Linux bind Beginner AlmaLinux Red Hat Enterprise Linux Rocky Linux

Nameserver basics

The basic configuration for nameserver.

Created 13.10.2026 by ffasel · updated 14.10.2026

Bookmark

Use at your own risk. Please never just copy and run commands from the internet – including the ones on this page. Disclaimer

Download complete script Download script and files

Introduction

In this tutorial, we will install and configure a basic BIND (Berkeley Internet Name Domain) DNS server on AlmaLinux 10 or Red Hat Enterprise Linux (RHEL) 10.

BIND is an open-source DNS server implementation that allows computers to resolve domain names into IP addresses and vice versa.

We will configure BIND as an authoritative DNS server for the internal domain test.lab and as a recursive caching DNS resolver for clients on the local network.

Steps

Install BIND and the required DNS utilities.
Understand the BIND configuration files.
Configure the BIND DNS server.
Create a forward DNS zone.
Create a reverse DNS zone.
Set file permissions and SELinux contexts.
Validate the BIND configuration and zone files.
Configure the firewall to allow DNS traffic.
Start and enable the BIND service.
Test forward, reverse, and external DNS resolution.
Configure a DNS client to use the BIND server.
Troubleshoot common DNS issues.

Example network environment

Setting	Example value
DNS domain	test.lab
DNS server hostname	ns1.test.lab
DNS server IP	192.168.10.10
Network	192.168.10.0/24
Forward zone	test.lab
Reverse zone	10.168.192.in-addr.arpa
Web server	192.168.10.20
Client	192.168.10.100

All IP addresses in this tutorial are examples and should be adjusted to match your network.

How the DNS server works

flowchart TD
    A["DNS Client<br/>192.168.10.100"]
    B["BIND DNS Server<br/>ns1.test.lab<br/>192.168.10.10"]
    C["Internal DNS Zone<br/>test.lab<br/>Forward & Reverse DNS"]
    D["External DNS Resolvers<br/>1.1.1.1 / 9.9.9.9"]

    A -->|"DNS Query (Port 53)"| B
    B -->|"Internal DNS Query"| C
    B -->|"External DNS Query"| D
    C -->|"DNS Response"| B
    D -->|"DNS Response"| B
    B -->|"DNS Response"| A

    classDef client fill:#e0f2fe,stroke:#0284c7,color:#075985
    classDef server fill:#ccfbf1,stroke:#0d9488,color:#115e59
    classDef internal fill:#fef3c7,stroke:#d97706,color:#92400e
    classDef external fill:#f3e8ff,stroke:#9333ea,color:#6b21a8

    class A client
    class B server
    class C internal
    class D external

Mermaid source

flowchart TD
    A["DNS Client<br/>192.168.10.100"]
    B["BIND DNS Server<br/>ns1.test.lab<br/>192.168.10.10"]
    C["Internal DNS Zone<br/>test.lab<br/>Forward & Reverse DNS"]
    D["External DNS Resolvers<br/>1.1.1.1 / 9.9.9.9"]

    A -->|"DNS Query (Port 53)"| B
    B -->|"Internal DNS Query"| C
    B -->|"External DNS Query"| D
    C -->|"DNS Response"| B
    D -->|"DNS Response"| B
    B -->|"DNS Response"| A

    classDef client fill:#e0f2fe,stroke:#0284c7,color:#075985
    classDef server fill:#ccfbf1,stroke:#0d9488,color:#115e59
    classDef internal fill:#fef3c7,stroke:#d97706,color:#92400e
    classDef external fill:#f3e8ff,stroke:#9333ea,color:#6b21a8

    class A client
    class B server
    class C internal
    class D external

The DNS server will perform two main functions:

Authoritative DNS: The server stores DNS records for test.lab and responds directly to queries for this domain.

Recursive DNS: When a client requests an external domain, such as www.redhat.com, BIND forwards the query to an external DNS resolver or performs recursion itself.

Only trusted clients from the internal network will be allowed to use the DNS server.

Preparing the Server

Before installing BIND, verify that the system is configured correctly.

Check the operating system

Bash / Shell

cat /etc/os-release

This command displays information about the installed Linux distribution and version.

Check the IP address

Bash / Shell

ip -4 addr show

Make sure the DNS server has the correct IP address.

The server should use a static IP address because clients must always be able to reach the DNS service at the same address.

Configure the hostname

Set the hostname:

Bash / Shell

sudo hostnamectl set-hostname ns1.test.lab

Verify the hostname:

Bash / Shell

hostnamectl

Update the system

Bash / Shell

sudo dnf update -y

This installs available package updates, including security updates.

If the update installs a new kernel or other components requiring a reboot, restart the server before continuing.

Installing BIND

Install BIND and the DNS utilities:

Bash / Shell

sudo dnf install -y bind bind-utils

Package explanation

Package	Description
bind	Contains the BIND DNS server and the named daemon
bind-utils	Contains DNS tools such as dig, host, and nslookup

The DNS server service is called named, which stands for name daemon.

Verify that BIND is installed:

Bash / Shell

named -v

This displays the installed BIND version.

You can also check the installed packages:

Bash / Shell

rpm -q bind bind-utils

Understanding BIND Configuration Files

BIND uses several files and directories for its configuration.

File / Directory	Purpose
/etc/named.conf	Main BIND configuration file
/etc/named.rfc1912.zones	Additional predefined zone declarations
/var/named/	Directory containing DNS zone files
/var/named/named.ca	Root DNS server hints
/var/named/data/	Directory for certain BIND runtime data

The most important file is /etc/named.conf

This file controls how the DNS server operates, which clients can access it, and which DNS zones it manages.

The zone files contain the actual DNS records.

Back up the original configuration

Before making changes, create a backup:

Bash / Shell

sudo cp -a /etc/named.conf /etc/named.conf.bak

The -a option preserves file attributes such as permissions and timestamps.

This backup allows you to restore the original configuration if necessary.

Configuring the BIND DNS Server

Open the main BIND configuration file:

Bash / Shell

sudo vi /etc/named.conf

For this basic standalone lab, replace the contents with the following configuration.

/etc/named.conf

named.conf (1.5 KB) Download


//
// BIND DNS Server Configuration
// AlmaLinux 10 / RHEL 10
// Domain: test.lab
// DNS Server: 192.168.10.10
//

// Trusted networks
acl "trusted" {
    127.0.0.1;
    192.168.10.0/24;
};

// Global DNS server settings
options {
    directory "/var/named";

    // IPv4 listening interfaces
    listen-on port 53 {
        127.0.0.1;
        192.168.10.10;
    };

    // IPv6 listening interface
    listen-on-v6 port 53 { ::1; };

    // DNS query permissions
    allow-query { trusted; };

    // Recursive DNS resolution
    recursion yes;
    allow-recursion { trusted; };
    allow-query-cache { trusted; };

    // DNSSEC validation
    dnssec-validation auto;

    // External DNS forwarders
    forwarders {
        1.1.1.1;
        9.9.9.9;
    };

    forward first;

    // Disable zone transfers
    allow-transfer { none; };

    // BIND runtime directories
    dump-file "/var/named/data/cache_dump.db";
    statistics-file "/var/named/data/named_stats.txt";
    memstatistics-file "/var/named/data/named_mem_stats.txt";

    // Hide BIND version information
    version "not disclosed";
};

// Logging configuration
logging {
    channel default_debug {
        file "data/named.run";
        severity dynamic;
    };
};

// Root DNS hints
zone "." IN {
    type hint;
    file "named.ca";
};

// Forward DNS zone
zone "test.lab" IN {
    type primary;
    file "test.lab.zone";
    allow-update { none; };
};

// Reverse DNS zone
zone "10.168.192.in-addr.arpa" IN {
    type primary;
    file "10.168.192.rev";
    allow-update { none; };
};

This configuration defines trusted clients, DNS listening interfaces, recursion settings, forwarders, and two authoritative DNS zones.

Configuration elements

Directive	Purpose
acl	Defines trusted clients or networks
options	Contains global BIND settings
directory	Specifies the working directory
listen-on	Defines IPv4 listening addresses
listen-on-v6	Defines IPv6 listening addresses
allow-query	Controls DNS query access
recursion	Enables or disables recursive DNS resolution
allow-recursion	Restricts recursive DNS queries
allow-query-cache	Restricts access to cached DNS responses
dnssec-validation	Controls DNSSEC validation
forwarders	Specifies external DNS resolvers
forward	Controls DNS forwarding behavior
allow-transfer	Restricts DNS zone transfers
dump-file	Specifies the DNS cache dump file
statistics-file	Specifies the statistics output file
memstatistics-file	Specifies the memory statistics file
version	Controls the exposed BIND version string
logging	Configures DNS server logging
zone	Declares a DNS zone
type hint	Configures root DNS hints
type primary	Defines a primary authoritative DNS zone
file	Specifies the associated zone file
allow-update	Controls dynamic DNS updates

Creating the Forward DNS Zone

A forward DNS zone resolves hostnames to IP addresses.

Create the zone file

Bash / Shell

sudo vi /var/named/test.lab.zone

Add the following content:

/var/named/test.lab.zone

test.lab.zone (424 bytes) Download

$TTL 86400
@   IN  SOA ns1.test.lab. admin.test.lab. (
        2026101401 ; Serial
        3600       ; Refresh
        1800       ; Retry
        604800     ; Expire
        86400      ; Negative cache TTL
)

; Name server
@       IN  NS      ns1.test.lab.

; A records
ns1     IN  A       192.168.10.10
www     IN  A       192.168.10.20
client1 IN  A       192.168.10.100

; CNAME record
web     IN  CNAME   www.test.lab.

Understanding the SOA record

Every authoritative DNS zone requires a Start of Authority (SOA) record.

The SOA record defines important administrative information about the zone.

Field	Value	Description
Primary server	ns1.test.lab.	Primary authoritative DNS server
Administrator	admin.test.lab.	Represents admin@test.lab
Serial	2026101401	Zone version number
Refresh	3600	Secondary DNS refresh interval
Retry	1800	Retry interval after a failed refresh
Expire	604800	Maximum time secondary servers may use stale zone data
Negative TTL	86400	Negative response caching TTL

All timing values are specified in seconds.

The serial number must be increased whenever the zone is modified.

Creating the Reverse DNS Zone

A reverse DNS zone resolves IP addresses to hostnames using PTR records.

For the network 192.168.10.0/24, the reverse DNS zone is 10.168.192.in-addr.arpa.

Create the reverse zone file

Bash / Shell

sudo vi /var/named/10.168.192.rev

Add the following content:

/var/named/10.168.192.rev

10.168.192.in-addr.arpa (379 bytes) Download

$TTL 86400
@   IN  SOA ns1.test.lab. admin.test.lab. (
        2026101401 ; Serial
        3600       ; Refresh
        1800       ; Retry
        604800     ; Expire
        86400      ; Negative cache TTL
)

; Name server
@       IN  NS      ns1.test.lab.

; PTR records
10      IN  PTR     ns1.test.lab.
20      IN  PTR     www.test.lab.
100     IN  PTR     client1.test.lab.

A PTR record maps an IP address to a hostname.

Configuring File Permissions and SELinux

BIND needs permission to read the DNS zone files.

Bash / Shell

sudo chown root:named \
    /var/named/test.lab.zone \
    /var/named/10.168.192.rev

This sets:

root as the file owner.
named as the file group.

Set file permissions

Bash / Shell

sudo chmod 640 \
    /var/named/test.lab.zone \
    /var/named/10.168.192.rev

Configure SELinux contexts

SELinux (Security-Enhanced Linux) provides an additional security layer by controlling access to system resources.

Restore the correct SELinux contexts:

Bash / Shell

sudo restorecon -v \
    /var/named/test.lab.zone \
    /var/named/10.168.192.rev

Because the zone files are stored in /var/named/, the standard SELinux policy should allow BIND to read them.

Validating the BIND Configuration

Before starting the DNS server, check the configuration for syntax errors.

BIND provides tools for validating the main configuration and zone files.

Check the main configuration

Bash / Shell

sudo named-checkconf

This command checks the syntax of /etc/named.conf.

Check the forward zone

Bash / Shell

sudo named-checkzone \
    test.lab \
    /var/named/test.lab.zone

Check the reverse zone

Bash / Shell

sudo named-checkzone \
    10.168.192.in-addr.arpa \
    /var/named/10.168.192.rev

Configuring the Firewall

DNS uses port 53 over both UDP and TCP.

Protocol	Port	Purpose
UDP	53	Standard DNS queries
TCP	53	Large DNS responses and other DNS operations

Allow DNS traffic

Add the DNS service to the firewall configuration:

Bash / Shell

sudo firewall-cmd --permanent --add-service=dns
sudo firewall-cmd --reload

Starting and Enabling BIND

Now that the configuration and zone files are ready, enable and start the BIND service.

Bash / Shell

sudo systemctl enable --now named

Checks

Check if the DNS server is working. Check the forward and reverse zone with dig.

Bash / Shell

dig +short @192.168.10.10 www.test.lab
dig +short @192.168.10.10 -x 192.168.10.20

Sources

Official documentation from Red Hat https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/managing_networking_infrastructure_services/assembly_setting-up-and-configuring-a-bind-dns-server_networking-infrastructure-

#bind #dns #nameserver

Finished? Let others know whether this tutorial worked for you.

It worked!

Back to overview Download complete script Download script and files