BIND: Access Controls

Updated: Sep 23, 2026

 
tsig-keygen -a hmac-sha512 server1.example.net
tsig-keygen -a hmac-sha512 server2.example.net

vim /etc/named.conf
 

 
// vim: set filetype=named :

key "srv-rndc-key" { 
	algorithm hmac-sha512; 
	secret "9ZkhaRf7FoyNLmkzUJiJxnmBdG0WSJDqUYQBn85X/Jp7eX6CHUBvdccpXsn4L0rroCmbcfROuL+QmV/9tz/0uQ=="; 
	};

key "server1.example.net" {
	algorithm hmac-sha512;
	secret "qWZ4nYRDV0H0hAVmtuxpKAEg47J6a99xYrSNVuz9t6FWR2lnD/DG8CSM/jjPyyZk7jyYdCxyEuNuIN2TtxiH5A==";
	};

key "server2.example.net" {
	algorithm hmac-sha512;
	secret "qWZ4nYRDV0H0hAVmtuxpKAEg47J6a99xYrSNVuz9t6FWR2lnD/DG8CSM/jjPyyZk7jyYdCxyEuNuIN2TtxiH5A==";
	};



acl "net-internal-acl" { 10.0.0.0/8; 127.0.0.0/8; 172.16.0.0/12; 192.168.0.0/16; };
acl "host-nameserver-acl" { 10.0.0.2; 10.0.0.3; 127.0.0.1; };

acl "admin-key-acl" { key srv-rndc-key; key server1.example.net; key server2.example.net; };

remote-servers "host-nameserver-slaves" { 10.0.0.3; };

controls { inet * port 953 allow { net-internal-acl; } 
	keys { 
		"srv-rndc-key"; 
		"server1.example.net"; 
		"server2.example.net"; 
		}; 
	};

statistics-channels { inet * port 9053 allow { net-internal-acl; }; };

options {
	listen-on port 53 { any; };
	directory "/var/named";
	pid-file "/var/run/named/pid";



	recursion yes;
	allow-recursion { net-internal-acl; };
	recursive-clients 1000;

	empty-zones-enable yes;

	allow-query { any; };
	allow-notify { host-nameserver-acl; };
	allow-update-forwarding { host-nameserver-acl; };
	allow-transfer { host-nameserver-acl; };
	allow-update { admin-key-acl; };

	dump-file "stats/named_dump.txt";
	zone-statistics full;
	statistics-file "stats/named_stats.txt";
	memstatistics yes;
	memstatistics-file "stats/named_memstats.txt";

	querylog yes;
	responselog yes;

};


logging {
	channel default {
		file "/var/named/logs/named.log" versions 10 size 10m ;
		print-time yes;
		print-category yes;
		severity dynamic;
	};
	channel "query" {
		file "/var/named/logs/query.log" versions 10 size 10m ;
		print-time yes;
		print-category yes;
	};
	channel "rpz" {
		file "/var/named/logs/rpz.log" versions 10 size 10m ;
		print-time yes;
		print-category yes;
	};
	channel "transfer" {
		file "/var/named/logs/transfer.log" versions 10 size 10m ;
		print-time yes;
		print-category yes;
	};
	channel "update" {
		file "/var/named/logs/update.log" versions 10 size 10m ;
		print-time yes;
		print-category yes;
	};


	category default { default; };

	category queries { query; };
	category query-errors { query; };
	category serve-stale { query; };
	category responses {query;};

	category lame-servers {null;};

	category resolver {rpz;};
	category rpz {rpz;};
	category rpz-passthru {rpz;};

	category notify { transfer; };
	category zoneload { transfer; };
	category xfer-in { transfer; };
	category xfer-out { transfer; };

	category update { update; };
	category update-security { update; };

};

zone "." { type hint; file "/var/named/named.root"; };
 

 
/usr/local/etc/rc.d/named restart
(service named restart)

rndc status

dig -4 @127.0.0.1 -t soa google.com