Questions tagged [bind]

BIND is a free, open source software implementation of the Domain Name System (DNS) protocols. The name BIND stands for "Berkeley Internet Name Domain", because the software originated in the early 1980s at the University of California at Berkeley. BIND is currently maintained and developed by the Internet Systems Consortium, a non-profit public benefit corporation with a mission to support a free and open internet.

The DNS protocols are part of the core Internet standards. They specify the process by which one computer can find another computer on the basis of its name. What it means to say "BIND is an implementation of the DNS protocols" is that the BIND software distribution contains all of the software needed both to ask name service questions and to answer such questions.

The BIND software distribution contains several parts:

  • A Domain Name System server. This is a program called "named", which is pronounced "name-dee" and stands for "name daemon". It answers questions that are sent to it, following the rules specified in the DNS protocol standards. You can provide DNS service on the internet by installing this software on a server computer and giving it correct information about your domain names.
  • Utility programs used in the management of a nameserver, including programs to control operation of the server, to cryptographically sign domain resource records for use with DNSSEC, assist in key management and rollover, and perform other functions.
  • A Domain Name System "resolver library". A "resolver" is a program that resolves questions about names by sending those questions to appropriate servers and responding appropriately to the servers' replies. A "resolver library" is a collection of software components that a programmer can add to software being developed, which will give that software the ability to resolve names. For example, a programmer who was programming a new web browser does not need to create the part of it that looks up names in DNS; he or she can plug in the resolver library and then send questions to the library software components. This saves time (the programmer does not need to re-invent that particular wheel) and helps ensure that the new browser correctly follows the DNS standards.
  • Software tools for testing servers. These are the tools that we use for testing, and we include them in the distribution in case you would like to do your own testing, perhaps to make sure your server configuration is working properly.
2274 questions
7
votes
1 answer

BIND - connection timed out; no servers could be reached

I've just upgraded from Debian 5 to 6 and I noticed bind stopped working. When trying to query for a domain from outside I get "connection timed out; no servers could be reached" error. Querying from localhost gives proper response. What could be…
krojew
  • 73
  • 1
  • 1
  • 3
7
votes
3 answers

DNSSEC - Ad Flag not activated

I have some doubts regarding DNSSEC. I have one server acting as an Authoritative Name Server and another one as a Cache/Resolver. I'm using Bind 9.7.1-P2 and these are my configuration files: Named.conf (Authoritative Server) // Opciones de…
Arancha
7
votes
5 answers

How can I override TTL of an Internet Address?

I'm running a caching DNS server currently to improve latency in a network. The question is: can I override the TTL I get from a server using BIND9 or other software on Linux? short "dig www.google.com" here: ; <<>> DiG 9.6.1-P2 <<>>…
OmniWired
  • 149
  • 1
  • 1
  • 6
6
votes
0 answers

Caching, forwarding Bind 9.9.4 server works for weeks, suddenly SERVFAIL on all queries (rebooting fixes it)

I have bind 9.9.5 running on two servers (CentOS 6 and 7), for caching and forwarding DNS queries for a mail server. The servers run fine for weeks, then suddenly respond to all queries with SERVFAIL. The first time it happened, both servers started…
Quinn Comendant
  • 548
  • 2
  • 17
6
votes
3 answers

What RFC encourages DNS servers to reply REFUSED to queries for unknown domains?

This question is very very similar to RFC that requires DNS servers to respond to unknown domain requests but I figured I ought to ask it as a new question. It appears that it is standard practice for an authoritative DNS server to respond with…
Quuxplusone
  • 213
  • 1
  • 3
  • 12
6
votes
1 answer

firewall rules for bind9

cat /etc/bind/named.conf.options // If there is a firewall between you and nameservers you want // to talk to, you may need to fix the firewall to allow multiple // ports to talk. I didn't find any information about what are the exact…
Pol Hallen
  • 1,095
  • 2
  • 13
  • 24
6
votes
1 answer

BIND, RPZ and Forwarding priorities

My objective is to block certain domains in bind WITHOUT first looking up their address (this is a small caching bind dns server). Currently my configuration will forward the request for badhost.com and get the IP address (I can see this in…
Jon T
  • 63
  • 1
  • 4
6
votes
3 answers

why bind9 gives connection refused for permission denied error when it is 777

These questions didn't help: https://askubuntu.com/questions/172030/how-to-allow-bind-in-app-armor Cannot start BIND9 I wanted to start bind9 and saw that it gives permission denied in syslog as below: Feb 8 09:37:24 aname named[27278]: automatic…
Alireza
  • 583
  • 4
  • 9
  • 27
6
votes
3 answers

BIND server has tons of "no valid RRSIG" errors

I have a forward-only BIND9 server running on the LAN and it logs hundreds of errors per day like: Aug 29 18:38:29 nuc named[850]: error (no valid RRSIG) resolving 'ubuntu.com/DS/IN': 75.75.75.75#53 Aug 29 18:38:31 nuc named[850]: validating…
jmw
  • 63
  • 1
  • 1
  • 3
6
votes
1 answer

SSH fails with host not found, but NSLookup finds that host

I have a small business network with several servers on it. To simplify things, I added a BIND9 DNS server on one of them, with entries for each of the local machines, i.e. vpn.example.com, web.example.com, storage.example.com, and so on. These…
Chris
  • 267
  • 4
  • 7
6
votes
1 answer

Set up BIND9 as DNS Firewall

With OpenDNS now needing one to be on the pro package to have filtering turned on, being on a tight budget, we are in need of free DNS filtering. After reading this link on how to block domains with bind, I collected SquidGuard blacklists and…
belteshazzar
  • 302
  • 4
  • 9
6
votes
1 answer

What is the syntax of email address with a dot behind it? in DNS zone file, SOA rr

How i can use a email address with a dot in behind. For example at bellow, email address is hostmaster@example.com, How to use host.master@example.com ? example.com. IN SOA ns.example.com. hostmaster.example.com. (...) I can not use…
Hamidreza
  • 163
  • 1
  • 2
  • 9
6
votes
1 answer

/usr/bin/host being used in HTTP DDoS on Debian?

So I got an abuse complaint for one of my dedicated servers, running Debian 6.0 Sure enough, sometimes, top shows /usr/bin/host using a lot of CPU for no apparent reason, and netstat shows process host doing a lot of HTTP requests. After while, my…
6
votes
4 answers

bind9: Disabling error logging for recursive queries

inadvertedly, a bind9 server I ran was an open resolver. Whoops. Now it's been months and the recursive queries for isc.org are still incoming. I would not mind if my /var/log/syslog did not look like this: Jul 6 01:10:23 servername last message…
Ivan Vučica
  • 224
  • 1
  • 4
  • 13
6
votes
1 answer

dns requests for odd domain names like mAiL.myDOmAIn.De

I have turned on logging in named. About 2% of all requests contain an odd mix of uppercase and lowercase domain, like Jan 7 10:38:46 s1500 named[27917]: client ip address#34084: query: mAIl.MYdoMain.de IN A - (my ip address) Jan 7 10:39:40 s1500…
nn4l
  • 1,336
  • 5
  • 23
  • 40