LFCE 35 🐧 BIND9 — Installation and Basic Config - KandZ

⏱️ Estimated read: 12 min | |

BIND9 is packaged for every major Linux distribution, and installation is a single package manager command. The complexity begins after the packages are installed. The default configuration shipped by Debian and RHEL is not a blank slate; it includes preconfigured zones, default options, and service management hooks that differ between distributions. An administrator who edits the wrong file, or who restarts the service without validating the configuration, can produce an outage that is difficult to diagnose because the service reports itself as running while refusing all queries.

This chapter covers the installation commands for the two major package families, the layout of the configuration files, the minimal options block that makes a server functional, and the validation tools that prevent a syntax error from becoming a production incident. It builds on the previous chapter’s distinction between authoritative and recursive roles; the installation is the same for both, but the options block determines which role the server performs.

Key point: Always run named-checkconf before restarting or reloading the service. A single missing semicolon in named.conf prevents named from starting, and the service manager may not report the failure clearly. The validation tool parses the configuration and reports the file and line number of the error before the running server is affected .

Why installation requires distribution-specific attention

The package-name problem.

The BIND9 packages are named differently on Debian and RHEL families. On Debian and Ubuntu, the server package is bind9, and the utility package is bind9utils . On RHEL, CentOS, Rocky Linux, and Fedora, the server package is bind, and the utility package is bind-utils . The daemon is named on both families, and the service is managed through systemctl as named on both, though the Debian package historically used a different service name in older releases.

The configuration-layout problem.

Debian splits the configuration across multiple files: named.conf includes named.conf.options, named.conf.local, and named.conf.default-zones . RHEL uses a single named.conf by convention, though the include statement is available on both. An administrator following a Debian tutorial on a RHEL system may edit a file that is never read, or vice versa. The include directives at the top of the main configuration file determine which files are actually loaded.

The default-zone problem.

Both distributions ship with default zones for localhost, the reverse loopback zone, and the root hints. These zones are necessary for the server to function correctly, but they can confuse an administrator who is trying to add a new authoritative zone. The new zone is added to named.conf.local on Debian or to named.conf on RHEL, alongside the defaults, not in place of them.

a. Installing the packages

The installation commands differ by package family, but the result is the same: the named daemon, the configuration files, and the validation utilities.

# Debian / Ubuntu
sudo apt update
sudo apt install bind9 bind9utils bind9-doc

# RHEL / CentOS / Rocky Linux / Fedora
sudo dnf install bind bind-utils

# Verify the installation
named -v
# Output: BIND 9.20.x (or the version shipped by the distribution)

The bind9-doc package on Debian installs the BIND 9 Administrator Reference Manual locally, which is useful for reference without internet access . The bind-utils package on RHEL provides dig, nslookup, and host, which are needed for testing the server after configuration.

After installation, the service is not running by default on Debian; on RHEL, the named service may be enabled but not started. The service management commands are the same on both families.

# Start and enable the service
sudo systemctl start named
sudo systemctl enable named

# Check the status
sudo systemctl status named
# The output should show "active (running)" and the listening ports

The named process listens on port 53 for both TCP and UDP by default. If the service fails to start, the first diagnostic step is journalctl -u named to see the error message, which usually points to a configuration syntax error.

b. The minimal options block

The options block in named.conf (or named.conf.options on Debian) controls the global behavior of the server. A minimal configuration for a resolver includes the directory, recursion, allow-recursion, and forwarders statements.

# Debian: /etc/bind/named.conf.options
# RHEL: /etc/named.conf (options block)
options {
    directory "/var/cache/bind";          # Working directory for zone and cache files
    recursion yes;                        # Enable recursive resolution
    allow-recursion { 192.168.1.0/24; };  # Only allow the local subnet
    listen-on { 192.168.1.10; };          # Listen on the internal interface only
    forwarders { 8.8.8.8; 8.8.4.4; };     # Forward queries to upstream resolvers
    dnssec-validation auto;               # Enable DNSSEC validation
};

The directory statement tells named where to write its cache and journal files. The allow-recursion ACL is the security boundary; without it, the server is an open resolver. The listen-on statement restricts which interfaces accept queries; any listens on all interfaces, which is appropriate only on a dedicated DNS server . The forwarders statement is optional; without it, the resolver performs iterative lookups from the root. With it, the resolver sends queries to the specified upstream servers, which is often faster on a local network.

For an authoritative-only server, the options block is simpler.

options {
    directory "/var/cache/bind";
    recursion no;                         # Authoritative only
    allow-query { any; };                 # Answer queries for configured zones
};

The recursion no directive prevents the server from resolving names outside its authoritative zones. A query for an external name returns a referral or a REFUSED response, not an answer from a cache.

c. Validating and reloading the configuration

The validation tools parse the configuration and zone files without affecting the running server. named-checkconf checks the syntax of named.conf and all included files. named-checkzone checks the syntax of a specific zone file.

# Validate the main configuration
sudo named-checkconf

# Validate a specific zone file
sudo named-checkzone example.com /etc/bind/zones/example.com.zone
# Output: zone example.com/IN: loaded serial 2025010101
#         OK

# If the configuration is valid, reload without a full restart
sudo rndc reload
# Output: server reload successful

The named-checkconf command returns no output on success. If there is an error, it prints the file name, line number, and a description of the problem. The rndc reload command tells the running server to re-read the configuration and zone files without dropping the service, which is less disruptive than a restart . If rndc is not configured or the control channel is not available, systemctl reload named achieves the same result on most distributions.

The rndc status command shows the server’s version, uptime, and the number of zones it has loaded. This is a useful verification after a reload, confirming that the server is running and has accepted the new configuration.

Complete Example Session

# ============================================
# PART 1: INSTALL THE PACKAGES
# ============================================
# Debian / Ubuntu
sudo apt update
sudo apt install -y bind9 bind9utils bind9-doc

# ============================================
# PART 2: INSPECT THE CONFIGURATION LAYOUT
# ============================================
ls -l /etc/bind/
# Output: named.conf, named.conf.options, named.conf.local, named.conf.default-zones

# ============================================
# PART 3: CONFIGURE THE OPTIONS BLOCK
# ============================================
sudo tee /etc/bind/named.conf.options > /dev/null <<'EOF'
options {
    directory "/var/cache/bind";
    recursion yes;
    allow-recursion { 192.168.1.0/24; };
    listen-on { 192.168.1.10; };
    forwarders { 8.8.8.8; 8.8.4.4; };
    dnssec-validation auto;
};
EOF

# ============================================
# PART 4: ADD AN AUTHORITATIVE ZONE
# ============================================
sudo tee -a /etc/bind/named.conf.local > /dev/null <<'EOF'
zone "example.com" {
    type primary;
    file "/etc/bind/zones/example.com.zone";
};
EOF

# ============================================
# PART 5: CREATE THE ZONE FILE
# ============================================
sudo mkdir -p /etc/bind/zones
sudo tee /etc/bind/zones/example.com.zone > /dev/null <<'EOF'
$TTL 3600
@   IN  SOA ns1.example.com. admin.example.com. (
        2025010101 ; serial
        3600       ; refresh
        900        ; retry
        604800     ; expire
        300        ; negative TTL
)
@   IN  NS  ns1.example.com.
ns1 IN  A   192.168.1.10
www IN  A   192.168.1.20
EOF

# ============================================
# PART 6: VALIDATE BEFORE STARTING
# ============================================
sudo named-checkconf
sudo named-checkzone example.com /etc/bind/zones/example.com.zone

# ============================================
# PART 7: START AND ENABLE THE SERVICE
# ============================================
sudo systemctl start named
sudo systemctl enable named
sudo systemctl status named

# ============================================
# PART 8: TEST THE SERVER
# ============================================
dig @localhost www.example.com
# Output: www.example.com. 3600 IN A 192.168.1.20

# ============================================
# PART 9: VERIFY THE AUTHORITATIVE FLAG
# ============================================
dig @localhost www.example.com | grep flags
# Output includes: flags: qr aa rd
# The "aa" flag confirms the answer is authoritative

# ============================================
# PART 10: RELOAD AFTER A CONFIGURATION CHANGE
# ============================================
sudo named-checkconf && sudo rndc reload
sudo rndc status

The ten parts demonstrate the complete installation and basic configuration workflow: package installation, configuration layout inspection, options configuration, zone addition, zone file creation, validation, service start, testing, verification, and reload. The critical step is Part 6: validation before the service is started, so that a syntax error is caught before it becomes an outage.

Quick Reference

Installation Commands

Distribution	Server Package	Utilities Package
Debian / Ubuntu	`bind9`	`bind9utils`
RHEL / Rocky / Fedora	`bind`	`bind-utils`

Configuration Files

File	Debian Path	RHEL Path
Main config	`/etc/bind/named.conf`	`/etc/named.conf`
Options	`/etc/bind/named.conf.options`	Included in `named.conf`
Local zones	`/etc/bind/named.conf.local`	Included in `named.conf`
Default zones	`/etc/bind/named.conf.default-zones`	Included in `named.conf`

Validation and Control Commands

Command	Purpose
`named-checkconf`	Validate configuration syntax
`named-checkzone <zone> <file>`	Validate a zone file
`rndc reload`	Reload configuration without restart
`rndc status`	Show server status
`dig @server <name>`	Query the server directly

Minimal Options Statements

Statement	Purpose
`directory`	Working directory for cache and journal files
`recursion`	Enable or disable recursive resolution
`allow-recursion`	Restrict who can use the resolver
`listen-on`	Restrict which interfaces accept queries
`forwarders`	Upstream resolvers for forwarding

Best Practices

✅ Do This:

# Install the correct package for the distribution
sudo apt install bind9 bind9utils    # Debian/Ubuntu              # ✅
sudo dnf install bind bind-utils     # RHEL/Rocky                 # ✅

# Validate before restarting
sudo named-checkconf                                          # ✅

# Restrict recursion to the local subnet
allow-recursion { 192.168.1.0/24; };                          # ✅

# Restrict listening to the internal interface
listen-on { 192.168.1.10; };                                  # ✅

# Use rndc reload instead of restart when possible
sudo rndc reload                                              # ✅

# Validate zone files before adding them to the configuration
sudo named-checkzone example.com /etc/bind/zones/example.com.zone # ✅

❌ Don’t Do This:

# Start the service without validating the configuration
sudo systemctl start named    # Syntax error causes failure      # ❌

# Leave recursion open to the internet
allow-recursion { any; };    # Amplification vector              # ❌

# Listen on all interfaces on a server with a public IP
listen-on { any; };    # Exposes the resolver to the internet # ❌

# Edit the wrong configuration file for the distribution
# Debian uses named.conf.options; RHEL uses named.conf          # ❌

# Assume the service is running correctly because systemctl says so
# Test with dig @localhost to confirm queries are answered        # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
Service fails to start	Syntax error in `named.conf`	`named-checkconf` reports file and line
Queries for external names fail	`recursion no` on authoritative server	Expected; use a resolver for external names
Zone not answering	Zone statement missing or file path wrong	`named-checkzone`; verify `file` path
Server is an open resolver	`allow-recursion { any; }`	Restrict to `localnets` or specific ACL
Configuration changes not applied	Service not reloaded	`rndc reload` or `systemctl reload named`
Wrong file edited on Debian	`named.conf` includes other files	Edit `named.conf.options` or `named.conf.local`

Real-World Examples

1. Debian installation

sudo apt update && sudo apt install bind9 bind9utils

2. RHEL installation

sudo dnf install bind bind-utils

3. Minimal resolver options

options { directory "/var/cache/bind"; recursion yes; allow-recursion { localnets; }; };

4. Minimal authoritative options

options { directory "/var/cache/bind"; recursion no; allow-query { any; }; };

5. Add a zone on Debian

zone "example.com" { type primary; file "/etc/bind/zones/example.com.zone"; };

6. Validate configuration

sudo named-checkconf

7. Validate zone file

sudo named-checkzone example.com /etc/bind/zones/example.com.zone

8. Start and enable service

sudo systemctl start named && sudo systemctl enable named

9. Reload without restart

sudo rndc reload

10. Test the server

dig @localhost www.example.com

Visual

Debian Configuration Layout

┌──────────────────────────────────────────────────────────────┐
│  DEBIAN SPLITS CONFIGURATION ACROSS MULTIPLE FILES           │
│                                                              │
│  /etc/bind/named.conf                                        │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ include "/etc/bind/named.conf.options";                │  │
│  │ include "/etc/bind/named.conf.local";                  │  │
│  │ include "/etc/bind/named.conf.default-zones";          │  │
│  └────────────────────────────────────────────────────────┘  │
│                           │                                  │
│         ┌─────────────────┼─────────────────┐                │
│         │                 │                 │                │
│         ▼                 ▼                 ▼                │
│  ┌────────────┐    ┌────────────┐    ┌────────────────┐      │
│  │ options    │    │ local      │    │ default-zones  │      │
│  │ recursion  │    │ user zones │    │ localhost,     │      │
│  │ forwarders │    │            │    │ reverse, root  │      │
│  └────────────┘    └────────────┘    └────────────────┘      │
│                                                              │
│  Edit named.conf.options for global behavior.                │
│  Edit named.conf.local for user-defined zones.               │
└──────────────────────────────────────────────────────────────┘

Validation Workflow

┌──────────────────────────────────────────────────────────────┐
│  VALIDATE BEFORE RELOADING                                   │
│                                                              │
│  Edit configuration                                          │
│       │                                                      │
│       ▼                                                      │
│  named-checkconf                                             │
│       │                                                      │
│       ├── Error → Fix file, repeat                           │
│       │                                                      │
│       └── Success → named-checkzone (if zone changed)        │
│                           │                                  │
│                           ├── Error → Fix zone file, repeat  │
│                           │                                  │
│                           └── Success → rndc reload          │
│                                              │               │
│                                              ▼               │
│                                        rndc status           │
│                                        (confirm running)     │
│                                                              │
│  Never skip validation. A syntax error stops the server.     │
└──────────────────────────────────────────────────────────────┘

Resolver vs Authoritative Options

┌──────────────────────────────────────────────────────────────┐
│  THE OPTIONS BLOCK DETERMINES THE ROLE                       │
│                                                              │
│  RESOLVER:                                                   │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ recursion yes;                                         │  │
│  │ allow-recursion { 192.168.1.0/24; };                   │  │
│  │ forwarders { 8.8.8.8; };                               │  │
│  └────────────────────────────────────────────────────────┘  │
│  Resolves external names for local clients.                  │
│                                                              │
│  AUTHORITATIVE:                                              │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ recursion no;                                          │  │
│  │ allow-query { any; };                                  │  │
│  │ zone "example.com" { ... };                            │  │
│  └────────────────────────────────────────────────────────┘  │
│  Answers only for configured zones.                          │
│                                                              │
│  COMBINED:                                                   │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ recursion yes;                                         │  │
│  │ allow-recursion { internal; };                         │  │
│  │ allow-query { any; };                                  │  │
│  │ zone "example.com" { ... };                            │  │
│  └────────────────────────────────────────────────────────┘  │
│  Internal clients resolve; anyone queries zones.             │
└──────────────────────────────────────────────────────────────┘

Summary

Item	Value
Debian package	`bind9`, `bind9utils`
RHEL package	`bind`, `bind-utils`
Daemon	`named`
Main config (Debian)	`/etc/bind/named.conf`
Main config (RHEL)	`/etc/named.conf`
Options file (Debian)	`/etc/bind/named.conf.options`
Local zones (Debian)	`/etc/bind/named.conf.local`
Config validation	`named-checkconf`
Zone validation	`named-checkzone`
Reload command	`rndc reload` or `systemctl reload named`
Service name	`named` (both families)

Key takeaways:

The package names differ between families. bind9 on Debian, bind on RHEL. The daemon is named on both. The utilities are bind9utils and bind-utils respectively .
Debian splits configuration; RHEL uses a single file. Edit named.conf.options and named.conf.local on Debian. Edit the options and zone blocks in named.conf on RHEL. The include directives determine which files are loaded .
named-checkconf is mandatory before restarting. A syntax error prevents named from starting. The validation tool reports the file and line number, allowing the error to be fixed before the running server is affected .
The options block determines the server’s role. recursion yes with allow-recursion makes a resolver. recursion no with zone statements makes an authoritative server. The same binary does both.
allow-recursion is a security boundary. Without it, the server is an open resolver and an amplification vector. Restrict it to the local network or a specific ACL.
rndc reload applies changes without a restart. The running server re-reads the configuration and zone files. rndc status confirms that the reload succeeded and the server is running.

Remember: BIND9 installation is one package manager command, but the configuration requires attention to the distribution’s layout. Debian and RHEL organize the files differently, and the include directives determine which files are actually read. The options block sets the server’s role: resolver, authoritative, or combined. Validate with named-checkconf and named-checkzone before reloading, and test with dig after. A server that starts without error is not necessarily a server that answers queries correctly; the dig test and the aa flag confirm the role.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!