-on { any; };
    listen-on-v6 { any; };
    recursion no;
    allow-transfer { none; };
    minimal-responses yes;
};

zone "example.net" {
    type primary;
    file "zones/example.net";
    allow-transfer { 192.0.2.53; };
};

A recursive resolver needs recursion yes and an allow-recursion or allow-query-cache ACL limited to its clients. Never expose recursion to untrusted networks unless the deployment explicitly provides a public resolver with abuse controls.

ACLs can be reused by allow-query, allow-recursion, allow-query-cache, allow-transfer, and match-clients. BIND view statements present different zone and recursion policies according to source address, destination address, or TSIG identity:

view "internal" {
    match-clients { trusted-recursors; };
    recursion yes;
    allow-recursion { trusted-recursors; };

    zone "example.net" {
        type primary;
        file "zones/internal/example.net";
    };
};

view "external" {
    match-clients { any; };
    recursion no;

    zone "example.net" {
        type primary;
        file "zones/external/example.net";
    };
};

When views are enabled, define each client-visible zone in the applicable view. Put the most specific match-clients rules first because BIND selects the first matching view.

Zone Files #

Zone-file records follow:

owner [TTL] [class] type rdata

$ORIGIN supplies a relative-name suffix; $TTL supplies a default TTL. An @ owner denotes the current origin. The zone apex needs an SOA record and NS records. Names lacking a terminal dot are relative to $ORIGIN.

$ORIGIN example.net.
$TTL 3600
@ IN SOA ns1.example.net. hostmaster.example.net. (
  2026080701 7200 900 1209600 300 )
  IN NS ns1.example.net.
  IN NS ns2.example.net.
ns1 IN A 192.0.2.53
www IN A 192.0.2.80
docs IN CNAME www

Increment the SOA serial for every published zone change. Secondary servers use the serial to decide whether a transfer is necessary. Configure transfers with an explicit ACL and authenticate them with TSIG when appropriate.

An A or AAAA record maps a name to an address. A CNAME makes its owner an alias and cannot coexist with ordinary data at that owner. Delegate a child zone with an NS RRset at the parent; include in-bailiwick A or AAAA glue in the parent when the delegated name servers reside below the delegated name:

child       IN NS ns1.child
ns1.child   IN A 192.0.2.91

Validation and Operations #

Validate before reloading:

named-checkconf /etc/named.conf
named-checkzone example.net /var/named/zones/example.net
rndc reload example.net
dig @127.0.0.1 www.example.net A +norecurse

Use rndc reconfig after changing zone declarations and rndc reload after changing zone data. Query authoritative and recursive paths separately with dig, inspect the status flags and authority section, and test both UDP and TCP where firewall behavior differs.

DNSSEC adds signed RRsets, DNSKEY publication, and a DS chain from the parent. BIND can maintain signatures and keys through a dnssec-policy; key files, rollover state, parent DS updates, and clock synchronization then become operational dependencies. Validate signed answers with dig +dnssec, and test through a validating resolver rather than treating the presence of an RRSIG as proof of a valid chain.

Run named as its dedicated unprivileged service account and ensure the working directory, keys, journal files, and zone files have the required permissions. Use named -g for foreground diagnostic runs and use the service manager for normal operation. Bind privileged ports before dropping privileges, limit writable directories, and keep control-channel keys readable only by the service and authorized administrators.

References #

• BIND 9 Administrator Reference Manual
• RFC 1035: Master File Format
• BIND 9 DNSSEC Guide