BIND: Adding Authoritative Zones
Updated: Sep 23, 2026
mkdir -p /var/named/zones/default
mkdir -p /var/named/zones/empty
mkdir -p /var/named/zones/master
mkdir -p /var/named/zones/slave
vim /var/named/zones/_template_zone
$TTL 7200
@ SOA server1.example.net. dnsadmin.example.com. 1 3600 1800 1209600 900
@ NS server1.example.net.
@ NS server2.example.net.
$TTL 900
vim /var/named/zones/_empty_zones
$TTL 7200
@ SOA server1.example.net. dnsadmin.example.com. 1 3600 1800 1209600 900
@ NS server1.example.net.
@ NS server2.example.net.
$TTL 900
cp /var/named/zones/_template_zone /var/named/zones/default/localhost
cp /var/named/zones/_template_zone /var/named/zones/default/localdomain
cp /var/named/zones/_template_zone /var/named/zones/default/127.in-addr.arpa
chown -Rf bind:bind /var/named/zones
vim /etc/named.conf
// vim: set filetype=named :
include "/etc/named_keys.conf";
acl "net-internal-acl" { 10.0.0.0/8; 127.0.0.0/8; 172.16.0.0/12; 192.168.0.0/16; };
acl "host-nameserver-acl" { 10.0.0.2; 10.0.0.3; 127.0.0.1; };
acl "admin-key-acl" { key srv-rndc-key; key server1.example.net; key server2.example.net; };
remote-servers "host-nameserver-slaves" { 10.0.0.3; };
server 10.0.0.2 { keys { server1.example.net; }; };
/*
masters "host-nameserver-slaves" { 10.0.0.3; };
primaries "host-nameserver-slaves" { 10.0.0.3; };
*/
controls { inet * port 953 allow { net-internal-acl; }
keys {
"srv-rndc-key";
"server1.example.net";
"server2.example.net";
};
};
statistics-channels { inet * port 9053 allow { net-internal-acl; }; };
options {
server-id hostname;
version "No version infomation available";
listen-on port 53 { any; };
directory "/var/named";
pid-file "/var/run/named/pid";
dnssec-validation auto;
managed-keys-directory "dnssec";
validate-except { internal; 10.in-addr.arpa; };
dnssec-policy none;
key-directory "dnssec";
max-records-per-type 100;
max-types-per-name 100;
qname-minimization relaxed;
minimal-any yes;
minimal-responses no-auth-recursive;
rate-limit {
log-only yes;
};
recursion yes;
allow-recursion { net-internal-acl; };
recursive-clients 1000;
empty-zones-enable no;
allow-query { any; };
allow-notify { host-nameserver-acl; };
allow-update-forwarding { host-nameserver-acl; };
allow-transfer { host-nameserver-acl; };
allow-update { admin-key-acl; };
dump-file "stats/named_dump.txt";
zone-statistics full;
statistics-file "stats/named_stats.txt";
memstatistics yes;
memstatistics-file "stats/named_memstats.txt";
querylog no;
responselog no;
dnstap { all; };
dnstap-output file "stats/dns.tap" size 100M versions 10 suffix timestamp;
check-names master warn;
check-names slave ignore;
notify master-only;
also-notify { host-nameserver-slaves; };
allow-new-zones yes;
new-zones-directory "zones";
masterfile-format text;
masterfile-style full;
serial-update-method date;
};
logging {
channel default {
file "/var/named/logs/named.log" versions 10 size 10m ;
print-time yes;
print-category yes;
severity dynamic;
};
channel "query" {
file "/var/named/logs/query.log" versions 10 size 10m ;
print-time yes;
print-category yes;
};
channel "rpz" {
file "/var/named/logs/rpz.log" versions 10 size 10m ;
print-time yes;
print-category yes;
};
channel "transfer" {
file "/var/named/logs/transfer.log" versions 10 size 10m ;
print-time yes;
print-category yes;
};
channel "update" {
file "/var/named/logs/update.log" versions 10 size 10m ;
print-time yes;
print-category yes;
};
category default { default; };
category queries { query; };
category query-errors { query; };
category serve-stale { query; };
category responses {query;};
category lame-servers {null;};
category resolver {rpz;};
category rpz {rpz;};
category rpz-passthru {rpz;};
category notify { transfer; };
category zoneload { transfer; };
category xfer-in { transfer; };
category xfer-out { transfer; };
category update { update; };
category update-security { update; };
};
zone "." { type slave; file "/var/named/zones/slave/root"; masters { 192.0.32.132; 192.0.47.132; 170.247.170.2; 192.33.4.12; 199.7.91.13; 192.5.5.241; 192.112.36.4; 198.97.190.53; 193.0.14.129; }; notify no; };
zone "example.net" { type master; file "/var/named/zones/master/example.net" ; };
zone "10.in-addr.arpa" {type master; file "/var/named/zones/master/10.in-addr.arpa" ;};
/usr/local/etc/rc.d/named restart
(service named restart)
rndc status
dig @127.0.0.1 -t soa localhost
cd /var/named/zones
cp -a /var/named/zones/_template_zone /var/named/zones/master/example.net
cp -a /var/named/zones/_template_zone /var/named/zones/master/10.in-addr.arpa
vim /var/named/zones/master/example.net
$TTL 7200
@ SOA server1.example.net. dnsadmin.example.com. 1 3600 1800 1209600 900
@ NS server1.example.net.
@ NS server2.example.net.
$TTL 900
vim /var/named/zones/master/10.in-addr.arpa
$TTL 7200
@ SOA server1.example.net. dnsadmin.example.com. 1 3600 1800 1209600 900
@ NS server1.example.net.
@ NS server2.example.net.
$TTL 900
rndc addzone zone example.net '{ type master; file "/var/named/zones/master/example.net"; };'
rndc addzone zone 10.in-addr.arpa '{ type master; file "/var/named/zones/master/10.in-addr.arpa"; };'
named-nzd2nzf /var/named/zones/_default.nzd
rndc showzone zone example.net
vim empty_zones
for zone_name in `cat empty_zones` ; do cp -a _empty_zones empty/${zone_name} ; done
for zone_name in `cat empty_zones ` ;do rndc addzone ${zone_name} '{ type master; file "/var/named/zones/empty/'${zone_name}'"; };' ;done
rndc addzone arpa '{ type slave; file "/var/named/zones/slave/arpa"; masters { 192.0.32.132; 192.0.47.132; 170.247.170.2; 192.33.4.12; 199.7.91.13; 192.5.5.241; 192.112.36.4; 193.0.14.129; }; notify no; };'
rndc addzone in-addr.arpa '{ type slave; file "/var/named/zones/slave/in-addr.arpa"; masters { 192.0.32.132; 192.0.47.132; }; notify no; };'
rndc addzone ip6.arpa '{ type slave; file "/var/named/zones/slave/ip6.arpa"; masters { 192.0.32.132; 192.0.47.132; }; notify no; };'