Bind9 Configuration Definitions
From:       https://www.linuxbabe.com/ubuntu/set-up-authoritative-dns-server-ubuntu-18-04-bind9

What Is An Authoritative Server Control Cmds
Master DNS Server Config Slave DNS Server Config More About Zone Transfer Reverse Zone
Change NS Rcd & Make Glue Rcd Select Advanced DNS Things To Know Using Wildcard in Bind Zone Files
Enabling the Resolver Wrapping Up 




Bind9 Configuration Definitions








What’s An Authoritative DNS Server? 


An authoritative DNS server is used by domain name owners to store DNS records.
It provides authoritative answers to DNS resolvers (like 8.8.8.8 or 1.1.1.1), 
which query DNS records on behalf of end users on PC, smartphone or tablet.





Control Cmds

named -v

Sample output:
BIND 9.11.3-1ubuntu1.3-Ubuntu (Extended Support Version) 

Check the version number and build options, run
named -V

BIND version number and build option

By default, BIND automatically starts after installation. Check its status with:

systemctl status bind9

bind 9 ubuntu 18.04 server

If it’s not running, then start it with:

sudo systemctl start bind9

And enable auto start at boot time:

sudo systemctl enable named

The BIND server will run as the bind user, which is created during installation,
and listens on TCP and UDP port 53, as can be seen by running the following 
command:

sudo netstat -lnptu | grep named

ubuntu 18.04 bind9 setup

The BIND demon is called named. (demon: program that runs in background) 
named installed by the bind9 package.
rndc, remote name demon controller, installed by bind9utils package. 
rndc is used to reload/stop and control other aspects of the BIND 
demon. 
Communication is done via TCP loopback (127.0.0.1:953).

Check the status of the BIND name server.

sudo rndc status

remote name demon controller





Configuration Files

The main BIND configuration file /etc/bind/named.conf sources the settings from
 3 other files.

Out of the box, the BIND9 server on Ubuntu provides recursive service for 
localhost and local network clients. 
When setting up an authoritative DNS server, disable recursion. 
Edit the /etc/bind/named.conf.options file.

sudo nano /etc/bind/named.conf.options

Add following lines in the options {...}; clause.

// hide version number from clients for security reasons.
 version "not currently available";

 // disable recursion on authoritative DNS server.
 recursion no;

 // enable the query log
 querylog yes;

 // disallow zone transfer
 allow-transfer { none; };


bind9 authoritative dns server ubuntu 18.04 LTS

Technically speaking, you only need to add recursion no; to disable recursion, 
but it’s a good practice to add the other 3 directives. Save and close the file.
Then restart BIND.

sudo systemctl restart bind9





Master DNS Server Configuration


Pick one of the two servers as the master DNS server. We will name it 
   ns1.example.com.

The master DNS server holds the master copy of the zone file. Changes of DNS 
records are made on this server. A domain can have one or more DNS zones. Each 
DNS zone has a zone file which contains every DNS record in that zone. For 
simplicity’s sake, this article assumes that you want to use a single DNS zone 
to manage all DNS records for your domain name.





named.conf.default-zones


The /etc/bind/named.conf.default-zones file defines the root zone and localhost
zone. 
 




named.conf.local

To add a zone for your domain name, edit /etc/bind/named.conf.local file.

sudo nano /etc/bind/named.conf.local

Add the following lines to this file. Replace example.com with your own domain 
name. Replace 12.34.56.78 with the IP address of slave DNS server.

zone "example.com" {
      type master;
      file "/etc/bind/db.example.com";
      allow-query { any; };
      allow-transfer { 12.34.56.78; };
}; 

In the above configuration, we created a new zone with the zone clause and we 
specified that this is the master zone. The zone file is 
/etc/bind/db.example.com, where we will add DNS records. Zone transfer will be 
only allowed for the slave DNS server. Save and close the file.

Instead of creating a zone file from scratch, we can use a zone template file. 
Copy the content of db.empty to a new file.

sudo cp /etc/bind/db.empty /etc/bind/db.example.com

A zone file can contain 3 types of entries:


A zone file typically consists of the following types of DNS records.


Now let’s edit the zone file.

sudo nano /etc/bind/db.example.com

By default, it looks like this:


BIND9 zone transfer ubuntu

You can change it to this instead.


bind9 master zone file

Where

The first record in a zone file is the SOA (Start of Authority) record. This 
record contains the following information:

TXT records are usually enclosed in double quotes. If you add DKIM record, you 
also need to enclose the value with parentheses.

Save and close the file. Then run the following command to check if there are 
syntax errors in the main configuration file. A silent output indicates no 
errors are found.

sudo named-checkconf

Then check the syntax of zone files.

sudo named-checkzone example.com /etc/bind/db.example.com

If there are syntax errors in the zone file, you need to fix it, or this zone 
won’t be loaded. The following message indicates there are no syntax errors.

zone example.com/IN: loaded serial 2019011503
OK

Then restart BIND9.

sudo systemctl restart bind9

If you are using the uncomplicated firewall (UFW), then open TCP and 
UDP port 53.

 sudo ufw allow 53/tcp
sudo ufw allow 53/udp

If you are using iptables firewall directly, then run the following command.

sudo iptables -A INPUT -p tcp --dport 53 -j ACCEPT
sudo iptables -A INPUT -p udp --dprot 53 -j ACCEPT





Slave DNS Server Configuration


Now we use the other server as the slave DNS server, which
will be named ns2.example.com.

First, edit the named.conf.local file.

sudo nano /etc/bind/named.conf.local

Add a zone like below. Replace 12.34.56.78 with the IP address of the master 
DNS server.

zone "example.com" {
        type slave;
        file "db.example.com";
        allow-query { any; };
        masters { 12.34.56.78; };
};

In the above configuration, we specified that this is a slave DNS server for the
example.com zone and it will accept zone transfers only from a trusted IP 
address.

Save and close the file. Then run the following command to check if there are 
syntax errors in the main configuration file.

sudo named-checkconf

If no errors are found, restart BIND9.

sudo systemctl restart bind9

The zone file on slave DNS server are loaded from a zone transfer, which is used
to synchronize DNS record changes from master DNS server to slave DNS server. 
After BIND9 restarts, zone tranfer will start immediately. Check the BIND9 log 
with the following command.

sudo journalctl -eu bind9

You can see messages like below, which indicates the zone transfer is successful.


named[31518]: transfer of 'example.com/IN' from 12.34.56.78#53: Transfer 
completed: 1 messages, 16 records, 886 bytes, 0.004 secs (221500 bytes/sec)


The zone file will be save as /var/cache/bind/db.example.com.

If you are using the uncomplicated firewall (UFW), then open TCP and UDP port 53.

sudo ufw allow 53/tcp
sudo ufw allow 53/udp

If you are using iptables firewall directly, then run the following command.

 sudo iptables -A INPUT -p tcp --dport 53 -j ACCEPT
sudo iptables -A INPUT -p udp --dport 53 -j ACCEPT





More about Zone Transfer 


The slave DNS server will contact the master again when the refresh time in SOA
record is reached and if the serial number on the master is greater than that 
on the slave, a zone transfer will be initiated. There are two types of zone 
transfers: