DNS

First, install the bind9 package. Then, navigate to /etc/bind/, and edit named.conf. Comment out any existing lines, and add the following contents. The listen-on addresses must be the DN42 IPs of the server to prevent conflicts with the systemd-resolved stub listener. The allow-recursion block should contain the ranges of the local network, otherwise BIND can be used as an open resolver by anyone on DN42.

options {
        directory "/var/cache/bind";

        allow-recursion { <ranges>; };
        allow-query-cache { any; };
        allow-query { any; };
        allow-transfer { none; };

        dnssec-validation no;

        listen-on port 53 { <outside ip>; };
        listen-on-v6 port 53 { <outside ipv6>; };

        empty-zones-enable no;
};

logging {
	channel default_file {
		file "/var/log/named/default.log" size 5m;
		severity dynamic;
		print-time yes;
	};
};

include "/etc/bind/named.forwarders.conf";
include "/etc/bind/named.dn42.conf";

Then, create the file named.forwarders.conf, and add the contents from the DN42 Wiki for BIND forwarding. Next, edit named.dn42.conf, and add entries for each forward and reverse zone.

zone "<zone>" {
        type master;
        file "/etc/bind/zones/<zone>.zone";
};

I then created each zone file using DNSControl, a DNS automation tool (see the dnsconfig.js used to generate the BIND files for this project). Before starting Bind9, run systemctl edit bind9 and add the following contents to ensure the server IPs (specifically the IPv6 address from SLAAC) will be up when BIND tries to bind to them.

[Unit]
After=network-online.target

Then, reload systemd and enable and start the bind9/named service.