BIND Installation and Configuration Guide
STEP 1: Update System
sudo apt update && sudo apt upgrade -y
STEP 1.5: install vm tools for vmware esxi control
sudo apt install open-vm-tools
STEP 2: Install BIND9 and Dependencies
sudo apt install -y bind9 bind9utils bind9-doc dnsutils net-tools ufw
#Package notes:
#* bind9 – The DNS server itself
#* bind9utils – Command-line tools (e.g., rndc)
#* bind9-doc – Documentation (optional but useful)
#* dnsutils – Includes dig, nslookup, etc.
#* net-tools – For netstat (useful for diagnostics)
STEP 3: Configure BIND’s Global Settings
# Edit BIND’s Global settings (behavior of the DNS server) config:
sudo nano /etc/bind/named.conf.options
# Replace contents with:
options {
directory “/var/cache/bind”;
recursion no; # Disable recursion (BIND will not resolve internet queries)
allow-query { 127.0.0.1; 10.10.10.4; }; # ONLY allow localhost and Unbound server to query
allow-transfer { none; }; # Block zone transfers (security)
listen-on { 127.0.0.1; 10.10.10.6; }; # Listen on localhost and BIND’s specific IP
listen-on-v6 { none; }; # Prevent listening for IPv6 (if not used)
};
# Save the file (Ctrl+O, Enter to confirm, Ctrl+X to exit)
# Run a quick syntax check after editing named.conf.options:
sudo named-checkconf
#if you get error try command below to remove hidden empty space
sudo sed -i ‘s/\xC2\xA0/ /g’ /etc/bind/named.conf.options
STEP 4: Configure UFW Firewall Rules for BIND Server
# IMPORTANT: This sets up the firewall on your BIND server (10.10.10.6)
# 1. Set default policies
sudo ufw default deny incoming
sudo ufw default allow outgoing
# 2. Allow SSH access (so you don’t lock yourself out)
sudo ufw allow ssh
# 3. Allow incoming DNS queries to BIND from your Unbound server and localhost
# Unbound (10.10.10.4) is the only external server querying BIND.
sudo ufw allow from 10.10.10.4 to any port 53 proto udp
sudo ufw allow from 10.10.10.4 to any port 53 proto tcp
# Allow localhost for local testing
sudo ufw allow from 127.0.0.1 to any port 53 proto udp
sudo ufw allow from 127.0.0.1 to any port 53 proto tcp
# 4. Enable UFW (this activates all the rules set above)
sudo ufw enable
# Verify UFW status (optional, after enabling)
sudo ufw status verbose
STEP 5: Define Local Zones & Add Reverse Lookup Zone (PTR Records)
# Edit BIND’s Local zone definitions (forward and reverse zones) config:
sudo nano /etc/bind/named.conf.local
# Add to the bottom of file:
zone “homelab” {
type master;
file “/etc/bind/db.homelab”;
};
zone “10.10.10.in-addr.arpa” {
type master;
file “/etc/bind/db.10.10.10”;
};
# Save the file (Ctrl+O, Enter to confirm, Ctrl+X to exit)
6. Create Zone File for .homelab
sudo cp /etc/bind/db.empty /etc/bind/db.homelab
sudo nano /etc/bind/db.homelab
# Example content:
# REMEMBER TO INCREMENT THE SERIAL NUMBER (e.g., 2025071001 -> 2025071002) EVERY TIME YOU EDIT THIS FILE!
$TTL 86400
@ IN SOA ns1.homelab. admin.homelab. (
2026072605 ; Serial (YYYYMMDDNN)
3600 ; Refresh (seconds)
1800 ; Retry (seconds)
1209600 ; Expire (seconds)
86400 ) ; Minimum TTL (seconds)
IN NS ns1.homelab.
ns1 IN A 10.10.10.6
server IN A 10.10.10.2
idrac IN A 10.10.10.3
unbound IN A 10.10.10.4
asterisk IN A 10.10.10.5
voip IN CNAME asterisk.homelab.
bind IN A 10.10.10.6
adguard IN A 10.10.10.7
searx IN A 10.10.10.23
google IN CNAME searx.homelab.
# Customize the A records for your homelab devices.
# Save the file (Ctrl+O, Enter to confirm, Ctrl+X to exit)
STEP 7: Create and Edit Reverse Zone File:
sudo cp /etc/bind/db.empty /etc/bind/db.10.10.10
sudo nano /etc/bind/db.10.10.10
# REMEMBER TO INCREMENT THE SERIAL NUMBER (e.g., 2025071001 -> 2025071002) EVERY TIME YOU EDIT THIS FILE!
$TTL 86400
@ IN SOA ns1.homelab. admin.homelab. (
2026072605 ; Serial
3600 ; Refresh
1800 ; Retry
1209600 ; Expire
86400 ) ; Minimum TTL
IN NS ns1.homelab.
2 IN PTR server.homelab.
3 IN PTR idrac.homelab.
4 IN PTR unbound.homelab.
5 IN PTR asterisk.homelab.
6 IN PTR bind.homelab.
7 IN PTR adguard.homelab.
23 IN PTR searx.homelab.
# Save the file (Ctrl+O, Enter to confirm, Ctrl+X to exit)
STEP 8: Validate All BIND Configuration and Zone Files
# This is a critical step to catch errors before starting the service.
sudo named-checkconf
#if gt error try below command
sudo sed -i ‘s/\xC2\xA0/ /g’ /etc/bind/named.conf.local
sudo named-checkzone homelab /etc/bind/db.homelab
#if gt error try below command
sudo sed -i ‘s/\xC2\xA0/ /g’ /etc/bind/db.homelab
sudo named-checkzone 10.10.10.in-addr.arpa /etc/bind/db.10.10.10
#if gt error try below command
sudo sed -i ‘s/\xC2\xA0/ /g’ /etc/bind/db.10.10.10
STEP 9: Enable and Start BIND9
# Enable BIND to start automatically at boot
sudo systemctl enable bind9
***dont need***
# Restart BIND to apply all configuration and zone changes
sudo systemctl restart bind9
# Alternatively, if only zone files were changed after initial setup:
sudo rndc reload # Reloads zones without a full service restart
STEP 10: Check BIND Status
sudo systemctl status bind9
STEP 11: Test BIND (for .homelab domains only)
# Test forward lookup for a .homelab domain via localhost
dig @127.0.0.1 nas.homelab
dig @127.0.0.1 adguard.homelab
dig @127.0.0.1 ns1.homelab
dig @127.0.0.1 voip.homelab
# Test reverse lookup for BIND’s own IP
dig -x 10.10.10.6
STEP 12: Monitor BIND Logs
sudo journalctl -u bind9 -f
*********make sure you increment the number********
#after adding new entry to
sudo nano /etc/bind/db.homelab
sudo nano /etc/bind/db.10.10.10
#run the below command and make sure it says there are no problems
sudo named-checkzone 10.10.10.in-addr.arpa /etc/bind/db.10.10.10
#reload each zone
sudo rndc reload homelab
sudo rndc reload 10.10.10.in-addr.arpa
#OR
#reload all zones at once
sudo rndc reload