BIND9 Authoritative DNS Server: Zone Configuration Guide

Hosting your own authoritative DNS with BIND9 means your domain answers come from servers you control instead of a registrar's panel - essential for glue records, split-horizon views and DNSSEC. The setup has three parts: global options that disable recursion (so your server cannot be abused as an open resolver), zone declarations in named.conf.local, and zone files holding the SOA, NS and address records. This guide walks through an authoritative-only BIND9 configuration on Ubuntu/Debian with the RHEL path noted, including validation with named-checkconf and named-checkzone.

Step 1: Install BIND9

sudo apt install bind9 bind9utils dnsutils       # Debian/Ubuntu
sudo dnf install bind bind-utils                 # RHEL/Rocky

Step 2: Harden the Global Options

In /etc/bind/named.conf.options (RHEL: /etc/named.conf), turn recursion off so the server only answers for zones it is authoritative for:

options {
    directory "/var/cache/bind";
    listen-on { any; };
    listen-on-v6 { none; };
    recursion no;                // prevents open-resolver abuse
    allow-query { any; };
    allow-transfer { none; };    // restrict zone transfers
    dnssec-validation auto;
    version "not available";
};

Step 3: Declare Forward and Reverse Zones

Append to /etc/bind/named.conf.local:

zone "example.com" {
    type master;
    file "/etc/bind/zones/db.example.com";
    allow-transfer { 10.20.0.2; };   // secondary nameserver
    notify yes;
};

zone "0.20.10.in-addr.arpa" {
    type master;
    file "/etc/bind/zones/db.10.20.0";
};

Step 4: Write the Zone Files

; /etc/bind/zones/db.example.com
$TTL 604800
@   IN  SOA ns1.example.com. admin.example.com. (
        2026050101 ; Serial (YYYYMMDDNN)
        604800     ; Refresh
        86400      ; Retry
        2419200    ; Expire
        604800 )   ; Negative cache TTL
    IN  NS  ns1.example.com.
    IN  NS  ns2.example.com.
ns1 IN  A   203.0.113.53
ns2 IN  A   198.51.100.53
@   IN  A   203.0.113.80
www IN  CNAME example.com.
mail IN  A   203.0.113.25
@   IN  MX  10 mail.example.com.

Remember the trailing dots on fully qualified names, and bump the serial (YYYYMMDDNN format) on every change so secondaries and caches pick it up.

Step 5: Validate and Restart

sudo named-checkconf                    # empty output = good
sudo named-checkzone example.com /etc/bind/zones/db.example.com
sudo named-checkzone 0.20.10.in-addr.arpa /etc/bind/zones/db.10.20.0
sudo systemctl restart bind9
dig @127.0.0.1 example.com A +short

Related Guides on This Site

Debug resolution problems with dig and nslookup troubleshooting, keep the server's clock honest with chrony NTP, and secure inbound queries with nftables.

原文链接：https://oneuptime.com/blog/post/2026-03-20-configure-bind-authoritative-dns/view