<\/span><\/h2>\nSet BIND to IPv4 mode, we will do that by editing the “\/etc\/default\/bind9” file and adding “-4” to the OPTIONS variable:<\/p>\n
# sudo nano \/etc\/default\/bind9<\/pre>\nThe edited file should look something like this:<\/p>\n
# run resolvconf?\r\nRESOLVCONF=no\r\n\r\n# startup options for the server\r\nOPTIONS=\"-4 -u bind\"\r\n<\/pre>\nNow let’s configure ns1, our primary DNS server.<\/p>\n
<\/span>4. Configuring the Primary DNS Server<\/span><\/h2>\nEdit the named.conf.options file:<\/p>\n
# sudo nano \/etc\/bind\/named.conf.options<\/pre>\nOn top of the options block, add a new block called trusted.This list will allow the clients specified in it to send recursive DNS queries to our primary server:<\/p>\n
acl \"trusted\" {\r\n 10.20.30.13; \r\n 10.20.30.14;\r\n 10.20.55.154;\r\n 10.20.55.155;\r\n};\r\n<\/pre>\n<\/span>5. Enable recursive queries\u00a0on our ns1 server, and have the server listen on our private network<\/span><\/h2>\nThen we will add a couple of configuration settings to enable recursive queries on our ns1 server and to have the server listen on our private network, add the configuration settings under the directory “\/var\/cache\/bind” directive like in the example below:<\/p>\n
options {\r\n directory \"\/var\/cache\/bind\";\r\n\r\n recursion yes;\r\n allow-recursion { trusted; };\r\n listen-on { 10.20.30.13; };\r\n allow-transfer { none; };\r\n\r\n forwarders {\r\n 8.8.8.8;\r\n 8.8.4.4;\r\n };\r\n};\r\n<\/pre>\nIf the “listen-on-v6” directive is present in the named.conf.options file, delete it as we want BIND to listen only on IPv4.
\nNow on ns1, open the named.conf.local file for editing:<\/p>\n
# sudo nano \/etc\/bind\/named.conf.local<\/pre>\nHere we are going to add the forward zone:<\/p>\n
zone \"test.example.com\" {\r\n type master;\r\n file \"\/etc\/bind\/zones\/db.test.example.com\";\r\n allow-transfer { 10.20.30.14; };\r\n};\r\n<\/pre>\nOur private subnet is 10.20.0.0\/16, so we are going to add the reverse zone with the following lines:<\/p>\n
zone \"20.10.in-addr.arpa\" {\r\n type master;\r\n file \"\/etc\/bind\/zones\/db.10.20\";\r\n allow-transfer { 10.20.30.14; };\r\n};\r\n<\/pre>\nIf your servers are in multiple private subnets in the same physical location, you need to specify a zone and create a separate zone file for each subnet.<\/p>\n
<\/span>6. Creating the Forward Zone File<\/span><\/h2>\nNow we’ll create the directory where we will store our zone files in:<\/p>\n
# sudo mkdir \/etc\/bind\/zones<\/pre>\nWe will use the sample db.local file to make our forward zone file, let’s copy the file first:<\/p>\n
# cd \/etc\/bind\/zones\r\n# sudo cp ..\/db.local .\/db.test.example.com\r\n<\/pre>\nNow edit the forward zone file we just copied:<\/p>\n
# sudo nano \/etc\/bind\/zones\/db.test.example.com<\/pre>\nIt should look something like the example below:<\/p>\n
$TTL 604800\r\n@ IN SOA localhost. root.localhost. (\r\n 2 ; Serial\r\n 604800 ; Refresh\r\n 86400 ; Retry\r\n 2419200 ; Expire\r\n 604800 ) ; Negative Cache TTL\r\n;\r\n@ IN NS localhost. ; delete this\r\n@ IN A 127.0.0.1 ; delete this\r\n@ IN AAAA ::1 ; delete this\r\n<\/pre>\nNow let’s edit the SOA record. Replace localhost with your ns1 server’s FQDN, then replace “root.localhost” with “admin.test.example.com”.Every time you edit the zone file, increment the serial value before you restart named otherwise BIND won’t apply the change to the zone, we will increment the value to “3”, it should look something like this:<\/p>\n
@ IN SOA ns1.test.example.com. admin.test.example.com. (\r\n 3 ; Serial\r\n<\/pre>\nThen delete the last three records that are marked with “delete this” after the SOA record.<\/p>\n
Add the nameserver records at the end of the file:<\/p>\n
; name servers - NS records\r\n IN NS ns1.test.example.com.\r\n IN NS ns2.test.example.com.\r\n<\/pre>\nAfter that add the A records for the hosts that need to be in this zone. That means any server whose name we want to end with “.test.example.com”:<\/p>\n
; name servers - A records\r\nns1.test.example.com. IN A 10.20.30.13\r\nns2.test.example.com. IN A 10.20.30.14\r\n\r\n; 10.20.0.0\/16 - A records\r\nhost1.test.example.com. IN A 10.20.55.154\r\nhost2.test.example.com. IN A 10.20.55.155\r\n<\/pre>\nThe db.test.example.com file should look something like the following:<\/p>\n
$TTL 604800\r\n@ IN SOA ns1.test.example.com. admin.test.example.com. (\r\n 3 ; Serial\r\n 604800 ; Refresh\r\n 86400 ; Retry\r\n 2419200 ; Expire\r\n 604800 ) ; Negative Cache TTL\r\n;\r\n; name servers - NS records\r\n IN NS ns1.test.example.com.\r\n IN NS ns2.test.example.com.\r\n\r\n; name servers - A records\r\nns1.test.example.com. IN A 10.20.30.13\r\nns2.test.example.com. IN A 10.20.30.14\r\n\r\n; 10.20.0.0\/16 - A records\r\nhost1.test.example.com. IN A 10.20.55.154\r\nhost2.test.example.com. IN A 10.20.55.155\r\n<\/pre>\n<\/span>7. Creating the Reverse Zone File<\/span><\/h2>\nWe specify the PTR records for reverse DNS lookups in the reverse zone files. When the DNS server receives a PTR lookup query for an example for IP: “10.20.55.154”, it will check the reverse zone file to retrieve the FQDN of the IP address, in our case that would be “host1.test.example.com”.<\/p>\n
We will create a reverse zone file for every single reverse zone specified in the named.conf.local file we created on ns1. We will use the sample db.127 zone file to create our reverse zone file:<\/p>\n
# cd \/etc\/bind\/zones\r\n# sudo cp ..\/db.127 .\/db.10.20\r\n<\/pre>\nEdit the reverse zone file so it matches the reverse zone defined in named.conf.local:<\/p>\n
# sudo nano \/etc\/bind\/zones\/db.10.20<\/pre>\nThe original file should look something like the following:<\/p>\n
$TTL 604800\r\n@ IN SOA localhost. root.localhost. (\r\n 1 ; Serial\r\n 604800 ; Refresh\r\n 86400 ; Retry\r\n 2419200 ; Expire\r\n 604800 ) ; Negative Cache TTL\r\n;\r\n@ IN NS localhost. ; delete this\r\n1.0.0 IN PTR localhost. ; delete this\r\n<\/pre>\nYou should modify the SOA record and increment the serial value. It should look something like this:<\/p>\n
@ IN SOA ns1.test.example.com. admin.test.example.com. (\r\n 3 ; Serial\r\n<\/pre>\nThen delete the last three records that are marked with “delete this” after the SOA record.<\/p>\n
Add the nameserver records at the end of the file:<\/p>\n
; name servers - NS records\r\n IN NS ns1.test.example.com.\r\n IN NS ns2.test.example.com.\r\n<\/pre>\nNow add the PTR records for all hosts that are on the same subnet in the zone file you created. This consists of our hosts that are on the 10.20.0.0\/16 subnet. In the first column we reverse the order of the last two octets from the IP address of the host we want to add:<\/p>\n
; PTR Records\r\n13.30 IN PTR ns1.test.example.com. ; 10.20.30.13\r\n14.30 IN PTR ns2.test.example.com. ; 10.20.30.14\r\n154.55 IN PTR host1.test.example.com. ; 10.20.55.154\r\n155.55 IN PTR host2.test.example.com. ; 10.20.55.155\r\n<\/pre>\nSave and exit the reverse zone file.<\/p>\n
The “\/etc\/bind\/zones\/db.10.20” reverse zone file should look something like this:<\/p>\n
$TTL 604800\r\n@ IN SOA test.example.com. admin.test.example.com. (\r\n 3 ; Serial\r\n 604800 ; Refresh\r\n 86400 ; Retry\r\n 2419200 ; Expire\r\n 604800 ) ; Negative Cache TTL\r\n; name servers\r\n IN NS ns1.test.example.com.\r\n IN NS ns2.test.example.com.\r\n\r\n; PTR Records\r\n13.30 IN PTR ns1.test.example.com. ; 10.20.30.13\r\n14.30 IN PTR ns2.test.example.com. ; 10.20.30.14\r\n154.55 IN PTR host1.test.example.com. ; 10.20.55.154\r\n155.55 IN PTR host2.test.example.com. ; 10.20.55.155\r\n<\/pre>\n<\/span>8. Check the Configuration Files<\/span><\/h2>\nUse the following command to check the configuration syntax of all the named.conf files that we configured:<\/p>\n
# sudo named-checkconf<\/pre>\nIf your configuration files don’t have any syntax problems, the output will not contain any error messages. However if you do have problems with your configuration files, compare the settings in the “Configuring the Primary DNS Server” section with the files you have errors in and make the correct adjustment, then you can try executing the named-checkconf command again.<\/p>\n
The named-checkzone can be used to check the proper configuration of your zone files.You can use the following command to check the forward zone “test.example.com”:<\/p>\n
# sudo named-checkzone test.example.com db.test.example.com<\/pre>\nAnd if you want to check the reverse zone configuration, execute the following command:<\/p>\n
# sudo named-checkzone 20.10.in-addr.arpa \/etc\/bind\/zones\/db.10.20<\/pre>\nOnce you have properly configured all the configuration and zone files, restart the BIND service:<\/p>\n
# sudo service bind9 restart<\/pre>\n<\/span>9. Configuring the Secondary DNS Server<\/span><\/h2>\nSetting up a secondary DNS server is always a good idea as it will serve as a failover and will respond to queries if the primary server is unresponsive.<\/p>\n
On ns2, edit the named.conf.options file:<\/p>\n
# sudo nano \/etc\/bind\/named.conf.options<\/pre>\nAt the top of the file, add the ACL with the private IP addresses for all your trusted servers:<\/p>\n
acl \"trusted\" {\r\n 10.20.30.13;\r\n 10.20.30.14;\r\n 10.128.100.101;\r\n 10.128.200.102;\r\n};\r\n<\/pre>\nJust like in the named.conf.options file for ns2, add the following lines under the directory “\/var\/cache\/bind” directive:<\/p>\n
recursion yes;\r\n allow-recursion { trusted; };\r\n listen-on { 10.20.30.13; };\r\n allow-transfer { none; };\r\n\r\n forwarders {\r\n 8.8.8.8;\r\n 8.8.4.4;\r\n };\r\n<\/pre>\nSave and exit the file.<\/p>\n
Now open the named.conf.local file for editing:<\/p>\n
# sudo nano \/etc\/bind\/named.conf.local<\/pre>\nNow we should specify slave zones that match the master zones on the ns1 DNS server. The masters directive should be set to the ns1 DNS server’s private IP address:<\/p>\n
zone \"test.example.com\" {\r\n type slave;\r\n file \"slaves\/db.test.example.com\";\r\n masters { 10.20.30.13; };\r\n};\r\n\r\nzone \"20.10.in-addr.arpa\" {\r\n type slave;\r\n file \"slaves\/db.10.20\";\r\n masters { 10.20.30.13; };\r\n};\r\n<\/pre>\nNow save and exit the file.<\/p>\n
Use the following command to check the syntax of the configuration files:<\/p>\n
# sudo named-checkconf<\/pre>\nThen restart the BIND service:<\/p>\n
# sudo service bind9 restart<\/pre>\n