DNS

Installation

Install the bind9 package.

Before starting/enabling Bind9, run systemctl edit bind9 and add the following contents to ensure the server IPs (specifically the IPv6 address from SLAAC) will be up when BIND tries to bind to them.

[Unit]
After=network-online.target

Reload systemd to apply the change.

Configuration

Primary

Navigate to /etc/bind/, and edit named.conf. Comment out any existing lines, and add the following contents. The listen-on addresses must be the DN42 IPs of the server to prevent conflicts with the systemd-resolved stub listener. The allow-recursion block should contain the ranges of the local network, otherwise BIND can be used as an open resolver by anyone on DN42.

options {
        directory "/var/cache/bind";

        allow-recursion { <ranges>; };
        allow-query-cache { any; };
        allow-query { any; };
        allow-transfer { <secondary ips>; };

        notify yes;

        dnssec-validation no;

        listen-on port 53 { <outside ip>; };
        listen-on-v6 port 53 { <outside ipv6>; };

        empty-zones-enable no;
};

logging {
	channel default_file {
		file "/var/log/named/default.log" size 5m;
		severity dynamic;
		print-time yes;
	};
};

include "/etc/bind/named.conf.forwarders";
include "/etc/bind/named.conf.dn42";

Then, create the file named.conf.forwarders, and add the contents from the DN42 Wiki for BIND forwarding. Next, edit named.conf.dn42, and add entries for each forward and reverse zone. For reverse zones, the syntax 64/27.119.23.172.in-addr.arpa can be used, for example, to represent the reverse DNS range for 172.23.119.64/27.

zone "<zone>" {
        type master;
        file "/var/lib/bind/db.<zone>";
};

Secondary

The configuration for a secondary server is fairly similar, except:

• The allow-transfer option in named.conf should be none
• The notify option in named.conf should not be added to named.conf
• Zones in named.conf.dn42 should instead have type slave
• Zones in named.conf.dn42 should have masters { <primary ip>; }

The zone files in /var/lib/bind/ will contain a non-text format of the zone file, and should not be modified directly.

Zones

I created each zone file using DNSControl, a DNS automation tool (see the dnsconfig.js used to generate the BIND files for this project). To trigger zone updates, I made sure the serial number (generated by DNSControl to be YYYYMMDDNN where NN is a number that increments with each modification) changed. Updates could be forced by reloading the bind9 service on the primary.