Primary and Secondary DNS -

I have completed setting up DNS for IPv4 and IPv6. Part of it was configuring HSTS for my web sites. I configured logging for bind.

7.1.2020 : Setting up better logging for DNS

I finally am ready to show how I did BIND9 DNS for IPv4 and IPv6


### Named.conf

// This is the primary configuration file for the BIND DNS server named.
//
// Please read /usr/share/doc/bind9/README.Debian.gz for information on the
// structure of BIND configuration files in Debian, *BEFORE* you customize
// this configuration file.
//
// If you are just adding zones, please do that in /etc/bind/named.conf.local

include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";
include "/etc/bind/named.conf.log";

sudo cat named.conf.options
options {
        directory "/var/cache/bind";

        // If there is a firewall between you and nameservers you want
        // to talk to, you may need to fix the firewall to allow multiple
        // ports to talk.  See http://www.kb.cert.org/vuls/id/800113

        // If your ISP provided one or more IP addresses for stable
        // nameservers, you probably want to use them as forwarders.
        // Uncomment the following block, and insert the addresses replacing
        // the all-0's placeholder.

        // forwarders {
        //      0.0.0.0;
        // };

        //======================================================================                    ==
        // If BIND logs error messages about the root key being expired,
        // you will need to update your keys.  See https://www.isc.org/bind-keys
        //======================================================================                    ==
        dnssec-validation auto;
        recursion yes;
        listen-on-v6 { any; };
};

 sudo cat named.conf.local

// allow-transfer { 192.168.1.210; 172.16.1.210; };
// also-notify { 192.168.1.210; 172.16.1.210; };

// Do any local configuration here
//

// Consider adding the 1918 zones here, if they are not used in your
// organization
//include "/etc/bind/zones.rfc1918";
zone "db.scsiraidguru.lan" {
type master;
file "/etc/bind/zones/db.scsiraidguru.lan";
allow-transfer { 192.168.1.210; 172.16.1.210; };
also-notify { 192.168.1.210; 172.16.1.210; };
};


zone "db.scsiraidguru.com" {
type master;
file "/etc/bind/zones/db.scsiraidguru.com";
allow-transfer { 192.168.1.210; 172.16.1.210; };
also-notify { 192.168.1.210; 172.16.1.210; };
};


zone "scsiraidguru.com" {
type master;
file "/etc/bind/zones/scsiraidguru.com";
allow-transfer { 192.168.1.210; 172.16.1.210; };
also-notify { 192.168.1.210; 172.16.1.210; };
};

zone "michaelmckenney.com" {
type master;
file "/etc/bind/zones/michaelmckenney.com";
allow-transfer { 192.168.1.210; 172.16.1.210; };
also-notify { 192.168.1.210; 172.16.1.210; };
};

zone "patrickmckenneylandscaping.com" {
type master;
file "/etc/bind/zones/patrickmckenneylandscaping.com";
allow-transfer { 192.168.1.210; 172.16.1.210; };
also-notify { 192.168.1.210; 172.16.1.210; };
};

zone "pandjmckenneyfamily.com" {
type master;
file "/etc/bind/zones/pandjmckenneyfamily.com";
allow-transfer { 192.168.1.210; 172.16.1.210; };
also-notify { 192.168.1.210; 172.16.1.210; };
};

zone "scsiraidguru.lan" {
type master;
file "/etc/bind/zones/scsiraidguru.lan";
allow-transfer { 192.168.1.210; 172.16.1.210; };
also-notify { 192.168.1.210; 172.16.1.210; };
};

zone "168.192.in.addr.arpa" {
type master;
file "/etc/bind/zones/db.192.168";
allow-transfer { 192.168.1.210; 172.16.1.210; };
also-notify { 192.168.1.210; 172.16.1.210; };
};

zone "16.172.in.addr.arpa" {
type master;
file "/etc/bind/zones/db.172.16";
allow-transfer { 192.168.1.210; 172.16.1.210; };
also-notify { 192.168.1.210; 172.16.1.210; };
}
;
//internal2
zone "2.5.d.1.1.0.2.8.2.0.4.0.1.0.6.2.ip6.arpa" {
type master;
file "/etc/bind/zones/db.2601.402.8201.1d52";
allow-transfer { 2601:402:8201:1d52::210; 2601:402:8201:1d52:20c:29ff:fe ba:7476; };
also-notify { 2601:402:8201:1d52::210; 2601:402:8201:1d52:20c:29ff:feba: 7476; };
};

// DMZ
zone "0.5.d.1.1.0.2.8.2.0.4.0.1.0.6.2.ip6.arpa" {
type master;
file "/etc/bind/zones/db.2601.402.8201.1d50";
allow-transfer { 2601:402:8201:1d50::210; 2601:402:8201:1d50:20c:29ff:fe ba:746c; };
also-notify { 2601:402:8201:1d50::210; 2601:402:8201:1d50:20c:29ff:feba: 746c; };
};

I removed the last digits of the address for privacy reasons in named.conf.options. You will notice allow-transfer and also-notify for IPv4 is an IPv4 address. IPv6 is an IPv6 address. On the secondary DNS server in /var/cache/bind/slaves, a copy of the /etc/bind/zones is copied. I follow naming protocols for the zones. Internal servers are scsiraidguru.lan and websites are scsiraidguru.com

 sudo cat named.conf.log
 logging {
  channel bind_log {
    file "/var/log/bind/bind.log" versions 3 size 5m;
    severity info;
    print-category yes;
    print-severity yes;
    print-time yes;
  };
  category default { bind_log; };
  category update { bind_log; };
  category update-security { bind_log; };
  category security { bind_log; };
  category queries { bind_log; };
  category lame-servers { null; };
};

create /var/log/bind

set it to bind:bind
set it to 755

On /etc/apparmor.d/usr.sbin.named

/var/log/bind/** rw,
/var/log/bind/ rw,

For completeness, I created a separate named.conf.log for the logging. I like my logs in a folder under /var/log.

Below is the old stuff from this page I need to edit and delete.

sudo apt update
sudo apt install resolvconf
sudo systemctl start resolvconf.service
sudo systemctl enable resolvconf.service
sudo systemctl status resolvconf.service
sudo dpkg-reconfigure resolvconf # answer Yes and ok

sudo vim /etc/resolvconf/resolv.conf.d/head
# your nameservers, domain, options that would go in /etc/resolv.conf in here

search nyc3.example.com  # your private domain
nameserver 10.128.10.11  # ns1 private IP address
nameserver 10.128.20.12  # ns2 private IP address

Restart the server

Turn these off in named.conf.options or you get errors

 dnssec-enable no;
 dnssec-validation no;

Sudo systemctl -l status bind9 gets check hint errors

These commands help test your DNS

sudo named-checkconf -z /etc/bind/named.conf
zone db.scsiraidguru.lan/IN: loaded serial 2011071006
zone db.scsiraidguru.com/IN: loaded serial 2011071006
zone scsiraidguru.com/IN: loaded serial 2011071006
zone michaelmckenney.com/IN: loaded serial 2011071006
zone patrickmckenneylandscaping.com/IN: loaded serial 2011071006
zone pandjmckenneyfamily.com/IN: loaded serial 2011071006
zone scsiraidguru.lan/IN: loaded serial 2011071006
zone 168.192.in.addr.arpa/IN: loaded serial 2011071005
zone 16.172.in.addr.arpa/IN: loaded serial 2011071005
zone 2.5.d.1.1.0.2.8.2.0.4.0.1.0.6.2.ip6.arpa/IN: loaded serial 2011071005
zone 0.5.d.1.1.0.2.8.2.0.4.0.1.0.6.2.ip6.arpa/IN: loaded serial 2011071005
zone localhost/IN: loaded serial 2
zone 127.in-addr.arpa/IN: loaded serial 1
zone 0.in-addr.arpa/IN: loaded serial 1
zone 255.in-addr.arpa/IN: loaded serial 1
zone 168.192.in-addr.arpa/IN: loaded serial 2011071005
zone 16.172.in-addr.arpa/IN: loaded serial 2011071005

How to view and clear Bind DNS server’s cache on Linux

Install and configure DNS server in Ubuntu 16.04 LTS

How To Configure BIND as a Private Network DNS Server on Ubuntu 18.04

Sudo systemctl -l status bind9 gets check hint errors

These commands help test your DNS