{"id":7005,"date":"2023-10-12T16:53:03","date_gmt":"2023-10-12T16:53:03","guid":{"rendered":"https:\/\/www.webhi.com\/how-to\/?p=7005"},"modified":"2023-10-12T16:53:07","modified_gmt":"2023-10-12T16:53:07","slug":"how-to-setup-and-configure-bind-as-a-private-network-dns-server","status":"publish","type":"post","link":"https:\/\/www.webhi.com\/how-to\/how-to-setup-and-configure-bind-as-a-private-network-dns-server\/","title":{"rendered":"How to Setup and configure Bind as a Private Network DNS Server"},"content":{"rendered":"\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"1200\" height=\"675\" src=\"https:\/\/www.webhi.com\/how-to\/gilrogre\/2023\/10\/bind_dns_en.jpg\" alt=\"install and Config Bind as a Private Network DNS Server\" class=\"wp-image-7034\" srcset=\"https:\/\/www.webhi.com\/how-to\/gilrogre\/2023\/10\/bind_dns_en.jpg 1200w, https:\/\/www.webhi.com\/how-to\/gilrogre\/2023\/10\/bind_dns_en-300x169.jpg 300w, https:\/\/www.webhi.com\/how-to\/gilrogre\/2023\/10\/bind_dns_en-1024x576.jpg 1024w, https:\/\/www.webhi.com\/how-to\/gilrogre\/2023\/10\/bind_dns_en-768x432.jpg 768w, https:\/\/www.webhi.com\/how-to\/gilrogre\/2023\/10\/bind_dns_en-150x84.jpg 150w\" sizes=\"(max-width: 1200px) 100vw, 1200px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"introduction\">Introduction<\/h2>\n\n\n\n<p><strong>Bind<\/strong> (Berkeley Internet Name Domain) is an open source software that implements the Domain Name System (DNS) protocols for the Internet. It is the most widely used DNS software on the Internet.<\/p>\n\n\n\n<p>Setting up Bind as a <strong>private network DNS server<\/strong> provides a number of benefits:<\/p>\n\n\n\n<ul>\n<li>Allows you to resolve hostnames to IP addresses for machines on your private network without relying on an external DNS server<\/li>\n\n\n\n<li>Gives you greater control and customization over your private DNS namespace<\/li>\n\n\n\n<li>Improves security and privacy by avoiding DNS queries going to external servers<\/li>\n\n\n\n<li>Enhances reliability by reducing dependence on external DNS servers<\/li>\n<\/ul>\n\n\n\n<p>In this guide, we will cover the steps required to install, configure and set up Bind as a caching and authoritative DNS server on a private network.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"prerequisites\">Prerequisites<\/h2>\n\n\n\n<p>Before starting with the Bind setup, we need to ensure we have the following:<\/p>\n\n\n\n<ul>\n<li>A Linux server with a fresh install of Linux distribution like Ubuntu 20.04\/22.04, Debian 11\/12, CentOS 7\/8 etc.<\/li>\n\n\n\n<li>The Linux machine should have a static IP address and network connectivity on the private network.<\/li>\n\n\n\n<li>A domain name you want to use for your private network. This will act as the root domain in your Bind configuration. For example, if you choose&nbsp;<code>home.net<\/code>&nbsp;as your domain, your DNS server will be responsible for&nbsp;<code>home.net<\/code>&nbsp;and any sub-domains under it like&nbsp;<code>server1.home.net<\/code>,&nbsp;<code>printers.home.net<\/code>&nbsp;etc.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"installing-bind\">Installing Bind<\/h2>\n\n\n\n<p>Bind is available in the default repositories for most Linux distributions.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"ubuntudebian\">Ubuntu\/Debian<\/h3>\n\n\n\n<p>On Ubuntu or Debian, install Bind using apt:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">$ sudo apt update\n$ sudo apt install bind9 bind9utils<\/code><\/pre>\n\n\n\n<p>This will install Bind 9 and some utilities like dig, nslookup etc.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"centosrhel\">CentOS\/RHEL<\/h3>\n\n\n\n<p>On CentOS or RHEL, install Bind using yum:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">$ sudo yum update\n$ sudo yum install bind bind-utils<\/code><\/pre>\n\n\n\n<p>Again this will install bind9 packages and utilities.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"verifying-installation\">Verifying Installation<\/h3>\n\n\n\n<p>To verify that Bind is installed:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">$ dig -v<\/code><\/pre>\n\n\n\n<p>This should display the Bind version that is now installed:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">;; BIND version: 9.11.3-1ubuntu1.2-Ubuntu<\/code><\/pre>\n\n\n\n<p>This confirms that Bind is installed and ready to be configured.<\/p>\n\n\n\n<p>The rest of the guide can then dive into the configuration as outlined. Let me know if you would like any other details added to the installation section!<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"basic-bind-configuration\">Basic Bind Configuration<\/h2>\n\n\n\n<p>The main Bind configuration files are:<\/p>\n\n\n\n<ul>\n<li><code>\/etc\/bind\/named.conf<\/code>&nbsp;&#8211; The main Bind config file which includes all other config files<\/li>\n\n\n\n<li><code>\/etc\/bind\/named.conf.options<\/code>&nbsp;&#8211; Global options for Bind<\/li>\n\n\n\n<li><code>\/etc\/bind\/named.conf.local<\/code>&nbsp;&#8211; Configuration for local DNS server itself<\/li>\n\n\n\n<li><code>\/etc\/bind\/db.root<\/code>&nbsp;&#8211; Root hints file pointing to DNS root servers<\/li>\n\n\n\n<li><code>\/var\/cache\/bind<\/code>&nbsp;&#8211; Working directory for Bind with cache and other data<\/li>\n<\/ul>\n\n\n\n<p>Let&#8217;s take a look at some key options we need to configure in these files.<\/p>\n\n\n\n<p>In&nbsp;<code>named.conf.options<\/code>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"nginx\" class=\"language-nginx\">options {\n        directory \"\/var\/cache\/bind\";\n        \n        forwarders {\n                8.8.8.8; \n                8.8.4.4;\n        };\n\n        allow-query { any; };\n        \n        dnssec-validation auto;\n\n        auth-nxdomain no;    # conform to RFC1035\n        listen-on-v6 { any; };\n};<\/code><\/pre>\n\n\n\n<p>This sets the Bind working directory, configures Google&#8217;s public DNS servers as forwarders for external domain resolution, allows queries from any IP address, enables DNSSEC validation and listens on both IPv4 and IPv6 addresses.<\/p>\n\n\n\n<p>In&nbsp;<code>named.conf.local<\/code>, configure your private root zone and local DNS server details:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"nginx\" class=\"language-nginx\">\/\/ Define root zone \nzone \"home.net\" IN {\n        type master;\n        file \"\/etc\/bind\/db.home.net\";\n};\n\n\/\/ Declare local DNS server itself\nzone \"dns1.home.net\" {\n        type master;\n        file \"\/etc\/bind\/db.dns1.home.net\";\n};<\/code><\/pre>\n\n\n\n<p>This defines&nbsp;<code>home.net<\/code>&nbsp;as the root zone configured as a master zone, meaning our DNS server will be the authoritative server for this domain. The zone details will be loaded from the file&nbsp;<code>db.home.net<\/code>.<\/p>\n\n\n\n<p>We also add a zone declaration for our local DNS server name&nbsp;<code>dns1.home.net<\/code>&nbsp;with its details in&nbsp;<code>db.dns1.home.net<\/code>&nbsp;file.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"configuring-the-root-zone\">Configuring the Root Zone<\/h2>\n\n\n\n<p>Next, we need to define our root zone&nbsp;<code>home.net<\/code>&nbsp;details in the&nbsp;<code>db.home.net<\/code>&nbsp;file:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"nginx\" class=\"language-nginx\">$TTL    604800\n@       IN      SOA     dns1.home.net. admin.home.net. (\n                              3         ; Serial\n                         604800         ; Refresh\n                          86400         ; Retry\n                        2419200         ; Expire\n                         604800 )       ; Negative Cache TTL\n;\n@       IN      NS      dns1.home.net.\n@       IN      A       192.168.1.100<\/code><\/pre>\n\n\n\n<p>This sets the default TTL, SOA record defining properties for the zone, our DNS server as the Name Server for&nbsp;<code>home.net<\/code>&nbsp;and its IP address.<\/p>\n\n\n\n<p>For the local DNS server, the&nbsp;<code>db.dns1.home.net<\/code>&nbsp;file:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"nginx\" class=\"language-nginx\">$TTL    604800\n@       IN      SOA     dns1.home.net. admin.home.net. (\n                              3         ; Serial\n                         604800         ; Refresh\n                          86400         ; Retry\n                        2419200         ; Expire\n                         604800 )       ; Negative Cache TTL\n;\n@       IN      NS      dns1\n@       IN      A       192.168.1.100<\/code><\/pre>\n\n\n\n<p>This configures the SOA and A record for our local DNS server.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"configuring-recursive-forwarding\">Configuring Recursive Forwarding<\/h2>\n\n\n\n<p>In a private network, the local DNS server may not be able to resolve all hostnames to IP addresses by itself. In that case, we need to configure recursive forwarding to send external DNS queries to public DNS resolvers.<\/p>\n\n\n\n<p>This is defined in&nbsp;<code>named.conf.options<\/code>&nbsp;earlier using the&nbsp;<code>forwarders<\/code>&nbsp;statement. Here we configure Google&#8217;s public DNS servers&nbsp;<code>8.8.8.8<\/code>&nbsp;and&nbsp;<code>8.8.4.4<\/code>&nbsp;to handle external queries.<\/p>\n\n\n\n<p>With this, if our DNS server receives a query it cannot resolve from its local zones, it will forward it recursively to the external DNS servers to find the answer.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"securing-the-dns-server\">Securing the DNS Server<\/h2>\n\n\n\n<p>Since the DNS server provides critical network services, we need to secure it just like any other server machine. Some key steps include:<\/p>\n\n\n\n<ul>\n<li>Use a dedicated non-root user account for Bind process<\/li>\n\n\n\n<li>Restrict access to Bind config files and folders<\/li>\n\n\n\n<li>Configure firewall rules to allow only DNS traffic on port 53 for both UDP and TCP<\/li>\n\n\n\n<li>Enable SElinux or AppArmor for additional security<\/li>\n\n\n\n<li>Use TLS for encrypting DNS traffic if needed<\/li>\n\n\n\n<li>Setup secure dynamic updates using TSIG if clients need to dynamically update DNS records<\/li>\n\n\n\n<li>Enable DNSSEC validation for enhanced security of DNS data<\/li>\n\n\n\n<li>Configure rate-limiting in&nbsp;<code>named.conf.options<\/code>&nbsp;to prevent DNS amplification attacks<\/li>\n<\/ul>\n\n\n\n<p>Here are some firewall rules to allow only DNS traffic:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\"># Allow DNS queries \n$ iptables -A INPUT -p udp --dport 53 -j ACCEPT\n$ iptables -A INPUT -p tcp --dport 53 -j ACCEPT\n\n# Allow zone transfers\n$ iptables -A INPUT -p tcp --dport 53 -m state --state ESTABLISHED -j ACCEPT\n\n# Allow responses \n$ iptables -A OUTPUT -p udp --sport 53 -j ACCEPT\n$ iptables -A OUTPUT -p tcp --sport 53 -j ACCEPT <\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"testing-the-setup\">Testing the Setup<\/h2>\n\n\n\n<p>Once Bind is installed and base configuration is done, we can start the service and verify it is working properly.<\/p>\n\n\n\n<p>On Systemd systems, run:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\"># systemctl start bind9\n# systemctl enable bind9<\/code><\/pre>\n\n\n\n<p>On init.d systems, run:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\"># service bind9 start\n# chkconfig bind9 on<\/code><\/pre>\n\n\n\n<p>Check status using:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\"># systemctl status bind9 \n# service bind9 status<\/code><\/pre>\n\n\n\n<p>The Bind service should be active and running.<\/p>\n\n\n\n<p>Now we can test lookups using&nbsp;<code>dig<\/code>,&nbsp;<code>nslookup<\/code>&nbsp;or&nbsp;<code>host<\/code>&nbsp;commands:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\"># dig @192.168.1.100 home.net\n# nslookup dns1.home.net 192.168.1.100\n# host google.com 192.168.1.100<\/code><\/pre>\n\n\n\n<p>The first query should return SOA and NS records for&nbsp;<code>home.net<\/code>. Second one should show the A record for&nbsp;<code>dns1.home.net<\/code>. Last one is a recursive query for&nbsp;<code>google.com<\/code>&nbsp;which should return the external IP address after forwarding to Google DNS.<\/p>\n\n\n\n<p>If all of these work fine, your Bind DNS server is configured properly for basic DNS resolution and forwarding!<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"configuring-zones-for-local-networks\">Configuring Zones for Local Networks<\/h2>\n\n\n\n<p>At this point, our DNS server only knows about the root&nbsp;<code>home.net<\/code>&nbsp;zone with the local DNS server details. We need to add more zones to provide naming resolution for our private network.<\/p>\n\n\n\n<p>Let&#8217;s assume we have the network&nbsp;<code>192.168.1.0\/24<\/code>&nbsp;with some hosts defined:<\/p>\n\n\n\n<ul>\n<li><code>192.168.1.100<\/code>&nbsp;&#8211; Our DNS server itself&nbsp;<code>dns1.home.net<\/code><\/li>\n\n\n\n<li><code>192.168.1.101<\/code>&nbsp;&#8211; A web server named&nbsp;<code>web1.home.net<\/code><\/li>\n\n\n\n<li><code>192.168.1.102<\/code>&nbsp;&#8211; A database server&nbsp;<code>db1.home.net<\/code><\/li>\n\n\n\n<li><code>192.168.1.103<\/code>&nbsp;&#8211; A file server&nbsp;<code>files.home.net<\/code><\/li>\n<\/ul>\n\n\n\n<p>We can add each of these servers as an A record within the&nbsp;<code>home.net<\/code>&nbsp;zone itself in&nbsp;<code>db.home.net<\/code>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"nginx\" class=\"language-nginx\">web1     IN  A 192.168.1.101\ndb1      IN  A 192.168.1.102 \nfiles    IN  A 192.168.1.103<\/code><\/pre>\n\n\n\n<p>After reloading the Bind service, we can now lookup these hosts and get back the IP address:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\"># dig @192.168.1.100 web1.home.net\n# nslookup db1.home.net 192.168.1.100\n# host files.home.net 192.168.1.100<\/code><\/pre>\n\n\n\n<p>Instead of adding all hosts in the root zone, we can also configure a new separate zone for our internal network.<\/p>\n\n\n\n<p>Add this zone definition to&nbsp;<code>named.conf.local<\/code>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"nginx\" class=\"language-nginx\">zone \"1.168.192.in-addr.arpa\" {\n  type master;\n  file \"\/etc\/bind\/db.192\"; \n};<\/code><\/pre>\n\n\n\n<p>Here we define a reverse lookup zone for IP addresses under 192.168.1.0\/24 mapped to the&nbsp;<code>.arpa<\/code>&nbsp;domain.<\/p>\n\n\n\n<p>The zone file&nbsp;<code>\/etc\/bind\/db.192<\/code>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"nginx\" class=\"language-nginx\">$TTL    604800\n@       IN      SOA     home.net. admin.home.net. (\n                              2         ; Serial\n                         604800         ; Refresh\n                          86400         ; Retry\n                        2419200         ; Expire\n                          86400 )       ; Negative Cache TTL\n;\n@       IN      NS      dns1.\n100     IN      PTR     dns1.home.net.  \n101     IN      PTR     web1.home.net.\n102     IN      PTR     db1.home.net.\n103     IN      PTR     files.home.net.<\/code><\/pre>\n\n\n\n<p>This defines the reverse mapping from IP addresses to names for hosts in 192.168.1.0\/24 network.<\/p>\n\n\n\n<p>After reloading Bind, reverse lookups will work:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\"># dig -x 192.168.1.101 @192.168.1.100\n# nslookup -query=PTR 192.168.1.102 192.168.1.100\n# host 192.168.1.103 192.168.1.100<\/code><\/pre>\n\n\n\n<p>Similar additional zone files can be added for any other private subnets and hosts configured on the network.<\/p>\n\n\n\n<p>This provides an authoritative local DNS service without relying on any external DNS servers.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"dynamic-zone-updates\">Dynamic Zone Updates<\/h2>\n\n\n\n<p>In larger environments, maintaining DNS records for a changing infrastructure can be challenging. Bind provides two ways of dynamically updating DNS zones &#8211; Dynamic DNS (DDNS) and DNSSEC signed updates.<\/p>\n\n\n\n<p>With DDNS, clients can directly update their DNS records within a zone by sending special UPDATE requests to the DNS server. This is simpler to setup but not secure.<\/p>\n\n\n\n<p>DNSSEC signed updates use Transaction Signatures (TSIG) to cryptographically sign the update requests. The DNS server only accepts updates with a valid signature.<\/p>\n\n\n\n<p>Here is an example of enabling DDNS updates for clients in subnet 192.168.1.0\/24:<\/p>\n\n\n\n<p>In&nbsp;<code>named.conf.local<\/code>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"nginx\" class=\"language-nginx\">zone \"home.net\" {\n     type master;\n     allow-update { 192.168.1\/24; };\n     file \"\/etc\/bind\/db.home.net\";\n}; <\/code><\/pre>\n\n\n\n<p>The&nbsp;<code>allow-update<\/code>&nbsp;option enables updates from the subnet.<\/p>\n\n\n\n<p>Client machines can use&nbsp;<code>nsupdate<\/code>&nbsp;command to add\/modify\/delete records. For example:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\"># nsupdate\n&gt; update add web2.home.net 3600 A 192.168.1.105\n&gt; send<\/code><\/pre>\n\n\n\n<p>This will add an A record for&nbsp;<code>web2.home.net<\/code>. Records can be deleted by specifying their name and&nbsp;<code>ttl<\/code>&nbsp;value only.<\/p>\n\n\n\n<p>For TSIG signed updates, both server and clients share a common TSIG key. The key can be generated using&nbsp;<code>dnssec-keygen<\/code>. Clients sign the UPDATE packet with the TSIG signature.<\/p>\n\n\n\n<p>On the server, the&nbsp;<code>named.conf<\/code>&nbsp;specifies the TSIG key and enabled signed updates:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"nginx\" class=\"language-nginx\">key \"tsig-key\" {\n     algorithm hmac-sha256;\n     secret \"b3BlbnNlc2FtZTAwMA==\"; \n};\n  \nzone \"home.net\" {\n    type master;\n    allow-update { key tsig-key; };\n    ...\n}<\/code><\/pre>\n\n\n\n<p>Clients can use the same key for signing update requests. This ensures only authorized hosts can dynamically update their DNS records.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"split-horizon-dns\">Split-Horizon DNS<\/h2>\n\n\n\n<p>Sometimes private internal DNS servers may return different results than external public DNS to provide split DNS configuration. This is known as split-horizon DNS.<\/p>\n\n\n\n<p>For example,&nbsp;<code>webserver.company.com<\/code>&nbsp;internally could resolve to the private IP&nbsp;<code>192.168.1.101<\/code>&nbsp;whereas externally it resolves to the public IP&nbsp;<code>1.2.3.4<\/code>.<\/p>\n\n\n\n<p>We can achieve this with Bind by defining&nbsp;<code>company.com<\/code>&nbsp;zone both as a forward zone for public IPs and as a separate reverse zone for internal IPs.<\/p>\n\n\n\n<p>In&nbsp;<code>named.conf.local<\/code>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"nginx\" class=\"language-nginx\">\/\/ Forward Zone\nzone \"company.com\" {\n    type master;\n    file \"\/etc\/bind\/db.company.com.public\";\n}\n\n\/\/ Reverse Zone \nzone \"1.168.192.in-addr.arpa\"{ \n   type master;\n   file \"\/etc\/bind\/db.company.com.private\";\n}<\/code><\/pre>\n\n\n\n<p>This allows defining different A records for&nbsp;<code>webserver.company.com<\/code>&nbsp;in the public and private zone files. The BIND server can be configured to listen on different network interfaces to serve the correct data.<\/p>\n\n\n\n<p>Split DNS is useful for security, isolation and policy control between public vs private DNS data.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"caching-and-prefetching\">Caching and Prefetching<\/h2>\n\n\n\n<p>Enabling caching and prefetching on the DNS server can improve performance. By default, Bind caches query results for better resolution speed.<\/p>\n\n\n\n<p>We can tune the cache TTL values in&nbsp;<code>named.conf.options<\/code>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"nginx\" class=\"language-nginx\">dnssec-validation auto;\nrecursion yes; \n\ncache-size 500m;\ncache-file \"\/var\/cache\/bind\/db.cache\"; \n\nprefetch 2;\nprefetch-key no-edns;\n\ndnssec-accept-expired yes;\nmax-cache-ttl 600;        # 10 minutes \nmax-ncache-ttl 90;        # 1.5 minutes<\/code><\/pre>\n\n\n\n<p>This enables caching of up to 500MB data to disk, sets prefetch level, cache TTL limits and allows using expired records while refreshing DNSSEC data.<\/p>\n\n\n\n<p>Prefetching improves resolution for sibling domains by proactively querying dependent records.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"logging-and-monitoring\">Logging and Monitoring<\/h2>\n\n\n\n<p>Like any server, the DNS server should be monitored closely. Bind provides good logging capabilities which can be sent to a central log server.<\/p>\n\n\n\n<p>In&nbsp;<code>named.conf.options<\/code>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"nginx\" class=\"language-nginx\">logging {\n        channel query_log {\n                file \"\/var\/log\/query.log\" versions 3 size 20m;\n                severity info;\n                print-category yes;\n                print-severity yes;\n                print-time yes;\n        };\n        category queries { query_log; };\n};<\/code><\/pre>\n\n\n\n<p>Key metrics to monitor are:<\/p>\n\n\n\n<ul>\n<li>Query rates and response times<\/li>\n\n\n\n<li>Cache utilization and hit ratios<\/li>\n\n\n\n<li>DNSSEC validation errors<\/li>\n\n\n\n<li>Failed updates or zone transfers<\/li>\n\n\n\n<li>Rate-limiting events or access violations<\/li>\n\n\n\n<li>Network errors and timeouts<\/li>\n<\/ul>\n\n\n\n<p>Integrating the DNS server with a monitoring system provides important visibility into DNS operations and performance.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"testing-and-validation\">Testing and Validation<\/h2>\n\n\n\n<p>Once the DNS server is configured and deployed, we should thoroughly test it to detect any issues:<\/p>\n\n\n\n<ul>\n<li>Use DNS lookup tools like&nbsp;<code>dig<\/code>,&nbsp;<code>nslookup<\/code>&nbsp;and&nbsp;<code>host<\/code>&nbsp;to test different record lookups<\/li>\n\n\n\n<li>Perform reverse lookups to confirm PTR records are defined properly<\/li>\n\n\n\n<li>Verify zone transfers are working securely for secondary servers<\/li>\n\n\n\n<li>Test dynamic updates by adding\/deleting records using&nbsp;<code>nsupdate<\/code><\/li>\n\n\n\n<li>Check split-horizon configurations are returning correct internal and external results<\/li>\n\n\n\n<li>Confirm DNSSEC validation is working for signed zones<\/li>\n\n\n\n<li>Load test the DNS server using tools like&nbsp;<code>dnsperf<\/code>&nbsp;and&nbsp;<code>namebench<\/code><\/li>\n\n\n\n<li>Check logs and monitors during testing to catch any errors<\/li>\n\n\n\n<li>Scan for security issues like vulnerable software versions, encryption strength<\/li>\n\n\n\n<li>Perform a penetration test to identify and fix vulnerabilities<\/li>\n<\/ul>\n\n\n\n<p>Thorough testing and validation of the DNS server reduces risk and provides confidence in the availability, performance, security and correctness of the DNS infrastructure.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"summary\">Conclusion<\/h2>\n\n\n\n<p>In this detailed guide, we covered how to install, configure and set up Bind 9 as a local DNS server for private networks.<\/p>\n\n\n\n<p>We installed the Bind packages, configured the base&nbsp;<code>named.conf<\/code>&nbsp;files, set up forwarding, access control lists and other options. We added primary and reverse lookup zones for the internal network domains and hosts. Dynamic updates, split-horizon DNS, caching, logging and monitoring were also configured.<\/p>\n\n\n\n<p>Deploying Bind as a local DNS server provides centralized naming services for your private environment. It offers greater control, customization, privacy, security and autonomy over your private DNS infrastructure vs relying solely on external providers.<\/p>\n\n\n\n<p>Of course, hardened security, robust monitoring, testing, redundancy and proper maintenance is required to keep your DNS services running reliably. But with its flexible configurations, Bind can meet the local DNS requirements for even large private networks and custom deployments.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Introduction Bind (Berkeley Internet Name Domain) is an open source software that implements the Domain Name System (DNS) protocols for the Internet. It is the most widely used DNS software on the Internet. Setting up Bind as a private network DNS server provides a number of benefits: In this guide, we will cover the steps ..<\/p>\n<div class=\"clear-fix\"><\/div>\n<p><a href=\"https:\/\/www.webhi.com\/how-to\/how-to-setup-and-configure-bind-as-a-private-network-dns-server\/\" title=\"read more...\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[69],"tags":[],"yoast_head":"\n<title>How to Setup and configure Bind as a Private Network DNS Server - WebHi Tutorials &amp; Documentations<\/title>\n<meta name=\"description\" content=\"A detailed guide on how to install, configure and set up Bind as a private caching and authoritative DNS server with recursive forwarding, access control, dynamic updates, split-horizon DNS and proper logging, monitoring and validation.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.webhi.com\/how-to\/how-to-setup-and-configure-bind-as-a-private-network-dns-server\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Setup and configure Bind as a Private Network DNS Server - WebHi Tutorials &amp; Documentations\" \/>\n<meta property=\"og:description\" content=\"A detailed guide on how to install, configure and set up Bind as a private caching and authoritative DNS server with recursive forwarding, access control, dynamic updates, split-horizon DNS and proper logging, monitoring and validation.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.webhi.com\/how-to\/how-to-setup-and-configure-bind-as-a-private-network-dns-server\/\" \/>\n<meta property=\"og:site_name\" content=\"WebHi Tutorials &amp; Documentations\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/webhi.technology\" \/>\n<meta property=\"article:published_time\" content=\"2023-10-12T16:53:03+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-10-12T16:53:07+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.webhi.com\/how-to\/gilrogre\/2023\/10\/bind_dns_en.jpg\" \/>\n<meta name=\"author\" content=\"webhi\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@WebHiTechnology\" \/>\n<meta name=\"twitter:site\" content=\"@WebHiTechnology\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"webhi\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"12 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"TechArticle\",\"@id\":\"https:\/\/www.webhi.com\/how-to\/how-to-setup-and-configure-bind-as-a-private-network-dns-server\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.webhi.com\/how-to\/how-to-setup-and-configure-bind-as-a-private-network-dns-server\/\"},\"author\":{\"name\":\"webhi\",\"@id\":\"https:\/\/www.webhi.com\/how-to\/#\/schema\/person\/b31e76e2311cdc0bb90f5e2733059a54\"},\"headline\":\"How to Setup and configure Bind as a Private Network DNS Server\",\"datePublished\":\"2023-10-12T16:53:03+00:00\",\"dateModified\":\"2023-10-12T16:53:07+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.webhi.com\/how-to\/how-to-setup-and-configure-bind-as-a-private-network-dns-server\/\"},\"wordCount\":1905,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.webhi.com\/how-to\/#organization\"},\"articleSection\":[\"Linux system administration\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.webhi.com\/how-to\/how-to-setup-and-configure-bind-as-a-private-network-dns-server\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.webhi.com\/how-to\/how-to-setup-and-configure-bind-as-a-private-network-dns-server\/\",\"url\":\"https:\/\/www.webhi.com\/how-to\/how-to-setup-and-configure-bind-as-a-private-network-dns-server\/\",\"name\":\"How to Setup and configure Bind as a Private Network DNS Server - WebHi Tutorials &amp; Documentations\",\"isPartOf\":{\"@id\":\"https:\/\/www.webhi.com\/how-to\/#website\"},\"datePublished\":\"2023-10-12T16:53:03+00:00\",\"dateModified\":\"2023-10-12T16:53:07+00:00\",\"description\":\"A detailed guide on how to install, configure and set up Bind as a private caching and authoritative DNS server with recursive forwarding, access control, dynamic updates, split-horizon DNS and proper logging, monitoring and validation.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.webhi.com\/how-to\/how-to-setup-and-configure-bind-as-a-private-network-dns-server\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.webhi.com\/how-to\/how-to-setup-and-configure-bind-as-a-private-network-dns-server\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.webhi.com\/how-to\/how-to-setup-and-configure-bind-as-a-private-network-dns-server\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.webhi.com\/how-to\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to Setup and configure Bind as a Private Network DNS Server\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.webhi.com\/how-to\/#website\",\"url\":\"https:\/\/www.webhi.com\/how-to\/\",\"name\":\"WebHi Tutorials &amp; Documentations\",\"description\":\"System administration and knowledge base\",\"publisher\":{\"@id\":\"https:\/\/www.webhi.com\/how-to\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.webhi.com\/how-to\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.webhi.com\/how-to\/#organization\",\"name\":\"WebHi Technology\",\"url\":\"https:\/\/www.webhi.com\/how-to\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.webhi.com\/how-to\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.webhi.com\/how-to\/gilrogre\/2022\/07\/logo.png\",\"contentUrl\":\"https:\/\/www.webhi.com\/how-to\/gilrogre\/2022\/07\/logo.png\",\"width\":288,\"height\":95,\"caption\":\"WebHi Technology\"},\"image\":{\"@id\":\"https:\/\/www.webhi.com\/how-to\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/webhi.technology\",\"https:\/\/twitter.com\/WebHiTechnology\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.webhi.com\/how-to\/#\/schema\/person\/b31e76e2311cdc0bb90f5e2733059a54\",\"name\":\"webhi\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.webhi.com\/how-to\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/www.webhi.com\/how-to\/ahuphiph\/litespeed\/avatar\/e20da107d0f4c765ead2eef88ad019d8.jpg?ver=1784239260\",\"contentUrl\":\"https:\/\/www.webhi.com\/how-to\/ahuphiph\/litespeed\/avatar\/e20da107d0f4c765ead2eef88ad019d8.jpg?ver=1784239260\",\"caption\":\"webhi\"},\"sameAs\":[\"https:\/\/www.webhi.com\/how-to\"],\"url\":\"https:\/\/www.webhi.com\/how-to\/author\/webhi\/\"}]}<\/script>\n","yoast_head_json":{"title":"How to Setup and configure Bind as a Private Network DNS Server - WebHi Tutorials &amp; Documentations","description":"A detailed guide on how to install, configure and set up Bind as a private caching and authoritative DNS server with recursive forwarding, access control, dynamic updates, split-horizon DNS and proper logging, monitoring and validation.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.webhi.com\/how-to\/how-to-setup-and-configure-bind-as-a-private-network-dns-server\/","og_locale":"en_US","og_type":"article","og_title":"How to Setup and configure Bind as a Private Network DNS Server - WebHi Tutorials &amp; Documentations","og_description":"A detailed guide on how to install, configure and set up Bind as a private caching and authoritative DNS server with recursive forwarding, access control, dynamic updates, split-horizon DNS and proper logging, monitoring and validation.","og_url":"https:\/\/www.webhi.com\/how-to\/how-to-setup-and-configure-bind-as-a-private-network-dns-server\/","og_site_name":"WebHi Tutorials &amp; Documentations","article_publisher":"https:\/\/www.facebook.com\/webhi.technology","article_published_time":"2023-10-12T16:53:03+00:00","article_modified_time":"2023-10-12T16:53:07+00:00","og_image":[{"url":"https:\/\/www.webhi.com\/how-to\/gilrogre\/2023\/10\/bind_dns_en.jpg"}],"author":"webhi","twitter_card":"summary_large_image","twitter_creator":"@WebHiTechnology","twitter_site":"@WebHiTechnology","twitter_misc":{"Written by":"webhi","Est. reading time":"12 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"TechArticle","@id":"https:\/\/www.webhi.com\/how-to\/how-to-setup-and-configure-bind-as-a-private-network-dns-server\/#article","isPartOf":{"@id":"https:\/\/www.webhi.com\/how-to\/how-to-setup-and-configure-bind-as-a-private-network-dns-server\/"},"author":{"name":"webhi","@id":"https:\/\/www.webhi.com\/how-to\/#\/schema\/person\/b31e76e2311cdc0bb90f5e2733059a54"},"headline":"How to Setup and configure Bind as a Private Network DNS Server","datePublished":"2023-10-12T16:53:03+00:00","dateModified":"2023-10-12T16:53:07+00:00","mainEntityOfPage":{"@id":"https:\/\/www.webhi.com\/how-to\/how-to-setup-and-configure-bind-as-a-private-network-dns-server\/"},"wordCount":1905,"commentCount":0,"publisher":{"@id":"https:\/\/www.webhi.com\/how-to\/#organization"},"articleSection":["Linux system administration"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.webhi.com\/how-to\/how-to-setup-and-configure-bind-as-a-private-network-dns-server\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.webhi.com\/how-to\/how-to-setup-and-configure-bind-as-a-private-network-dns-server\/","url":"https:\/\/www.webhi.com\/how-to\/how-to-setup-and-configure-bind-as-a-private-network-dns-server\/","name":"How to Setup and configure Bind as a Private Network DNS Server - WebHi Tutorials &amp; Documentations","isPartOf":{"@id":"https:\/\/www.webhi.com\/how-to\/#website"},"datePublished":"2023-10-12T16:53:03+00:00","dateModified":"2023-10-12T16:53:07+00:00","description":"A detailed guide on how to install, configure and set up Bind as a private caching and authoritative DNS server with recursive forwarding, access control, dynamic updates, split-horizon DNS and proper logging, monitoring and validation.","breadcrumb":{"@id":"https:\/\/www.webhi.com\/how-to\/how-to-setup-and-configure-bind-as-a-private-network-dns-server\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.webhi.com\/how-to\/how-to-setup-and-configure-bind-as-a-private-network-dns-server\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.webhi.com\/how-to\/how-to-setup-and-configure-bind-as-a-private-network-dns-server\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.webhi.com\/how-to\/"},{"@type":"ListItem","position":2,"name":"How to Setup and configure Bind as a Private Network DNS Server"}]},{"@type":"WebSite","@id":"https:\/\/www.webhi.com\/how-to\/#website","url":"https:\/\/www.webhi.com\/how-to\/","name":"WebHi Tutorials &amp; Documentations","description":"System administration and knowledge base","publisher":{"@id":"https:\/\/www.webhi.com\/how-to\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.webhi.com\/how-to\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.webhi.com\/how-to\/#organization","name":"WebHi Technology","url":"https:\/\/www.webhi.com\/how-to\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.webhi.com\/how-to\/#\/schema\/logo\/image\/","url":"https:\/\/www.webhi.com\/how-to\/gilrogre\/2022\/07\/logo.png","contentUrl":"https:\/\/www.webhi.com\/how-to\/gilrogre\/2022\/07\/logo.png","width":288,"height":95,"caption":"WebHi Technology"},"image":{"@id":"https:\/\/www.webhi.com\/how-to\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/webhi.technology","https:\/\/twitter.com\/WebHiTechnology"]},{"@type":"Person","@id":"https:\/\/www.webhi.com\/how-to\/#\/schema\/person\/b31e76e2311cdc0bb90f5e2733059a54","name":"webhi","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.webhi.com\/how-to\/#\/schema\/person\/image\/","url":"https:\/\/www.webhi.com\/how-to\/ahuphiph\/litespeed\/avatar\/e20da107d0f4c765ead2eef88ad019d8.jpg?ver=1784239260","contentUrl":"https:\/\/www.webhi.com\/how-to\/ahuphiph\/litespeed\/avatar\/e20da107d0f4c765ead2eef88ad019d8.jpg?ver=1784239260","caption":"webhi"},"sameAs":["https:\/\/www.webhi.com\/how-to"],"url":"https:\/\/www.webhi.com\/how-to\/author\/webhi\/"}]}},"_links":{"self":[{"href":"https:\/\/www.webhi.com\/how-to\/wp-json\/wp\/v2\/posts\/7005"}],"collection":[{"href":"https:\/\/www.webhi.com\/how-to\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.webhi.com\/how-to\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.webhi.com\/how-to\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.webhi.com\/how-to\/wp-json\/wp\/v2\/comments?post=7005"}],"version-history":[{"count":15,"href":"https:\/\/www.webhi.com\/how-to\/wp-json\/wp\/v2\/posts\/7005\/revisions"}],"predecessor-version":[{"id":7048,"href":"https:\/\/www.webhi.com\/how-to\/wp-json\/wp\/v2\/posts\/7005\/revisions\/7048"}],"wp:attachment":[{"href":"https:\/\/www.webhi.com\/how-to\/wp-json\/wp\/v2\/media?parent=7005"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.webhi.com\/how-to\/wp-json\/wp\/v2\/categories?post=7005"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.webhi.com\/how-to\/wp-json\/wp\/v2\/tags?post=7005"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}