SSH port <\/a>number\u2014furthermore, substitute ‘root’ with the username of the system user with sudo privileges.<\/p>\n\n\n\nYou can verify whether you have the correct AlmaLinux version installed on your server with the subsequent command:<\/p>\n\n\n\n
# cat \/etc\/almalinux-release<\/pre>\n\n\n\nYou should see an output like this:<\/p>\n\n\n\n
AlmaLinux release 9.2 (Turquoise Kodkod)<\/pre>\n\n\n\nIn this article, we are using ‘root’ to execute the shell commands. If you want to use your regular user with sudo privileges to run the commands, make sure to append ‘sudo’ in front of the commands.<\/p>\n\n\n\n
<\/span>Step 2. Install Bind<\/span><\/h2>\n\n\n\nExecute the following command to install Bind 9 on your AlmaLinux 9 from its default repository. Bind 9 is the most recent version, while Bind 10 is the obsolete project.<\/p>\n\n\n\n
# dnf update\n# dnf install bind bind-utils<\/pre>\n\n\n\nOnce installed, we can check the Bind version information.<\/p>\n\n\n\n
# named -v<\/pre>\n\n\n\nSample output:<\/p>\n\n\n\n
BIND 9.16.23-RH (Extended Support Version)<\/pre>\n\n\n\nTo check the Bind version number and build options, execute this command<\/p>\n\n\n\n
# named -V<\/pre>\n\n\n\nIt will show you an output similar to this:<\/p>\n\n\n\n
BIND 9.16.23-RH (Extended Support Version)\nrunning on Linux x86_64 5.14.0-284.11.1.el9_2.x86_64 #1 SMP PREEMPT_DYNAMIC Tue May 9 05:49:00 EDT 2023\nbuilt by make with '--build=x86_64-redhat-linux-gnu' '--host=x86_64-redhat-linux-gnu' '--program-prefix=' '--disable-dependency-tracking' '--prefix=\/usr' '--exec-prefix=\/usr' '--bindir=\/usr\/bin' '--sbindir=\/usr\/sbin' '--sysconfdir=\/etc' '--datadir=\/usr\/share' '--includedir=\/usr\/include' '--libdir=\/usr\/lib64' '--libexecdir=\/usr\/libexec' '--sharedstatedir=\/var\/lib' '--mandir=\/usr\/share\/man' '--infodir=\/usr\/share\/info' '--with-python=\/usr\/bin\/python3' '--with-libtool' '--localstatedir=\/var' '--with-pic' '--disable-static' '--includedir=\/usr\/include\/bind9' '--with-tuning=large' '--with-libidn2' '--with-maxminddb' '--with-dlopen=yes' '--with-gssapi=yes' '--with-lmdb=yes' '--without-libjson' '--with-json-c' '--enable-dnstap' '--enable-fixed-rrset' '--enable-full-report' 'build_alias=x86_64-redhat-linux-gnu' 'host_alias=x86_64-redhat-linux-gnu' 'CC=gcc' 'CFLAGS= -O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -specs=\/usr\/lib\/rpm\/redhat\/redhat-hardened-cc1 -fstack-protector-strong -specs=\/usr\/lib\/rpm\/redhat\/redhat-annobin-cc1 -m64 -march=x86-64-v2 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection' 'LDFLAGS=-Wl,-z,relro -Wl,--as-needed -Wl,-z,now -specs=\/usr\/lib\/rpm\/redhat\/redhat-hardened-ld -specs=\/usr\/lib\/rpm\/redhat\/redhat-annobin-cc1 ' 'LT_SYS_LIBRARY_PATH=\/usr\/lib64:' 'PKG_CONFIG_PATH=:\/usr\/lib64\/pkgconfig:\/usr\/share\/pkgconfig'\ncompiled by GCC 11.3.1 20221121 (Red Hat 11.3.1-4)\ncompiled with OpenSSL version: OpenSSL 3.0.1 14 Dec 2021\nlinked to OpenSSL version: OpenSSL 3.0.7 1 Nov 2022\ncompiled with libuv version: 1.42.0\nlinked to libuv version: 1.42.0\ncompiled with libxml2 version: 2.9.13\nlinked to libxml2 version: 20913\ncompiled with json-c version: 0.14\nlinked to json-c version: 0.14\ncompiled with zlib version: 1.2.11\nlinked to zlib version: 1.2.11\nlinked to maxminddb version: 1.5.2\ncompiled with protobuf-c version: 1.3.3\nlinked to protobuf-c version: 1.3.3\nthreads support is enabled\n\ndefault paths:\nnamed configuration: \/etc\/named.conf\nrndc configuration: \/etc\/rndc.conf\nDNSSEC root key: \/etc\/bind.keys\nnsupdate session key: \/var\/run\/named\/session.key\nnamed PID file: \/var\/run\/named\/named.pid\nnamed lock file: \/var\/run\/named\/named.lock\ngeoip-directory: \/usr\/share\/GeoIP<\/pre>\n\n\n\n<\/p>\n\n\n\n
Bind has been installed at this point, but it’s not automatically running. Let’s run this command to start Bind and configure it to run automatically upon reboot.<\/p>\n\n\n\n
# systemctl enable --now named<\/pre>\n\n\n\n<\/span>Step 3. Configure Bind<\/span><\/h2>\n\n\n\nBy default, the BIND9 server on CentOS\/RHEL offers recursive functionality exclusively for the localhost. External requests will be rejected. Modify the main configuration file of BIND, located at \/etc\/named.conf.<\/p>\n\n\n\n
# nano \/etc\/named.conf<\/pre>\n\n\n\nFind these two lines<\/p>\n\n\n\n
listen-on port 53 { 127.0.0.1; };\n listen-on-v6 port 53 { ::1; };<\/code><\/pre>\n\n\n\nThen, comment on them, and it should look like these<\/p>\n\n\n\n
#listen-on port 53 { 127.0.0.1; };\n#listen-on-v6 port 53 { ::1; };<\/pre>\n\n\n\nYou can also modify this line<\/p>\n\n\n\n
allow-query { localhost; };<\/pre>\n\n\n\nTo something like this<\/p>\n\n\n\n
allow-query { localhost; 192.168.0.0\/24; 10.10.10.0\/24; };<\/pre>\n\n\n\nOr, if you want to make some tests before allowing specific IP ranges, simply comment on the lines; it should be like this:<\/p>\n\n\n\n
#allow-query { localhost; };<\/pre>\n\n\n\nSave the file, then exit and restart Bind.<\/p>\n\n\n\n
# systemctl restart named<\/pre>\n\n\n\nNow, the Bind service is listening to your server’s interfaces, not only localhost.<\/p>\n\n\n\n
<\/span>Step 4. Create Zones<\/span><\/h2>\n\n\n\nAppend the following lines while modifying the domain name as per your needs at the end of the document.<\/p>\n\n\n\n
zone \"yourdomain.com\" {\n type master;\n file \"\/var\/named\/yourdomain.com\";\n};<\/pre>\n\n\n\nSave the file, then exit<\/p>\n\n\n\n
Now create a BIND zone configuration file \/var\/named\/yourdomain.com<\/p>\n\n\n\n
# nano \/var\/named\/yourdomain.com<\/pre>\n\n\n\nThen add these lines.<\/p>\n\n\n\n
$TTL 1d\n@ IN SOA dns1.yourdomain.com. hostmaster.yourdomain.com. (\n 1 ; serial\n 6h ; refresh after 6 hours\n 1h ; retry after 1 hour\n 1w ; expire after 1 week\n 1d ) ; minimum TTL of 1 day\n\n\n@ IN NS ns1.yourdomain.com.\n@\t\t\t\tIN \t\tNS \t\tns2.yourdomain.com.\n\nns1 IN A 192.168.0.1\nns2\t\t\t\tIN A 192.168.0.1\n\nyourdomain.com. IN MX 0 mail.yourdomain.com.\nmail IN A 192.168.0.1\nwww IN CNAME yourdomain.com.\nblog IN A 192.168.0.1<\/pre>\n\n\n\nSave the file, then exit.<\/p>\n\n\n\n
Please ensure that you always include a dot at the end of the domain name when using it in the zone file. You have the flexibility to modify or add the records as per your requirements using the provided template.<\/p>\n\n\n\n
This line signifies:<\/p>\n\n\n\n
@ \u2013 The domain mentioned in the named.conf.local file, which is yourdomain.com, will be substituted here.
IN \u2013 Records of INTERNET type in this case.
SOA \u2013 This is the Start Of Authority record, which is the authoritative record for this domain.
ns1.yourdomain.com. \u2013 The nameserver DNS record. \u2013 The server that handles the domain's DNS.
hostmaster.yourdomain.com. \u2013 The email address of the nameserver's manager. The @ symbol is replaced with a dot.<\/pre>\n\n\n\nYou can add more zones and follow the steps above, and note that every time you modify Bind configuration files, make sure to execute this command:<\/p>\n\n\n\n
# named-checkconf<\/pre>\n\n\n\nIf there is no message after executing the command, then the configuration is okay, and we can restart the Bind service.<\/p>\n\n\n\n
# systemctl restart named<\/pre>\n\n\n\nAt this point, you should be able to use your server as the DNS server. For example, we can try to query mail.yourdomain.com<\/p>\n\n\n\n
# dig mail.yourdomain.com @127.0.0.1<\/pre>\n\n\n\nThe command above will return an output like this:<\/p>\n\n\n\n
; <<>> DiG 9.16.23-RH <<>> mail.yourdomain.com @127.0.0.1\n;; global options: +cmd\n;; Got answer:\n;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 933\n;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1\n\n;; OPT PSEUDOSECTION:\n; EDNS: version: 0, flags:; udp: 1232\n; COOKIE: 86b765bc5dc202110100000064a7606f61c60bf02ed52508 (good)\n;; QUESTION SECTION:\n;mail.yourdomain.com. IN A\n\n;; ANSWER SECTION:\nmail.yourdomain.com. 86400 IN A 192.168.0.1\n\n;; Query time: 2 msec\n;; SERVER: 127.0.0.1#53(127.0.0.1)\n;; WHEN: Thu Jul 06 19:46:39 CDT 2023\n;; MSG SIZE rcvd: 92<\/pre>\n\n\n\n<\/p>\n\n\n\n
As you can see, mail.yourdomain.com is pointing to 192.168.0.1<\/p>\n\n\n\n