Skip to content
Flowchart Learning

Dns_configuration

Chapter 26: DNS Configuration and Troubleshooting

Section titled “Chapter 26: DNS Configuration and Troubleshooting”

Overview

Section titled “Overview”

DNS (Domain Name System) is critical infrastructure for all network services. This chapter covers BIND9 configuration, DNS troubleshooting, and advanced DNS concepts essential for Linux system administrators.

24.1 DNS Fundamentals

Section titled “24.1 DNS Fundamentals”

DNS Query Types

Section titled “DNS Query Types”
                     DNS Query Flow
+------------------------------------------------------------------+
|                                                                   |
|     Client                                                        |
|        |                                                          |
|        v                                                          |
|   +----------+                                                    |
|   | Resolver |                                                    |
|   +-----+----+                                                    |
|         |                                                         |
|         | Query                                                  |
|         v                                                         |
|   +----------+                                                    |
|   | TLD Server|  (.com, .org)                                    |
|   +-----+----+                                                    |
|         |                                                         |
|         | Response                                                |
|         v                                                         |
|   +----------+                                                    |
|   | Authoritative|  (example.com)                                 |
|   |   Server    |                                                    |
|   +-----+----+                                                    |
|         |                                                         |
|         | Answer                                                  |
|         v                                                         |
|   +----------+                                                    |
|   | Client   |                                                    |
|   +----------+                                                    |
|                                                                   |
+------------------------------------------------------------------+

DNS Record Types

Section titled “DNS Record Types”
Terminal window
# A Record - IPv4 address
example.com.    IN    A    192.0.2.1


# AAAA Record - IPv6 address
example.com.    IN    AAAA    2001:db8::1


# CNAME - Canonical name (alias)
www.example.com. IN CNAME example.com.


# MX Record - Mail exchange
example.com.    IN    MX    10 mail.example.com.


# TXT Record - Text records (SPF, DKIM, DMARC)
example.com.    IN    TXT    "v=spf1 mx -all"


# NS Record - Name server
example.com.    IN    NS    ns1.example.com.


# SOA Record - Start of Authority
example.com.    IN    SOA    ns1.example.com. admin.example.com. (
                        2024022201  ; Serial
                        3600        ; Refresh
                        1800        ; Retry
                        604800      ; Expire
                        86400 )     ; Minimum TTL


# SRV Record - Service location
_http._tcp.example.com. IN SRV 10 5 80 www.example.com.


# PTR Record - Reverse DNS
1.2.0.192.in-addr.arpa. IN PTR example.com.

24.2 BIND9 Installation and Configuration

Section titled “24.2 BIND9 Installation and Configuration”

Installing BIND9

Section titled “Installing BIND9”
Terminal window
# Install BIND
sudo pacman -S bind


# Check version
named -v
named -V


# Enable and start
sudo systemctl enable --now named

Basic Configuration

Section titled “Basic Configuration”
/etc/named.conf
options {
    directory "/var/named";
    pid-file "/run/named/named.pid";


    // Allow queries
    allow-query { localhost; 192.168.0.0/16; 10.0.0.0/8; };


    // Recursion for internal clients
    allow-recursion { localhost; 192.168.0.0/16; };


    // Forwarders (use ISP or public DNS)
    forwarders {
        8.8.8.8;
        8.8.4.4;
    };


    // DNSSEC validation
    dnssec-validation auto;


    // Listen on
    listen-on { any; };


    // Port
    port 53;


    // Logging
    logging {
        channel default_log {
            file "/var/log/named/default.log" versions 3 size 5m;
            severity info;
            print-time yes;
            print-category yes;
        };
        category default { default_log; };
    };
};


// Include zone files
include "/etc/named.conf.local";

Local Zones

Section titled “Local Zones”
/etc/named.conf.local
// Forward zone
zone "example.com" {
    type master;
    file "/var/named/zones/db.example.com";
    allow-transfer { 192.168.1.0/24;; };
};


// Reverse zone for 192.168.1.0/24
zone "1.168.192.in-addr.arpa" {
    type master;
    file "/var/named/zones/db.192.168.1";
    allow-transfer { 192.168.1.0/24; };
};


// Local-only zone
zone "localdomain" {
    type master;
    file "/dev/null";
};

24.3 Zone Files

Section titled “24.3 Zone Files”

Forward Zone File

Section titled “Forward Zone File”
/var/named/zones/db.example.com
$TTL 86400


@       IN      SOA     ns1.example.com. admin.example.com. (
                        2024022201  ; Serial (YYYYMMDDNN)
                        3600        ; Refresh (1 hour)
                        1800        ; Retry (30 minutes)
                        604800      ; Expire (1 week)
                        86400 )     ; Minimum TTL (1 day)


; Name servers
@       IN      NS      ns1.example.com.
@       IN      NS      ns2.example.com.


; A records
@       IN      A       192.0.2.1
ns1     IN      A       192.0.2.10
ns2     IN      A       192.0.2.11
www     IN      A       192.0.2.1
mail    IN      A       192.0.2.20
api     IN      A       192.0.2.30


; CNAME records
blog    IN      CNAME   www
shop    IN      CNAME   www


; MX records (priority 10 and 20)
@       IN      MX      10 mail.example.com.
@       IN      MX      20 mail2.example.com.


; TXT records (SPF)
@       IN      TXT     "v=spf1 mx -all"


; DMARC
_dmarc  IN      TXT     "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"


; DKIM
mail._domainkey IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQE..."

Reverse Zone File

Section titled “Reverse Zone File”
/var/named/zones/db.192.168.1
$TTL 86400


@       IN      SOA     ns1.example.com. admin.example.com. (
                        2024022201  ; Serial
                        3600        ; Refresh
                        1800        ; Retry
                        604800      ; Expire
                        86400 )     ; Minimum TTL


@       IN      NS      ns1.example.com.
@       IN      NS      ns2.example.com.


; PTR records (reverse)
1       IN      PTR      www.example.com.
10      IN      PTR      ns1.example.com.
11      IN      PTR      ns2.example.com.
20      IN      PTR      mail.example.com.
30      IN      PTR      api.example.com.

24.4 DNS Security

Section titled “24.4 DNS Security”

DNSSEC Configuration

Section titled “DNSSEC Configuration”
Terminal window
# Generate keys for zone
dnssec-keygen -a RSASHA256 -b 2048 -n ZONE example.com
dnssec-keygen -a RSASHA256 -b 2048 -n ZONE -f KSK example.com


# Sign zone
dnssec-signzone -A -3 $(head -c 1000 /dev/urandom | tr -dc 'a-z0-9' | head -c 16) \
    -o example.com -t db.example.com


# Enable in named.conf
zone "example.com" {
    type master;
    file "db.example.com.signed";
    inline-signing yes;
    auto-dnssec maintain;
};


# Verify DNSSEC
dig +sigchase example.com @localhost

Access Control

Section titled “Access Control”
Terminal window
# Allow zone transfer
allow-transfer { 192.168.1.0/24; };


# Allow queries
allow-query { trusted-networks; };


# Rate limiting
rate-limit {
    responses-per-second 10;
    window 5;
};

24.5 DNS Troubleshooting

Section titled “24.5 DNS Troubleshooting”

Common Commands

Section titled “Common Commands”
Terminal window
# Query DNS
dig example.com
dig example.com A
dig example.com MX
dig example.com TXT
dig -x 192.0.2.1        # Reverse lookup


# Query specific server
dig @8.8.8.8 example.com


# Trace DNS path
dig +trace example.com


# Short output
dig +short example.com


# DNS zone transfer
dig axfr example.com @ns1.example.com


# Using nslookup
nslookup example.com
nslookup -type=mx example.com
nslookup -query=ANY example.com


# Using host
host example.com
host -t mx example.com
host -r example.com        # Short output

Debugging Issues

Section titled “Debugging Issues”
Terminal window
# Check named configuration
named-checkconf
named-checkconf /etc/named.conf


# Check zone file
named-checkzone example.com /var/named/zones/db.example.com


# Test with dig
dig @localhost example.com


# Check logs
journalctl -u named -f
tail -f /var/log/named/default.log


# DNS cache flush
# systemd-resolved
sudo systemd-resolve --flush-caches


# nscd
sudo nscd -i hosts


# BIND
sudo rndc flush

Common DNS Issues

Section titled “Common DNS Issues”
Terminal window
# 1. Zone not loading
# Check syntax: named-checkzone
# Check file permissions


# 2. Recursive queries failing
# Check allow-recursion


# 3. Zone transfer blocked
# Check allow-transfer


# 4. TTL issues
# Check SOA records
# Lower TTL before migration


# 5. Cached negative responses
# Check negative cache TTL in SOA


# 6. Firewall blocking port 53
# iptables -A INPUT -p udp --dport 53 -j ACCEPT
# iptables -A INPUT -p tcp --dport 53 -j ACCEPT

24.6 BIND Views (Split DNS)

Section titled “24.6 BIND Views (Split DNS)”
/etc/named.conf
view "internal" {
    match-clients { 192.168.0.0/16; 10.0.0.0/8; };


    recursion yes;


    zone "example.com" {
        type master;
        file "internal/db.example.com";
    };
};


view "external" {
    match-clients { any; };


    recursion no;


    zone "example.com" {
        type master;
        file "external/db.example.com";
    };
};

24.7 Dynamic DNS (DDNS)

Section titled “24.7 Dynamic DNS (DDNS)”

DHCP + DDNS Configuration

Section titled “DHCP + DDNS Configuration”
Terminal window
# In named.conf
ddns-updates on;
ddns-update-style standard;
update-static-leases on;


key "ddns-key" {
    algorithm hmac-md5;
    secret "YourSecretKey==";
};


zone "example.com" {
    primary 127.0.0.1;
    key ddns-key;
}

nsupdate Command

Section titled “nsupdate Command”
Terminal window
# Interactive update
nsupdate
> server ns1.example.com
> key ddns-key YourSecretKey==
> update add host.example.com 3600 A 192.168.1.50
> send


# Command line
nsupdate -k /etc/bind/ddns.key << EOF
server ns1.example.com
update delete host.example.com A
update add host.example.com 3600 A 192.168.1.50
send
EOF

24.8 Caching DNS Server (Unbound)

Section titled “24.8 Caching DNS Server (Unbound)”

Unbound Configuration

Section titled “Unbound Configuration”
/etc/unbound/unbound.conf
# Install
sudo pacman -S unbound


server:
    interface: 0.0.0.0
    access-control: 10.0.0.0/8 allow
    access-control: 192.168.0.0/16 allow
    access-control: ::1 allow


    verbosity: 1


    # Forward to upstream
    forward-zone:
        name: "."
        forward-addr: 8.8.8.8
        forward-addr: 8.8.4.4


# Enable and start
sudo systemctl enable --now unbound

Summary

Section titled “Summary”

In this chapter, you learned:

  • ✅ DNS fundamentals and record types
  • ✅ BIND9 installation and configuration
  • ✅ Zone file creation and management
  • ✅ DNSSEC security
  • ✅ DNS troubleshooting commands
  • ✅ Common DNS issues and solutions
  • ✅ Split DNS with views
  • ✅ Dynamic DNS updates
  • ✅ Unbound caching DNS

Next Chapter

Section titled “Next Chapter”

Chapter 25: Network Troubleshooting

Last Updated: February 2026