BIND9 — DNS server

Q: The server doesn't answer queries

Run named-checkconf (any errors?), check the service is active, listening on 53 (ss -tulnp), and the port is open in firewall (53/udp and 53/tcp). Confirm dig @IP reaches it.

Q: I changed a zone — still old data

You didn't bump the serial in the SOA, or didn't reload (rndc reload). Also the TTL: until it expires, caches keep the old data.

Q: SERVFAIL

An error in the zone (named-checkzone), a broken delegation, or DNSSEC. Check journalctl -u named.

Q: It only resolves locally

Check allow-query / listen-on in named.conf.options — is it listening on the right address and letting clients in.

3 min Ubuntu 24.04 · BIND 9

Running your own DNS — zones, records, config checks, resolving debug.

Cheat sheet

4 commands Printable version

named-checkconf check named.conf syntax
named-checkzone example.com /etc/bind/db.example.com check a zone (BEFORE reload)
sudo rndc reload apply (or systemctl reload named)
dig @localhost www.example.com ask your own server
don't forget to bump the serial in the SOA when you edit a zone!

Overview

BIND9 is the most common DNS server. It is run for your own zone (an authoritative server) or as a caching resolver. The service is named (package bind9); for the client side, see dns-resolv.

bash

systemctl status named            # (the service is called named)
ss -tulnp | grep :53              # is it listening on DNS (53 TCP/UDP)

Configuration

The config is /etc/bind/named.conf*; zone files usually live in /etc/bind/db.*.

text

// named.conf.local
zone "example.com" {
    type master;
    file "/etc/bind/db.example.com";
};

text

; db.example.com (simplified)
$TTL 3600
@   IN SOA ns1.example.com. admin.example.com. ( 2026062501 3600 600 86400 600 )
@   IN NS  ns1.example.com.
@   IN A   10.0.0.1
www IN A   10.0.0.1

Every time you edit a zone, bump the serial (the number in the SOA) — otherwise secondary servers and caches won't pick up the change.

Recipes

Checking

bash

named-checkconf                    # check named.conf syntax
named-checkzone example.com /etc/bind/db.example.com   # check a zone
sudo systemctl reload named        # apply (or sudo rndc reload)
dig @localhost www.example.com     # ask your own server (see dns-resolv)

Troubleshooting

The server doesn't answer queries

Run named-checkconf (any errors?), check the service is active, listening on 53 (ss -tulnp), and the port is open in firewall (53/udp and 53/tcp). Confirm dig @IP reaches it.

I changed a zone — still old data

You didn't bump the serial in the SOA, or didn't reload (rndc reload). Also the TTL: until it expires, caches keep the old data.

SERVFAIL

An error in the zone (named-checkzone), a broken delegation, or DNSSEC. Check journalctl -u named.

It only resolves locally

Check allow-query / listen-on in named.conf.options — is it listening on the right address and letting clients in.