1.2. Configuring BIND as a caching DNS server

Procedure

1. Install the bind and bind-utils packages:

   # dnf install bind bind-utils

2. If you want to run BIND in a change-root environment install the bind-chroot package:

   # dnf install bind-chroot

   Note that running BIND on a host with SELinux in enforcing mode, which is default, is more secure.

3. Edit the /etc/named.conf file, and make the following changes in the options statement:

   1. Update the listen-on and listen-on-v6 statements to specify on which IPv4 and IPv6 interfaces BIND should listen:

      listen-on port 53 { 127.0.0.1; 192.0.2.1; };
      listen-on-v6 port 53 { ::1; 2001:db8:1::1; };

   2. Update the allow-query statement to configure from which IP addresses and ranges clients can query this DNS server:

      allow-query { localhost; 192.0.2.0/24; 2001:db8:1::/64; };

   3. Add an allow-recursion statement to define from which IP addresses and ranges BIND accepts recursive queries:

      allow-recursion { localhost; 192.0.2.0/24; 2001:db8:1::/64; };

      警告

      Do not allow recursion on public IP addresses of the server. Otherwise, the server can become part of large-scale DNS amplification attacks.

   4. By default, BIND resolves queries by recursively querying from the root servers to an authoritative DNS server. Alternatively, you can configure BIND to forward queries to other DNS servers, such as the ones of your provider. In this case, add a forwarders statement with the list of IP addresses of the DNS servers that BIND should forward queries to:

      forwarders { 198.51.100.1; 203.0.113.5; };

      As a fall-back behavior, BIND resolves queries recursively if the forwarder servers do not respond. To disable this behavior, add a forward only; statement.

4. Verify the syntax of the /etc/named.conf file:

   # named-checkconf

   If the command displays no output, the syntax is correct.

5. Update the firewalld rules to allow incoming DNS traffic:

   # firewall-cmd --permanent --add-service=dns
   # firewall-cmd --reload

6. Start and enable BIND:

   # systemctl enable --now named

   If you want to run BIND in a change-root environment, use the systemctl enable --now named-chroot command to enable and start the service.

Verification

1. Use the newly set up DNS server to resolve a domain:

   # dig @localhost www.example.org
   ...
   www.example.org.    86400    IN    A    198.51.100.34
   
   ;; Query time: 917 msec
   ...

   This example assumes that BIND runs on the same host and responds to queries on the localhost interface.

   After querying a record for the first time, BIND adds the entry to its cache.

2. Repeat the previous query:

   # dig @localhost www.example.org
   ...
   www.example.org.    85332    IN    A    198.51.100.34
   
   ;; Query time: 1 msec
   ...

   Because of the cached entry, further requests for the same record are significantly faster until the entry expires.