<aside> 🧭
Module 05 · Running an Authoritative Server (BIND 9)
Four modules of reading other people's DNS. Now you run your own: a primary and a secondary on one laptop, a TSIG-authenticated zone transfer between them, and the serial-number bug from Module 03 committed deliberately so you recognise it when it costs somebody a weekend.
🧠 concept → 🧪 exercise → ✅ expected result (hidden) → 🎯 interview questions (answers hidden)
Prerequisite: Modules 01–04. You need zone files and named-checkzone (02), NS/SOA and delegation (02, 03), the aa flag and REFUSED (01), and why AXFR needs TCP (04).
</aside>
<aside> 🧪
Everything in this module runs on one machine. Two named processes on 127.0.0.1, on ports 5301 and 5302, in /tmp/lab. Nothing touches the system resolver, nothing needs port 53, nothing needs a second host, and nothing survives a reboot — so you can break it freely.
</aside>
named is, and installing it<aside> 🏪
The analogy. Think of one shop unit that can be run as either a bakery or a wholesaler.
Same building, same fittings. What you sell is a decision you make on day one, and it changes who is allowed to walk in.
named is that unit. Run as an authoritative server it answers only about its own goods. Run as a resolver it fetches anything for anyone — and doing both on a public street is how you end up working for people you never agreed to serve.
</aside>
<aside> 📖
Official docs: BIND 9 Administrator Reference Manual · Introduction to DNS and BIND 9 · named manual
</aside>
named — pronounced name-dee, the name daemon — is BIND's server. It is the reference implementation of DNS, and the same binary can act as an authoritative server, a recursive resolver, or both at once.
<aside> 🔑
One binary, two jobs, and keeping them apart is the first design decision you make. Module 01 B1 introduced authoritative servers and recursive resolvers as different roles; named can do either. Running both on one public address is the open resolver finding from Module 01 — you become a free amplifier for attacks on other people.
So the very first line of any authoritative configuration is recursion no;. Not as a hardening step you get to later — as the definition of what this server is.
</aside>
sudo apt install -y bind9 bind9-utils bind9-dnsutils # Debian / Ubuntu
sudo dnf install -y bind bind-utils # RHEL / Rocky / Fedora
named -V | head -2
🧪 Exercise A1.1 — Confirm the toolchain, not just the daemon
named -V | head -2
which named rndc rndc-confgen tsig-keygen named-checkconf named-checkzone
named.conf<aside> 🗝️
The analogy. Think of the notice you put in the shop window on opening day.
Who you serve, what hours, which counter is which — and, most importantly, the line that says "we do not take orders for other shops' goods".
That one line is recursion no;, and leaving it off is how a small shop ends up with a queue of strangers using it as a free delivery service.
</aside>
<aside> 📖
Official docs: BIND 9 — Configurations and Zone Files · Configuration Reference · named-checkconf
</aside>