User Tools

Site Tools



Originally the Domain Register took care of any DNS entries relating to the Domain selected -

To setup Bind9 locally:

 apt-get install bind9

This should install and work ok. Note: Firewall rules are required. See Firewall section. In order to start using bind locally, edit /etc/resolv.conf


(The “search” allows you to ping/access subdomain names without typing in the entire address. I.E. ping www will ping )<br> Restart bind: - /etc/init.d/bind9 restart

Test and ping google etc. Bind should be resolving internet addresses. If not - Check Firewall.

Configing Bind (version 9):

Check to see if the following is referenced in /etc/bind/named.conf

 include "/etc/bind/named.conf.local"; is in /etc/bind/named.conf

Edit the following file:

 vi /etc/bind/named.conf.local
 //This file contains all local and changable info.
 //Begin File - by creating the following entry:
 //----------- Begin ------------
 zone "" {
        type master;
        file "/etc/bind/zones/";
        allow-transfer {; };   ; Note this line is only for a secondary nameserver, allowing for zone transfer.
 //The next is the reverse DNS entry.
 zone "" {
         type master;
         file "/etc/bind/zones/136.201.1.db";
 //------------ End of ----------

Create the file:

 vi /etc/bind/zones/
 //Begin file --------------------------------
 $TTL 3h
 @       IN      SOA    (
                 2006120702      ; counter/ Serial    ; in the format YYYYMMDDCC where CC - counter 1 to 99
                 20m             ; refresh
                 15m             ; Retry Interval
                 1w              ; Expire
                 1h )            ; Negative Cache TTL 
         IN      NS        ; must the name of the name server used to register
 ;        IN      NS      ns1.secondary nameserver.  ; A semi-colon is used to comment out lines in bind configs.
         IN      MX      10
 ns      IN      A
 mail    IN      A
 wiki    IN      A
 monitor IN      A
 www     IN      A
 @       IN      A   ; the @ is for the no www name. E.g. (without www's)
 www.portal      IN      A
 //End file ------------------------------------

Create Reverse DNS lookup file: This is just for reverse DNS lookups. Reverse DNS entries also have to be made with your ISP - as reverse DNS entries come from them.

 vi /etc/bind/zones/136.201.1.db
 //Start of file -------------------------
 @       IN      SOA (
                 3       ; counter/ Serial
                 15m     ; refresh
                 15m     ; Retry Interval
                 1w      ; Expire
                 1h )    ; Negative Cache TTL
         IN      NS
 250     IN      PTR
 //End of file ---------------------------

Start bind and Test:

 /etc/init.d/bind start
 tail /var/log/daemon.log
 Test with dig, nslookup and ping.
 To test with nslookup, at the prompt type in "set type=mx" to query mx records. Similiarly, "set type=A" for A records.
 Go to and carryout a DNS report.

If you don't have bind installed you wont have nslookup and you'll get:

 -bash: nslookup: command not found

To solve this:

 apt-get install dnsutils

Setting up A Secondary DNS

Having a secondary DNS is very important, especially if your services (web,mail,db etc) are running off different boxes. The www could be up, but if DNS goes down - no www traffic :-(

There is very little to setting up a secondary dns entry/server. It takes care of everything, e.g. updating etc. from master to slave itself.

Config Master To setup the master (main or primary DNS server) the following must be added:

 vi /etc/bind/zones/
 allow-transfer {; };
 //where the above ip is the secondary dns server's.

Config Slave Of course bind will have to be installed and it could be perhaps serving out dns for another domain! Edit the following file:

 vi /etc/bind/named.conf.local
 //add the following lines:
 zone "" {
         type slave;
         file "/etc/bind/slaves/";
         masters {; };
         allow-transfer {; };

The /etc/bind/slaves directory must be created, and also bind must be given permission to write to this slaves directory. This is because bind runs as user bind - and can only edit files it owns, or if the directory is chmod'd 775.

 mkdir /etc/bind/slaves
 chown bind:bind /etc/bind/slaves
 //I chose to change ownership of this file rather than chmod it 775.

The allow-transfer should be included even for the slave zone files, otherwise anyone could do a zone transfer and lookup all your sub domains. See: Prevent_DNS_lookup_of_sub_domains

Thats it! Secondary DNS setup. Restart/reload bind on both servers. Check /var/log/daemon.log for updates' Check also after the slave updates from the master. The slave will place dns files in /etc/bind/slaves/

bind slave error: permission denied

On a Ubuntu box, I was getting:

 bind dumping master file: /etc/bind/zones/slaves/: open: permission denied


 vi /etc/apparmor.d/usr.sbin.named
 #add in:
   /etc/bind/zones/slaves/** rw,

Slow DNS lookup issues with bind9

If ping or netstat etc. takes a long time to return an ip - there is a problem. Carry out the following test:


Identify the time taken. Try the same test on a different computer (your local one etc.). If it takes 2000+ msec (milliseconds) this is poor. After looking at problems found here: and I realised bind9 was doing a lookup via ipv6. Although ipv6 is enabled in my default debian install, there is no ipv6 network. Bind9 however does a lookup over ipv6 first, then times out and tries ipv4.

Solutions: Disable ipv6 on Debian Sarge, or Disable ipv6 bind lookup, or use a different dns server for lookups.

It is difficult to cleanly disable ipv6 on Sarge, requiring reboot and trial and error. <br> In order to Disable ipv6 lookup on bind9 with Debian Sarge - a recompile is required. If you are using debian packages (like me) this is not ideal. <br> The default bind9 that ships with Debian Etch (9.3.2-P1.0-1) can easily be configured to use ipv4 by:

 vi /etc/default/bind9
 OPTIONS="-4 -u bind"
 //-4 = to use ipv4 only.
As I was using Debian Sarge, and wanted a quick solution to my DNS lookup times, I decided to use my ISP dns server *only* for lookups. This entry is in /etc/resolv.conf and I put the following syntax:

Bind will still serve out all domain names when requested. The above simply uses the ISP's dns server for lookups on the server.

Solving Problems, Failings and Warnings from DNS report by

Open DNS servers fail warnings

Typically bind will allow any other server/ip to query it and use it as a DNS server for its queries. Therefore - a foreign server could be doing a dns lookup for hundreds of domains etc. and may overload your dns server! Here is how to solve this:

 vi /etc/bind/named.conf.options
 //put the following as the very first line (note the ip of secondary dns server):
 acl recurseallow {;;; };
 //at the bottom of the same file put:
         //recursion no;
        allow-recursion { recurseallow; };

Debian squeeze by default will only allow localhost and localnets to perform dns lookups. To allow a particular IP or IP range to carry out dns lookups with your dns server, you need to add the following:

 vi /etc/bind/named.conf.options
 options {
        directory "/var/cache/bind";
        // If there is a firewall between you and nameservers you want
        // to talk to, you may need to fix the firewall to allow multiple
        auth-nxdomain no;    # conform to RFC1035
        listen-on-v6 { any; };
        allow-recursion { ip.address.range/26;; ip.address; };


 #On fedora, its a little different due to how the named options are stored. Here is the config:
 vi /etc/named.conf
 options {
        pid-file "/var/named/chroot/var/run/named/";
        directory "/var/named/chroot/var/named";
        auth-nxdomain no;
        //The following it to have a closed DNS Server.
        allow-recursion { localhost; };
 // a caching only nameserver config
 zone "." {.................

Thats it. You now have a closed DNS server.

Old Config Example and Other Information

Make the following file: - /etc/bind/

     $TTL 3h
     @       IN      SOA (
                          2006100659         ; Serial (A simple Counter to Increment after changing this file. eg. timestamp)
                                 15m         ; Refresh
                                 15m         ; Retry
                                  1w         ; Expire
                                  1h )       ; Default TTL
                MX      10
     ;Main domains
     ns 	A
     wiki	A
     mail	A
     mrtg	A
     www 	A
     misc	A
     lists      A
     ;Sub Mail domains
     lists      MX      5 lists

To Flush all DNS entries from CACHE ->

 rndc flush

To Efficiently RELOAD DNS after adding a DNS entry ->

 rndc reload   <nowiki>//</nowiki>use this instead of reloading all of bind
 rndc reload   <nowiki>//</nowiki>use this to reload just the config file

Prevent DNS lookup of sub domains

The “host” utility, which is default with debian, will attempt to perform a zone transfer in order to look at all of the sub domains! The syntax is:

 host -l ip.of.their.ns.server
 #to find all of the authorative ns servers do the following:
 > set type=ns

Another tool to do domain lookups is:

 dig -t axfr

Typically it is an oversight which allows the above, especially on secondary ns's. The following line needs to be added to the slave dns entries:

 vi /etc/bind/named.conf.local
 #add the following for each slave zone, including the master ip address for example.
 allow-transfer {; };

DNS - Config Used:

DNS - Basic Config:

DNS - Linux DNS Server VIDEO TUTORIAL - Explains all pieces:

dns_-_bind9.txt · Last modified: 2022/07/19 23:57 by admin