Week 3, Day 3 — BIND9 & Forward Zone

BIND9 config hierarchy, zone file syntax, the trailing dot rule, record types

Part 1 — BIND9 config file hierarchy (8 min)

• All configuration lives in /etc/bind/. The entry point is named.conf — it does nothing itself except include three other files:
  named.conf.options — global daemon behaviour: directory (cache location), forwarders (where to send unresolvable queries), allow-query (who can query), recursion (whether to resolve on behalf of clients), dnssec-validation.
  named.conf.local — where we add our own zone declarations. Everything we configure this week goes here.
  named.conf.default-zones — built-in zones (localhost, root hints). Touch this carefully.
• Two validation tools: named-checkconf — validates the syntax of all named.conf files. named-checkzone zonename file — validates a specific zone database file. Always run both before restarting BIND. A BIND daemon that fails to start due to a syntax error stops answering all DNS queries — validation prevents outages.

Part 2 — Zone declaration in named.conf.local (5 min)

• A zone declaration tells BIND: "I am authoritative for this zone, and the database is in this file":
  zone "yourname.net" {
type primary;
notify no;
allow-query { any; };
file "/etc/bind/db.yourname.net";
};
  Note: use type primary — the older type master still works in BIND9 but is deprecated. Current best practice is primary and secondary.

Part 3 — Zone database file anatomy (12 min)

• Walk through each element of a zone database file — write it on the board as you explain:
  $TTL 2D — default time-to-live for records in this zone. 2D = 3 days. Clients cache records for this duration before re-querying.
  @ IN SOA s1.yourname.net. hostmaster.yourname.net. ( — Start of Authority record. @ represents the zone origin (yourname.net). The SOA lists the primary nameserver and admin email (in dotted form — the first dot is an @). Five numbers inside the parentheses:
    2024112101 — serial number. Convention: YYYYMMDDNN (date + two-digit revision). Increment every time the zone changes. Secondary servers only transfer if our serial is higher than theirs.
    3600 — refresh. How often a secondary checks for serial changes (1 hour).
    3600 — retry. How long a secondary waits before retrying a failed refresh (1 hour).
    3600 — expire. How long a secondary serves stale data if the primary is unreachable (1 hour — normally this would be days).
    3600 — minimum/negative cache TTL. How long a "name doesn't exist" response is cached.
  @ NS s1 — Name Server record: s1 (which expands to s1.yourname.net) is the authoritative nameserver.
  s1 A 192.168.50.1 — A record mapping s1 → IP.
• The trailing dot rule — write this large on the board:
  In a zone file for yourname.net:
  · s1 — relative name — BIND appends the zone name → s1.yourname.net ✓
  · s1.yourname.net. — absolute FQDN (trailing dot) — used exactly as written ✓
  · s1.yourname.net — no trailing dot — BIND appends zone → s1.yourname.net.yourname.net ✗
  Rule: if you write a fully qualified name (with dots), always add a trailing dot. If you write a short label, don't add any dots. Never write a partial FQDN without the trailing dot.
• Other record types briefly:
  CNAME — canonical name alias: www CNAME s1 → www.yourname.net resolves to whatever s1 resolves to.
  MX — mail exchanger: @ MX 10 mail.yourname.net. → mail for yourname.net goes to mail.yourname.net.
  AAAA — IPv6 address record. Same as A but for IPv6.
  PTR — pointer record for reverse lookups. Covered tomorrow.

Part 4 — Point systemd-resolved at S1 (5 min)

• Ubuntu uses systemd-resolved as a local resolver. To make S1 and S2 use our new DNS server, edit /etc/systemd/resolved.conf on each server and add under [Resolve]: DNS=192.168.50.1. Restart: sudo systemctl restart systemd-resolved. Verify: resolvectl status.