How To Configure Dns Server In Linux – Linux DNS Server Configuration

by

A properly configured DNS server in Linux translates domain names into IP addresses, making network navigation possible. If you’re wondering how to configure dns server in linux, you’ve come to the right place. This guide walks you through the entire process step by step, from installation to testing, using BIND (Berkeley Internet Name Domain), the most popular DNS software on Linux.

DNS servers are the backbone of the internet. Without them, you’d have to memorize IP addresses for every website. Configuring your own DNS server gives you control over your network, improves performance, and enhances security. Let’s get started.

Understanding Dns Server Basics

Before diving into configuration, it helps to know what a DNS server does. It resolves domain names like example.com into IP addresses like 93.184.216.34. There are different types of DNS servers: authoritative, recursive, and caching. For this guide, we’ll set up a caching DNS server, which stores query results to speed up future requests.

BIND is the standard. It’s robust, flexible, and well-documented. You’ll also need a Linux distribution like Ubuntu, CentOS, or Debian. This guide uses Ubuntu 22.04, but the steps are similar for other distros.

Prerequisites For Configuration

You need a Linux machine with root or sudo access. A static IP address is essential—DNS servers shouldn’t change addresses. Also, ensure your system is updated. Run sudo apt update && sudo apt upgrade on Debian-based systems or sudo yum update on RHEL-based ones.

Basic knowledge of the command line helps. You’ll edit config files with nano or vim. Don’t worry if you’re new; we’ll explain every command.

Installing Bind On Linux

First, install BIND. On Ubuntu or Debian, use:

sudo apt install bind9 bind9utils bind9-doc

On CentOS or RHEL, use:

sudo yum install bind bind-utils

This installs the DNS server, utilities, and documentation. After installation, check the service status:

sudo systemctl status bind9

It should show “active (running)”. If not, start it with sudo systemctl start bind9.

How To Configure Dns Server In Linux

Now comes the main part. The configuration files for BIND are in /etc/bind/ on Ubuntu. The primary file is named.conf. We’ll edit it to set up a caching DNS server.

Editing The Main Configuration File

Open /etc/bind/named.conf with sudo:

sudo nano /etc/bind/named.conf

You’ll see three include statements. We’ll focus on named.conf.options. Add or modify the following options:

options {
    directory "/var/cache/bind";
    recursion yes;
    allow-query { any; };
    listen-on { any; };
    forwarders {
        8.8.8.8;
        8.8.4.4;
    };
    dnssec-validation auto;
    auth-nxdomain no;
};

Here’s what each line does:

  • directory: Sets the working directory for BIND.
  • recursion yes: Enables recursive queries.
  • allow-query { any; }: Allows any client to query the server. For security, restrict this to your network later.
  • listen-on { any; }: Listens on all network interfaces.
  • forwarders: Sends queries to Google’s DNS if not cached.
  • dnssec-validation auto: Enables DNSSEC for security.

Save and exit. On Ubuntu, also edit /etc/bind/named.conf.local if you need custom zones. For a caching server, you can leave it empty.

Configuring Firewall Rules

DNS uses port 53. Allow traffic on both TCP and UDP:

sudo ufw allow 53/tcp
sudo ufw allow 53/udp

If using firewalld on CentOS, run:

sudo firewall-cmd --add-service=dns --permanent
sudo firewall-cmd --reload

Testing The Configuration

Check for syntax errors:

sudo named-checkconf

If no output, the config is valid. Restart BIND:

sudo systemctl restart bind9

Test with dig:

dig @localhost google.com

You should see a response with the IP address. If you get “connection timed out”, check the firewall or BIND logs at /var/log/syslog.

Setting Up A Forward Zone

For an authoritative DNS server, you need forward and reverse zones. A forward zone maps domain names to IPs. Let’s create one for example.com.

Creating The Zone File

First, define the zone in named.conf.local:

zone "example.com" {
    type master;
    file "/etc/bind/db.example.com";
};

Then create the zone file:

sudo nano /etc/bind/db.example.com

Add this content:

$TTL    604800
@       IN      SOA     ns1.example.com. admin.example.com. (
                  2023100101   ; Serial
                  604800       ; Refresh
                  86400        ; Retry
                  2419200      ; Expire
                  604800 )     ; Negative Cache TTL
;
@       IN      NS      ns1.example.com.
@       IN      A       192.168.1.10
ns1     IN      A       192.168.1.10
www     IN      A       192.168.1.20

This defines the SOA record, name server, and A records. Replace IPs with your actual addresses. Increment the serial number each time you edit.

Checking Zone File Syntax

Use named-checkzone:

sudo named-checkzone example.com /etc/bind/db.example.com

If OK, restart BIND and test:

dig @localhost www.example.com

Configuring A Reverse Zone

Reverse DNS maps IPs to domain names. It’s useful for mail servers and diagnostics. Add this to named.conf.local:

zone "1.168.192.in-addr.arpa" {
    type master;
    file "/etc/bind/db.192.168.1";
};

Create the reverse zone file:

sudo nano /etc/bind/db.192.168.1

Content:

$TTL    604800
@       IN      SOA     ns1.example.com. admin.example.com. (
                  2023100101
                  604800
                  86400
                  2419200
                  604800 )
;
@       IN      NS      ns1.example.com.
10      IN      PTR     ns1.example.com.
20      IN      PTR     www.example.com.

Check syntax and restart BIND.

Securing Your Dns Server

Security is critical. Open DNS servers can be abused for DDoS attacks. Restrict queries to your network:

allow-query { 192.168.1.0/24; localhost; };

Also disable recursion for external queries:

allow-recursion { 192.168.1.0/24; localhost; };

Enable rate limiting to prevent abuse:

rate-limit {
    responses-per-second 5;
};

Use chroot jail for extra isolation, though it’s advanced.

Troubleshooting Common Issues

DNS configuration can be tricky. Here are frequent problems and fixes:

  • Service won’t start: Check logs with journalctl -u bind9. Look for syntax errors in config files.
  • Queries fail: Ensure firewall allows port 53. Test with dig @127.0.0.1.
  • Serial number errors: Always increment the serial when changing zone files.
  • Permission denied: Zone files must be readable by the bind user. Use sudo chown bind:bind /etc/bind/db.*.

Testing And Verifying Configuration

After setup, verify your server works correctly. Use dig from another machine:

dig @your-server-ip google.com

You can also use nslookup or host. Check that forward and reverse lookups match. For a caching server, query a domain twice—the second should be faster.

Monitor logs for errors:

sudo tail -f /var/log/syslog | grep named

Advanced Configuration Options

BIND offers many advanced features. You can set up slave servers for redundancy, implement DNSSEC for security, or configure split DNS for internal/external resolution. For performance, adjust cache size:

max-cache-size 256m;

Logging can be fine-tuned:

logging {
    channel default_log {
        file "/var/log/bind.log";
        severity info;
    };
};

These options go in named.conf.options.

Frequently Asked Questions

What Is The Best DNS Server Software For Linux?

BIND is the most common, but alternatives like Unbound, dnsmasq, and PowerDNS exist. BIND offers full features for both caching and authoritative servers.

Can I Configure A DNS Server On A Virtual Machine?

Yes, as long as it has a static IP and proper network access. Virtual machines work fine for testing or production.

How Do I Restart BIND After Changes?

Use sudo systemctl restart bind9 or sudo rndc reload for a reload without full restart.

Why Is My DNS Server Not Resolving External Domains?

Check recursion is enabled and forwarders are set. Also verify firewall rules and network connectivity to upstream DNS servers.

What Is The Difference Between Authoritative And Caching DNS?

An authoritative server holds zone data for domains it manages. A caching server stores query results to speed up future lookups for clients.

Conclusion

Configuring a DNS server in Linux is a rewarding task that gives you control over your network’s name resolution. We covered installation, basic caching setup, forward and reverse zones, security, and troubleshooting. Remember to test thoroughly and secure your server to prevent abuse.

With practice, you’ll be able to customize BIND for complex environments. Start with a simple caching server, then expand to authoritative zones as needed. Your network will thank you for the speed and reliability.

Now you know how to configure dns server in linux. Go ahead and set up your own—it’s easier than you think. If you run into issues, the logs and community forums are your best friends. Happy configuring!