Questions tagged [bind]

BIND is a free, open source software implementation of the Domain Name System (DNS) protocols. The name BIND stands for "Berkeley Internet Name Domain", because the software originated in the early 1980s at the University of California at Berkeley. BIND is currently maintained and developed by the Internet Systems Consortium, a non-profit public benefit corporation with a mission to support a free and open internet.

The DNS protocols are part of the core Internet standards. They specify the process by which one computer can find another computer on the basis of its name. What it means to say "BIND is an implementation of the DNS protocols" is that the BIND software distribution contains all of the software needed both to ask name service questions and to answer such questions.

The BIND software distribution contains several parts:

  • A Domain Name System server. This is a program called "named", which is pronounced "name-dee" and stands for "name daemon". It answers questions that are sent to it, following the rules specified in the DNS protocol standards. You can provide DNS service on the internet by installing this software on a server computer and giving it correct information about your domain names.
  • Utility programs used in the management of a nameserver, including programs to control operation of the server, to cryptographically sign domain resource records for use with DNSSEC, assist in key management and rollover, and perform other functions.
  • A Domain Name System "resolver library". A "resolver" is a program that resolves questions about names by sending those questions to appropriate servers and responding appropriately to the servers' replies. A "resolver library" is a collection of software components that a programmer can add to software being developed, which will give that software the ability to resolve names. For example, a programmer who was programming a new web browser does not need to create the part of it that looks up names in DNS; he or she can plug in the resolver library and then send questions to the library software components. This saves time (the programmer does not need to re-invent that particular wheel) and helps ensure that the new browser correctly follows the DNS standards.
  • Software tools for testing servers. These are the tools that we use for testing, and we include them in the distribution in case you would like to do your own testing, perhaps to make sure your server configuration is working properly.
2274 questions
5
votes
2 answers

Malware DNS A record points to my ip address

I've used BIND for about ten years but am by no means an expert, at all. Having said that, I just wiped my VPS due to a crytomining malware infection. While I was getting BIND set back up I noticed that a domain (TLD) I do not own was coming up as…
matzhu
  • 51
  • 2
5
votes
1 answer

Large AXFR through dnsmasq causes dig to hang with partial results

I'm attempting to set up dnsmasq as a local cache for consul. While this seems to work fine for normal digs, dnsmasq seems to only allow partial zone transfers. My resolv.conf: search x.domain.com y.domain.com z.domain.com domain.com nameserver…
Connor Bell
  • 146
  • 1
  • 8
5
votes
2 answers

Suppress BIND authority section on authoritative server with recursion disabled

I'm running an authoritative server with recursion disabled for hosts not in my network on BIND 9.11.3. When querying for domains not under the server's authority from a host outside my network, I get no answer and a list of root servers in the…
asmth00
  • 53
  • 3
5
votes
0 answers

BIND: DNS failover and high availability with dynamic updates

I am trying to design a system with 2 servers that act as both DHCP and DNS servers with dynamic updates. I am using ISC DHCP and BIND9. It looks like this. Server1 - DHCP primary and DNS master. IP address - 10.99.99.11 Server2 - DHCP secondary and…
5
votes
1 answer

Setting up an automatic DNS server on OpenVPN server

I have a number of networks in remote locations, which I want to be able to access over a VPN. The topology of each network is simply a NAT router, and a machine running an SSH server. The router has the SSH port forwarded, so all that's needed is…
emorris
  • 211
  • 2
  • 8
5
votes
1 answer

How to Make a /22 Reverse Zone in Bind? (255.255.252.0))

I'm working on a project to set up a Bind9 DNS server on a network with a 255.255.252.0 subnet. Currently, the way it is set up makes it impossible to run nslookup From 192.168.1.101/22 through ns1 @ 192.168.1.61/22 on a 192.168.0.0/22 network with…
thursDave
  • 55
  • 1
  • 1
  • 5
5
votes
2 answers

Return A records but not AAAA records on specific domain in bind9

I've setup a caching DNS server with bind9 using a root-hints method (like this). It works as desired--but, our IPv6 traffic goes through a gateway outside of my country that makes Netflix think we're visiting from that other country, and this…
Ole Wolf
  • 440
  • 1
  • 5
  • 13
5
votes
1 answer

Reverse DNS/bind named-checkzone "zone NS has no address records (A or AAAA) error"

This is my reverse dns file. $TTL 1D @ IN SOA dns.prv.server.co.uk. root.prv.server.co.uk. ( 2014090402 ; serial 3600 ; refresh …
neilH
  • 977
  • 1
  • 6
  • 16
5
votes
2 answers

Setting different NS records as authoritative on authoritative DNS

I have DNS servers for a domain set to one set of authoritative DNS servers on the registrar. However, those DNS servers zone file for the domain have a different set of NS records for it. Some DNS servers are passing the request on merrily to the…
5
votes
2 answers

bind: "nsupdate -l" failed with status "update failed: REFUSED"

I just switched to bind 9.9.5 dynamic DNS feature with semi-automatic management of DNSSEC entries, the whole process went good and my zone files were updated well, but now I can't update or add entries via nsupdate tool. The…
Neurotransmitter
  • 468
  • 1
  • 6
  • 17
5
votes
2 answers

Can a DNS client distinguish if the answer they received was based on a wildcard record or a specific match?

I had a * record on one of our zones and I changed it. But when I queried certain, random names on that zone from public DNS servers, I still received the old IP address. This makes no sense to me. The server I queried could not know the correct IP…
Oliver Salzburg
  • 4,635
  • 17
  • 55
  • 82
5
votes
2 answers

unexpected RCODE REFUSED - eating up log files

I have a website which I host myself, and I use bind9 as my DNS server (host my own nameservers etc.). I am having a problem with traffic bandwidth, and my syslog is full of the following type of issue: error (unexpected RCODE REFUSED) resolving…
pokero
  • 249
  • 3
  • 4
  • 9
5
votes
2 answers

bind9 configure forward zone for local domain without DNSSEC for this zone only

I have a working DNS server for local domain mydomain.local. I am trying to configure bind9 to work in default configuration, except for this zone, for which I want to forward queries to local DNS server. Here's config I have (ubuntu…
galets
  • 806
  • 3
  • 7
  • 18
5
votes
0 answers

Understanding (and partially disabling?) DNSSEC for an internal domain

I am setting up a new DNS infrastructure for our internal HPC cluster environment. This involves providing a migration path from our existing DNS authorities and domains. For sake of example, let's say that we have an institutional domain of…
anderbubble
  • 226
  • 3
  • 7
5
votes
1 answer

BIND 9.10 constantly killed on FreeBSD 10.0 with out of swap space

In one of our slave DNS servers BIND, version bind910-9.10.0P2_3, constantly get killed with the following message in /var/log/messages: Jul 30 01:00:10 cinnabar kernel: pid 602 (named), uid 53, was killed: out of swap space This service runs on a…
Vinícius Ferrão
  • 5,520
  • 11
  • 55
  • 95