Overview

• What you’ll learn: How to install and configure BIND 9 on Ubuntu Server, create forward and reverse lookup zones, define resource records, configure zone transfers for secondary servers, and test your DNS server.
• Prerequisites: Lesson 16 – DNS Fundamentals
• Estimated reading time: 25 minutes

Introduction

BIND (Berkeley Internet Name Domain) is the most widely deployed DNS server software on the Internet. BIND 9, the current major version, is maintained by the Internet Systems Consortium (ISC) and supports authoritative DNS, recursive resolution, DNSSEC, and dynamic updates.

Running your own DNS server gives you complete control over name resolution for your domain. This is essential for internal networks, split-horizon DNS configurations, and environments where you need custom DNS records that a registrar’s DNS panel cannot provide.

In this lesson, you will install BIND 9 on Ubuntu Server, configure it as an authoritative DNS server, create forward and reverse zones, and verify that resolution works correctly.

Installing BIND 9

BIND 9 is available in the Ubuntu package repositories. The installation includes the server daemon (named), configuration utilities, and documentation.

# Install BIND 9 and utilities
$ sudo apt update
$ sudo apt install -y bind9 bind9-utils bind9-dnsutils

# Verify the installation
$ named -v
BIND 9.18.18-0ubuntu0.22.04.2-Ubuntu (Extended Support Version)

# Check the service status
$ sudo systemctl status named
● named.service - BIND Domain Name Server
     Loaded: loaded (/lib/systemd/system/named.service; enabled)
     Active: active (running) since Mon 2025-01-01 10:00:00 UTC

# BIND configuration directory structure
$ ls /etc/bind/
bind.keys  db.0  db.127  db.255  db.empty  db.local
named.conf  named.conf.default-zones  named.conf.local
named.conf.options  rndc.key  zones.rfc1918

Configuring BIND 9 Options

The main configuration is split across several files. named.conf is the entry point that includes the other files. Start by configuring global options in named.conf.options.

# /etc/bind/named.conf.options
options {
    directory "/var/cache/bind";

    // Listen on local interfaces
    listen-on { 127.0.0.1; 192.168.1.10; };
    listen-on-v6 { ::1; };

    // Allow queries from the local network
    allow-query { localhost; 192.168.1.0/24; };

    // Forwarding: send unresolved queries to upstream DNS
    forwarders {
        8.8.8.8;
        8.8.4.4;
    };

    // Enable recursion only for trusted clients
    recursion yes;
    allow-recursion { localhost; 192.168.1.0/24; };

    // DNSSEC validation
    dnssec-validation auto;

    // Hide version for security
    version "not disclosed";
};

# Validate the configuration
$ sudo named-checkconf
# (No output means the configuration is valid)

Creating a Forward Lookup Zone

A forward lookup zone maps domain names to IP addresses. You define the zone in named.conf.local and create the zone file with your resource records.

# /etc/bind/named.conf.local — Add zone declaration
zone "lab.example.com" {
    type primary;
    file "/etc/bind/zones/db.lab.example.com";
    allow-transfer { 192.168.1.11; };  // Secondary DNS server
};

# Create the zones directory
$ sudo mkdir -p /etc/bind/zones

# /etc/bind/zones/db.lab.example.com — Forward zone file
$TTL    604800
@       IN      SOA     ns1.lab.example.com. admin.lab.example.com. (
                     2025010101         ; Serial (YYYYMMDDNN)
                         604800         ; Refresh (7 days)
                          86400         ; Retry (1 day)
                        2419200         ; Expire (28 days)
                         604800 )       ; Negative Cache TTL (7 days)

; Name servers
@       IN      NS      ns1.lab.example.com.
@       IN      NS      ns2.lab.example.com.

; A records
ns1     IN      A       192.168.1.10
ns2     IN      A       192.168.1.11
web     IN      A       192.168.1.20
db      IN      A       192.168.1.30
mail    IN      A       192.168.1.40

; CNAME records
www     IN      CNAME   web.lab.example.com.
ftp     IN      CNAME   web.lab.example.com.

; MX record
@       IN      MX  10  mail.lab.example.com.

# Validate the zone file
$ sudo named-checkzone lab.example.com /etc/bind/zones/db.lab.example.com
zone lab.example.com/IN: loaded serial 2025010101
OK

Creating a Reverse Lookup Zone

A reverse lookup zone maps IP addresses back to domain names using PTR records. The zone name is based on the reversed IP network octets followed by .in-addr.arpa.

# /etc/bind/named.conf.local — Add reverse zone
zone "1.168.192.in-addr.arpa" {
    type primary;
    file "/etc/bind/zones/db.192.168.1";
    allow-transfer { 192.168.1.11; };
};

# /etc/bind/zones/db.192.168.1 — Reverse zone file
$TTL    604800
@       IN      SOA     ns1.lab.example.com. admin.lab.example.com. (
                     2025010101         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL

; Name servers
@       IN      NS      ns1.lab.example.com.
@       IN      NS      ns2.lab.example.com.

; PTR records
10      IN      PTR     ns1.lab.example.com.
11      IN      PTR     ns2.lab.example.com.
20      IN      PTR     web.lab.example.com.
30      IN      PTR     db.lab.example.com.
40      IN      PTR     mail.lab.example.com.

# Validate the reverse zone
$ sudo named-checkzone 1.168.192.in-addr.arpa /etc/bind/zones/db.192.168.1
zone 1.168.192.in-addr.arpa/IN: loaded serial 2025010101
OK

# Restart BIND to load the new zones
$ sudo systemctl restart named

# Test forward resolution
$ dig @192.168.1.10 web.lab.example.com A +short
192.168.1.20

# Test reverse resolution
$ dig @192.168.1.10 -x 192.168.1.20 +short
web.lab.example.com.

Key Takeaways

• BIND 9 is the most widely used DNS server software, supporting authoritative zones, recursion, DNSSEC, and zone transfers.
• Configuration is split across named.conf, named.conf.options (global settings), and named.conf.local (zone declarations).
• Forward zones map names to addresses (A/AAAA records); reverse zones map addresses to names (PTR records in the .in-addr.arpa domain).
• Always validate with named-checkconf (configuration) and named-checkzone (zone files) before restarting the service.
• Remember to increment the SOA serial number every time you modify a zone file — secondary servers use this to detect changes.

What’s Next

In Lesson 18, you will learn how to set up a DHCP Server with isc-kea — the modern replacement for ISC DHCP, capable of dynamically assigning IP addresses, options, and integrating with DNS.