BIND: Security and Performance Settings

Updated: Sep 23, 2026

 
vim /etc/named_keys.conf

mkdir /var/named/dnssec
chown bind:bind /var/named/dnssec

vim /etc/named.conf
 

 
// vim: set filetype=named :

include "/etc/named_keys.conf";

acl "net-internal-acl" { 10.0.0.0/8; 127.0.0.0/8; 172.16.0.0/12; 192.168.0.0/16; };
acl "host-nameserver-acl" { 10.0.0.2; 10.0.0.3; 127.0.0.1; };

acl "admin-key-acl" { key srv-rndc-key; key server1.example.net; key server2.example.net; };

remote-servers "host-nameserver-slaves" { 10.0.0.3; };
server 10.0.0.2 { keys { server1.example.net; }; };

controls { inet * port 953 allow { net-internal-acl; } 
	keys { "srv-rndc-key"; 
		"server1.example.net"; 
		"server2.example.net"; 
		}; 
	};

statistics-channels { inet * port 9053 allow { net-internal-acl; }; };

options {
	server-id hostname;
	version "No version infomation available";
	listen-on port 53 { any; };
	directory "/var/named";
	pid-file "/var/run/named/pid";

	dnssec-validation auto;
	managed-keys-directory "dnssec";
	validate-except { internal; 10.in-addr.arpa; };

	dnssec-policy none;
	key-directory "dnssec";

	max-records-per-type 100;
	max-types-per-name 100;

	qname-minimization relaxed;

	minimal-any yes;
	minimal-responses no-auth-recursive;

	rate-limit {
		log-only yes;
	};

	recursion yes;
	allow-recursion { net-internal-acl; };
	recursive-clients 1000;

	empty-zones-enable yes;

	allow-query { any; };
	allow-notify { host-nameserver-acl; };
	allow-update-forwarding { host-nameserver-acl; };
	allow-transfer { host-nameserver-acl; };
	allow-update { admin-key-acl; };

	dump-file "stats/named_dump.txt";
	zone-statistics full;
	statistics-file "stats/named_stats.txt";
	memstatistics yes;
	memstatistics-file "stats/named_memstats.txt";

	querylog no;
	responselog no;

	dnstap { all; };
	dnstap-output file "stats/dns.tap" size 100M versions 10 suffix timestamp;

	check-names master warn;
	check-names slave ignore;

	notify master-only;
	also-notify { host-nameserver-slaves; };
};


logging {
	channel default {
		file "/var/named/logs/named.log" versions 10 size 10m ;
		print-time yes;
		print-category yes;
		severity dynamic;
	};
	channel "query" {
		file "/var/named/logs/query.log" versions 10 size 10m ;
		print-time yes;
		print-category yes;
	};
	channel "rpz" {
		file "/var/named/logs/rpz.log" versions 10 size 10m ;
		print-time yes;
		print-category yes;
	};
	channel "transfer" {
		file "/var/named/logs/transfer.log" versions 10 size 10m ;
		print-time yes;
		print-category yes;
	};
	channel "update" {
		file "/var/named/logs/update.log" versions 10 size 10m ;
		print-time yes;
		print-category yes;
	};


	category default { default; };

	category queries { query; };
	category query-errors { query; };
	category serve-stale { query; };
	category responses {query;};

	category lame-servers {null;};

	category resolver {rpz;};
	category rpz {rpz;};
	category rpz-passthru {rpz;};

	category notify { transfer; };
	category zoneload { transfer; };
	category xfer-in { transfer; };
	category xfer-out { transfer; };

	category update { update; };
	category update-security { update; };

};

zone "." { type hint; file "/var/named/named.root"; };
 

 
/usr/local/etc/rc.d/named restart
(service named restart)

rndc status

rm /var/named/managed-keys.bind /var/named/managed-keys.bind.jnl

dig -4 @127.0.0.1 -t soa google.com

cat /var/named/logs/named.log