Deploying Bind9 as DNS Server on Ubuntu Server

By Manny Fernandez

April 18, 2026

Deploying Bind9 as DNS Server on Ubuntu Server

In the process of deploying my lab, I needed to set up DNS services for it. I decided to use Bind 9 on my Ubuntu Server. I am going to use infosecmonkey.org as the domain for my lab. The .lab did not work out as I expected before. The idea is to allow anyone to query this server from 10.1.105.0/24, 10.1.106.0/24 and 10.240.0.0/15.

1. Assumptions and Planning

We will assume:

– Ubuntu Server 22.04/24.04, fresh or lightly used.
– Server IP (example): 10.1.106.10 (adjust to your real IP).
– Domain: infosecmonkey.org hosted authoritatively on this box.
– Networks allowed recursion:
– 10.1.106.0/24
– 10.1.105.0/24
– 10.240.0.0/15

Files we will touch (Ubuntu/Debian layout):

– /etc/bind/named.conf.options
– /etc/bind/named.conf.local
– Zone file: /etc/bind/db.infosecmonkey.org

2. Install BIND9 and Base Packages

Run these commands as root or with sudo.

sudo apt update
sudo apt install bind9 bind9-utils bind9-dnsutils -y

Enable and start the service:

sudo systemctl enable bind9
sudo systemctl start bind9
sudo systemctl status bind9

You should see active (running) in the status output.

3. Define ACLs and Recursive Options

We will configure:

– An ACL trusted for your three networks.
– BIND to listen on all interfaces.
– Recursion allowed only for trusted and localhost.

Edit /etc/bind/named.conf.options:

sudo vi /etc/bind/named.conf.options

Replace the entire file contents with this (adjust comments if you like):

acl "trusted" {
127.0.0.1; // localhost
10.1.106.0/24; // allowed subnet
10.1.105.0/24; // allowed subnet
10.240.0.0/15; // allowed subnet
};

options {
directory "/var/cache/bind";

// Listen on all IPv4/IPv6 interfaces
listen-on port 53 { any; };
listen-on-v6 port 53 { any; };

// Allow queries (authoritative + recursive) only from trusted ACL
allow-query { trusted; };
allow-recursion { trusted; };

// Disable zone transfers by default (unless you add slaves later)
allow-transfer { none; };

// Enable recursion
recursion yes;

// DNSSEC validation (recommended on modern BIND/Ubuntu)
dnssec-validation auto;
auth-nxdomain no; // conform to RFC1035
empty-zones-enable yes;

// Some sensible performance/security tuning
max-cache-size 512M;
max-cache-ttl 604800; // 7 days
max-ncache-ttl 3600; // 1 hour
minimal-responses yes;
qname-minimization relaxed;

// Hide software version
version "DNS Server";

// Forwarders (optional) - remove or change if you want pure recursion
// forwarders {
// 1.1.1.1;
// 8.8.8.8;
// };
};

This configuration ensures recursive queries are only served to your specified networks plus localhost.

4. Define the infosecmonkey.org Zone

We now make BIND authoritative for `infosecmonkey.org` by defining a master zone and its zone file.[^1_6][^1_7][^1_2][^1_1]

4.1 Add Zone to named.conf.local

Edit /etc/bind/named.conf.local:

sudo vi /etc/bind/named.conf.local

Append the following block:

zone "infosecmonkey.org" {
type master;
file "/etc/bind/db.infosecmonkey.org";
};

This tells BIND to load the zone data from /etc/bind/db.infosecmonkey.org.

5. Create Zone File for infosecmonkey.org

We will create a basic but functional zone:

– SOA
– NS records
– A record for the nameserver itself
– A couple of sample A records (adjust to your environment).

Create the zone file:

sudo vi /etc/bind/db.infosecmonkey.org

Paste and adjust as needed:

$TTL 86400
@ IN SOA ns1.infosecmonkey.org. admin.infosecmonkey.org. (
2026041701 ; Serial (YYYYMMDDnn)
3600 ; Refresh (1 hour)
1800 ; Retry (30 minutes)
1209600 ; Expire (14 days)
86400 ) ; Minimum TTL (1 day)

; Authoritative name servers
IN NS ns1.infosecmonkey.org.

; Nameserver A record (use your actual IP)
ns1 IN A 10.1.106.10

; Example host records
@ IN A 10.1.106.10
www IN A 10.1.106.10
api IN A 10.1.105.20
vpn IN A 10.240.0.10

Key points:

– Update the serial each time you edit the file (e.g., 2026041702).
– Replace IPs with your real host addresses.

Set proper permissions (usually already fine, but explicit is safe):

sudo chown root:bind /etc/bind/db.infosecmonkey.org
sudo chmod 640 /etc/bind/db.infosecmonkey.org

6. Check Configuration and Reload BIND

Use BIND’s built-in checkers:

sudo named-checkconf

If no output, syntax is OK.

Check the zone file syntax:

sudo named-checkzone infosecmonkey.org /etc/bind/db.infosecmonkey.org

You should see something like:

zone infosecmonkey.org/IN: loaded serial 2026041701

If all is good, reload BIND:

sudo systemctl reload bind9

Or restart if you prefer
sudo systemctl restart bind9

7. Allow DNS Through Ubuntu Firewall (ufw)

If you use ufw, allow port 53 (UDP/TCP).

sudo ufw allow 53/tcp
sudo ufw allow 53/udp
sudo ufw reload

Your ACL still restricts who can use recursion; firewall only governs basic reachability.

8. Test Authoritative and Recursive Queries

From a host in 10.1.106.0/24, 10.1.105.0/24, or 10.240.0.0/15, or from the server itself:

8.1 Test Zone Resolution

dig @10.1.106.10 infosecmonkey.org
dig @10.1.106.10 www.infosecmonkey.org
dig @10.1.106.10 ns1.infosecmonkey.org

You should receive NOERROR responses with the configured A records.

8.2 Test Recursion (External Domain)

dig @10.1.106.10 google.com
dig @10.1.106.10 www.cloudflare.com

You should see status: NOERROR and IP addresses in the ANSWER section, plus the ra (recursion available) flag.

8.3 Test Recursion from a Disallowed IP

From a non-allowed subnet (or simulate with a VM on another network) you should see queries refused or timed out:

dig @10.1.106.10 google.com

Expected: status: REFUSED (or similar), indicating ACLs are working.

9. Optional: Logging for Troubleshooting

To get more visibility, you can add logging channels and categories.

Edit /etc/bind/named.conf.local and add before your zone:

logging {
channel default_syslog {
syslog daemon;
severity info;
};

channel query_log {
file "/var/log/named/queries.log" versions 3 size 10m;
severity info;
print-time yes;
`};

category queries { query_log; };
category default { default_syslog; };
};

Create log directory and adjust permissions:

sudo mkdir -p /var/log/named
sudo chown bind:bind /var/log/named
sudo chmod 750 /var/log/named
sudo systemctl restart bind9

You can then tail query logs:

sudo tail -f /var/log/named/queries.log

10. Quick Health Checklist

– systemctl status bind9 shows running.
– named-checkconf and named-checkzone both OK.
– dig for infosecmonkey.org returns your internal IPs.
– dig google.com via your server works from allowed networks and is refused from others

Deploying Bind9 as DNS Server on Ubuntu Server

1. Assumptions and Planning

2. Install BIND9 and Base Packages

3. Define ACLs and Recursive Options

4. Define the infosecmonkey.org Zone

4.1 Add Zone to named.conf.local

5. Create Zone File for infosecmonkey.org

6. Check Configuration and Reload BIND

7. Allow DNS Through Ubuntu Firewall (ufw)

8. Test Authoritative and Recursive Queries

8.1 Test Zone Resolution

8.2 Test Recursion (External Domain)

8.3 Test Recursion from a Disallowed IP

9. Optional: Logging for Troubleshooting

10. Quick Health Checklist

Recent posts