# Quick Linux DNS Server Setup Commands
sudo apt update && sudo apt install bind9 bind9utils bind9-doc
sudo systemctl enable named
sudo systemctl start named

# Update package repositories
sudo apt update

# Install BIND9 and utilities
sudo apt install bind9 bind9utils bind9-doc bind9-host

# Install additional tools for DNS management
sudo apt install dnsutils

# Verify installation
named -v

# Install BIND9 packages
sudo dnf install bind bind-utils bind-libs

# For older CentOS versions, use yum
sudo yum install bind bind-utils bind-libs

# Enable and start named service
sudo systemctl enable named
sudo systemctl start named

# Check service status
sudo systemctl status named

# Install BIND9 using dnf
sudo dnf install bind bind-utils bind-libs bind-doc

# Configure firewall for DNS traffic
sudo firewall-cmd --add-service=dns --permanent
sudo firewall-cmd --reload

# Start and enable BIND9 service
sudo systemctl enable --now named

# Install BIND9 from official repositories
sudo pacman -S bind

# Start named service
sudo systemctl start named

# Enable automatic startup
sudo systemctl enable named

# Check BIND9 version
named -V

# Verify service status
sudo systemctl status named

# Test basic functionality
dig @localhost version.bind chaos txt

# Check listening ports
sudo netstat -tulnp | grep :53

# Main BIND9 configuration structure
/etc/
├── named.conf                 # Main configuration
├── named.conf.options        # Global options
├── named.conf.local         # Local zone definitions
├── named.conf.default-zones # Default zones
└── bind/
    ├── zones/              # Zone files directory
    └── keys/              # DNSSEC keys

// BIND9 Main Configuration for Linux DNS Server Setup
include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";

// Global options
options {
    directory "/var/bind";
    pid-file "/run/named/named.pid";
    
    // Listen on all interfaces
    listen-on { any; };
    listen-on-v6 { any; };
    
    // Allow queries from any client
    allow-query { any; };
    
    // Recursive queries configuration
    recursion yes;
    allow-recursion { localhost; 192.168.1.0/24; };
    
    // Forwarders for external queries
    forwarders {
        8.8.8.8;
        8.8.4.4;
    };
};

# Set correct ownership and permissions
sudo chown root:bind /etc/bind/named.conf*
sudo chmod 644 /etc/bind/named.conf*

# Secure zone files
sudo chown root:bind /etc/bind/zones/*
sudo chmod 644 /etc/bind/zones/*

# Verify permissions
ls -la /etc/bind/

// Forward zone for example.com
zone "example.com" {
    type master;
    file "/etc/bind/zones/db.example.com";
    allow-transfer { 192.168.1.100; }; // Secondary DNS server
    also-notify { 192.168.1.100; };
};

// Forward zone for subdomain
zone "internal.example.com" {
    type master;
    file "/etc/bind/zones/db.internal.example.com";
    allow-transfer { none; };
};

; BIND9 Zone file for example.com - Linux DNS Server Setup
; 
$TTL    604800
@       IN      SOA     ns1.example.com. admin.example.com. (
                        2024112601      ; Serial (YYYYMMDDNN)
                        604800          ; Refresh (1 week)
                        86400           ; Retry (1 day)
                        2419200         ; Expire (4 weeks)
                        604800 )        ; Negative Cache TTL (1 week)

; Name servers
@       IN      NS      ns1.example.com.
@       IN      NS      ns2.example.com.

; A records for nameservers
ns1     IN      A       192.168.1.10
ns2     IN      A       192.168.1.11

; Main domain A record
@       IN      A       192.168.1.20
www     IN      A       192.168.1.20

; Web services
mail    IN      A       192.168.1.25
ftp     IN      A       192.168.1.30
api     IN      A       192.168.1.35

; CNAME records (aliases)
blog    IN      CNAME   www.example.com.
shop    IN      CNAME   www.example.com.
webmail IN      CNAME   mail.example.com.

; MX records for email
@       IN      MX      10      mail.example.com.
@       IN      MX      20      backup-mail.example.com.

; TXT records for verification
@       IN      TXT     "v=spf1 include:_spf.google.com ~all"
_dmarc  IN      TXT     "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"

; Service records
_sip._tcp.example.com.   IN   SRV   10   5   5060   sip.example.com.
_http._tcp.example.com.  IN   SRV   10   5   80     www.example.com.

; Catch-all wildcard for subdomains
*.example.com.  IN  A   192.168.1.50

; IPv6 addresses
@       IN      AAAA    2001:db8::20
www     IN      AAAA    2001:db8::20
mail    IN      AAAA    2001:db8::25

; Round-robin load balancing
web     IN      A       192.168.1.40
web     IN      A       192.168.1.41
web     IN      A       192.168.1.42

# Check zone file syntax
sudo named-checkzone example.com /etc/bind/zones/db.example.com

# Check main configuration
sudo named-checkconf

# Test configuration reload
sudo systemctl reload named

# Verify zone is loaded
sudo rndc status

// Reverse zone for 192.168.1.0/24 network
zone "1.168.192.in-addr.arpa" {
    type master;
    file "/etc/bind/zones/db.192.168.1";
    allow-transfer { 192.168.1.100; };
};

// IPv6 reverse zone example
zone "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa" {
    type master;
    file "/etc/bind/zones/db.2001.db8";
};

; Reverse DNS zone for 192.168.1.0/24 - Linux DNS Server Setup
;
$TTL    604800
@       IN      SOA     ns1.example.com. admin.example.com. (
                        2024112601      ; Serial
                        604800          ; Refresh
                        86400           ; Retry
                        2419200         ; Expire
                        604800 )        ; Negative Cache TTL

; Name servers
@       IN      NS      ns1.example.com.
@       IN      NS      ns2.example.com.

; PTR records (IP to hostname mapping)
10      IN      PTR     ns1.example.com.
11      IN      PTR     ns2.example.com.
20      IN      PTR     www.example.com.
25      IN      PTR     mail.example.com.
30      IN      PTR     ftp.example.com.
35      IN      PTR     api.example.com.
40      IN      PTR     web1.example.com.
41      IN      PTR     web2.example.com.
42      IN      PTR     web3.example.com.
50      IN      PTR     wildcard.example.com.

; IPv6 Reverse DNS zone
$TTL    604800
@       IN      SOA     ns1.example.com. admin.example.com. (
                        2024112601
                        604800
                        86400
                        2419200
                        604800 )

; Name servers
@       IN      NS      ns1.example.com.
@       IN      NS      ns2.example.com.

; IPv6 PTR records (reversed nibble format)
0.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2  IN  PTR  www.example.com.
5.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2  IN  PTR  mail.example.com.

#!/bin/bash
# Generate reverse DNS entries script

NETWORK="192.168.1"
ZONE_FILE="/etc/bind/zones/db.192.168.1"
DOMAIN="example.com"

# Create hosts array
declare -A HOSTS
HOSTS[10]="ns1"
HOSTS[20]="www"
HOSTS[25]="mail"
HOSTS[30]="ftp"

# Generate PTR records
for IP in "${!HOSTS[@]}"; do
    echo "${IP}      IN      PTR     ${HOSTS[$IP]}.${DOMAIN}."
done >> $ZONE_FILE

// Define ACLs for security
acl "trusted" {
    192.168.1.0/24;     // Local network
    10.0.0.0/8;         // Private networks
    172.16.0.0/12;
    localhost;
    localnets;
};

acl "slaves" {
    192.168.1.100;      // Secondary DNS servers
    192.168.1.101;
};

options {
    // Restrict recursive queries
    allow-query { trusted; };
    allow-recursion { trusted; };
    
    // Restrict zone transfers
    allow-transfer { slaves; };
    
    // Disable version disclosure
    version "DNS Server";
    
    // Rate limiting
    rate-limit {
        responses-per-second 10;
        window 5;
    };
};

# Generate zone signing keys
sudo dnssec-keygen -a RSASHA256 -b 2048 -n ZONE example.com
sudo dnssec-keygen -a RSASHA256 -b 2048 -n ZONE -f KSK example.com

# Sign the zone
sudo dnssec-signzone -o example.com /etc/bind/zones/db.example.com

# Update named.conf to use signed zone
# file "db.example.com.signed";

# Allow DNS traffic on port 53
sudo iptables -A INPUT -p tcp --dport 53 -j ACCEPT
sudo iptables -A INPUT -p udp --dport 53 -j ACCEPT

# Restrict zone transfers to specific IPs
sudo iptables -A INPUT -p tcp --dport 53 -s 192.168.1.100 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 53 -j DROP

# Save rules
sudo iptables-save > /etc/iptables/rules.v4

# Add DNS service
sudo firewall-cmd --add-service=dns --permanent

# Create custom zone for DNS slaves
sudo firewall-cmd --new-zone=dns-slaves --permanent
sudo firewall-cmd --zone=dns-slaves --add-source=192.168.1.100 --permanent
sudo firewall-cmd --zone=dns-slaves --add-port=53/tcp --permanent

# Reload firewall
sudo firewall-cmd --reload

logging {
    channel default_debug {
        file "data/named.log";
        severity debug;
        print-time yes;
    };
    
    channel security_log {
        file "data/security.log";
        severity info;
        print-time yes;
        print-category yes;
    };
    
    category default { default_debug; };
    category security { security_log; };
    category lame-servers { null; };
};

// Response Policy Zone configuration
zone "rpz.example.com" {
    type master;
    file "rpz.zone";
    
    response-policy {
        zone "rpz.example.com";
    };
};

# Test forward resolution
dig @localhost example.com A
dig @localhost www.example.com A
dig @localhost mail.example.com MX

# Test reverse resolution
dig @localhost -x 192.168.1.20
dig @localhost -x 192.168.1.25

# Test DNSSEC validation (if enabled)
dig @localhost example.com A +dnssec +multiline

#!/bin/bash
# DNS Server Testing Script for Linux DNS Server Setup

DNS_SERVER="127.0.0.1"
DOMAIN="example.com"
LOGFILE="/var/log/dns-test.log"

echo "=== DNS Server Testing Started ===" | tee -a $LOGFILE

# Test forward DNS
echo "Testing forward DNS resolution..." | tee -a $LOGFILE
dig @$DNS_SERVER $DOMAIN A +short | tee -a $LOGFILE
dig @$DNS_SERVER www.$DOMAIN A +short | tee -a $LOGFILE

# Test MX records
echo "Testing MX records..." | tee -a $LOGFILE
dig @$DNS_SERVER $DOMAIN MX +short | tee -a $LOGFILE

# Test NS records
echo "Testing NS records..." | tee -a $LOGFILE
dig @$DNS_SERVER $DOMAIN NS +short | tee -a $LOGFILE

# Test reverse DNS
echo "Testing reverse DNS..." | tee -a $LOGFILE
dig @$DNS_SERVER -x 192.168.1.20 +short | tee -a $LOGFILE

# Test recursion
echo "Testing recursive queries..." | tee -a $LOGFILE
dig @$DNS_SERVER google.com A +short | tee -a $LOGFILE

# Performance testing
echo "Performance testing..." | tee -a $LOGFILE
time dig @$DNS_SERVER $DOMAIN A > /dev/null

echo "=== DNS Testing Completed ===" | tee -a $LOGFILE

# Install dnsperf
sudo apt install dnsperf  # Ubuntu/Debian
sudo dnf install dnsperf  # CentOS/RHEL

# Create query file
cat > queries.txt << EOF
www.example.com A
mail.example.com A
ftp.example.com A
api.example.com A
EOF

# Run performance test
dnsperf -s 127.0.0.1 -d queries.txt -l 30 -c 10

# Test from external perspective
dig @8.8.8.8 example.com NS
dig @1.1.1.1 example.com A

# Use nslookup for additional testing
nslookup example.com localhost
nslookup 192.168.1.20 localhost

# Test with host command
host example.com localhost
host 192.168.1.20 localhost

#!/bin/bash
# DNS Health Monitor Script

check_dns_response() {
    local domain=$1
    local expected_ip=$2
    
    result=$(dig @localhost $domain A +short)
    if [ "$result" = "$expected_ip" ]; then
        echo "✓ $domain resolves correctly to $expected_ip"
        return 0
    else
        echo "✗ $domain resolution failed. Got: $result, Expected: $expected_ip"
        return 1
    fi
}

# Monitor critical domains
check_dns_response "www.example.com" "192.168.1.20"
check_dns_response "mail.example.com" "192.168.1.25"

# Check service status
if systemctl is-active named >/dev/null 2>&1; then
    echo "✓ BIND9 service is running"
else
    echo "✗ BIND9 service is not running"
    sudo systemctl start named
fi

options {
    // Cache optimization
    max-cache-size 512M;
    max-cache-ttl 86400;        // 1 day
    max-ncache-ttl 3600;        // 1 hour negative caching
    
    // Query optimization
    clients-per-query 10;
    max-clients-per-query 100;
    
    // Memory optimization
    recursive-clients 1000;
    tcp-clients 100;
    
    // Network optimization
    edns-udp-size 4096;
    max-udp-size 4096;
    
    // Enable query response rate limiting
    rate-limit {
        responses-per-second 10;
        window 5;
        slip 2;
    };
};

// Allow dynamic updates with TSIG keys
zone "dynamic.example.com" {
    type master;
    file "/etc/bind/zones/db.dynamic.example.com";
    allow-update { key "ddns-key"; };
    journal "/var/bind/dynamic.example.com.jnl";
};

// TSIG key configuration
key "ddns-key" {
    algorithm hmac-sha256;
    secret "base64-encoded-secret-key-here";
};

// Internal view for local clients
view "internal" {
    match-clients { 192.168.1.0/24; };
    
    zone "example.com" {
        type master;
        file "/etc/bind/zones/internal/db.example.com";
    };
    
    // Include standard zones
    include "/etc/bind/named.conf.default-zones";
};

// External view for internet clients
view "external" {
    match-clients { any; };
    
    zone "example.com" {
        type master;
        file "/etc/bind/zones/external/db.example.com";
    };
};

; Geographic load balancing example
; Multiple A records with different weights

; North America servers
www-na  IN  A   198.51.100.10
www-na  IN  A   198.51.100.11

; Europe servers  
www-eu  IN  A   203.0.113.20
www-eu  IN  A   203.0.113.21

; Asia servers
www-asia IN A   192.0.2.30
www-asia IN A   192.0.2.31

; Main www record using GeoDNS logic
www     IN  CNAME  www-na.example.com.  ; Default to NA

; Response Policy Zone for malware protection
$TTL 60
@       SOA     localhost. root.localhost. (
                1          ; serial
                3H         ; refresh
                1H         ; retry  
                1W         ; expiry
                1H )       ; minimum

        NS      localhost.

; Block known malicious domains
malware.example.com     A       127.0.0.1
badsite.com             CNAME   .
phishing.net            A       127.0.0.1

; Wildcard blocks for entire bad domains
*.malware-domain.com    A       127.0.0.1

# Check configuration syntax
sudo named-checkconf
sudo named-checkconf -z  # Check zones too

# Common error: Missing semicolons
# Error: zone "example.com": missing semicolon
# Fix: Add semicolon at end of statements

# Check specific zone file
sudo named-checkzone example.com /etc/bind/zones/db.example.com

# Problem: Zone not updating after changes
# Cause: Forgot to increment serial number

# Fix: Update serial in SOA record
# Before: 2024112601
# After:  2024112602

# Force zone reload
sudo rndc reload example.com

# Diagnosis commands
dig @localhost example.com A
tail -f /var/log/named/named.log

# Common causes and fixes:
# 1. Zone file syntax errors
sudo named-checkzone example.com /etc/bind/zones/db.example.com

# 2. File permissions issues
sudo chown bind:bind /etc/bind/zones/db.example.com
sudo chmod 644 /etc/bind/zones/db.example.com

# 3. Zone not loaded
sudo rndc reload

# Test reverse lookup
dig @localhost -x 192.168.1.20

# Check reverse zone file
sudo named-checkzone 1.168.192.in-addr.arpa /etc/bind/zones/db.192.168.1

# Common issue: Incorrect PTR record format
# Wrong: 20 IN PTR www.example.com
# Right: 20 IN PTR www.example.com.  (note the trailing dot)

# Check if named is running
sudo systemctl status named

# Check if port 53 is listening
sudo netstat -tulnp | grep :53
sudo ss -tulnp | grep :53

# Test local connectivity
telnet localhost 53

# Check firewall rules
sudo iptables -L | grep 53
sudo firewall-cmd --list-services

# Test response time
time dig @localhost example.com A

# Check server load
top | grep named
htop -p $(pidof named)

# Monitor DNS queries
sudo tcpdump -i any port 53

# Review cache statistics
sudo rndc stats
cat /var/bind/named.stats

logging {
    channel debug_log {
        file "/var/log/named/debug.log" versions 3 size 5m;
        severity debug;
        print-time yes;
        print-severity yes;
        print-category yes;
    };
    
    category default { debug_log; };
    category queries { debug_log; };
    category security { debug_log; };
};

# Test network connectivity
ping dns-server-ip

# Trace DNS query path
dig +trace example.com A

# Test from different DNS servers
dig @8.8.8.8 example.com A
dig @1.1.1.1 example.com A

# Check DNS propagation
for server in 8.8.8.8 1.1.1.1 208.67.222.222; do
    echo "Testing $server:"
    dig @$server example.com A +short
done

# Check memory usage
ps aux | grep named
cat /proc/$(pidof named)/status | grep Vm

# Monitor file descriptors
ls -la /proc/$(pidof named)/fd | wc -l

# Check for memory leaks
valgrind --tool=memcheck named -f -g

# 1. Stop named service
sudo systemctl stop named

# 2. Check configuration
sudo named-checkconf

# 3. Fix any errors found
sudo nano /etc/named.conf

# 4. Verify zone files
for zone in /etc/bind/zones/db.*; do
    sudo named-checkzone $(basename $zone | cut -d. -f2-) $zone
done

# 5. Start service
sudo systemctl start named

# 6. Monitor logs
sudo tail -f /var/log/named/named.log

#!/bin/bash
# Emergency DNS failover script

PRIMARY_DNS="192.168.1.10"
SECONDARY_DNS="192.168.1.11"

if ! ping -c 1 $PRIMARY_DNS >/dev/null 2>&1; then
    echo "Primary DNS down, activating secondary"
    
    # Update resolv.conf
    sed -i "s/nameserver $PRIMARY_DNS/nameserver $SECONDARY_DNS/" /etc/resolv.conf
    
    # Notify monitoring system
    logger "DNS failover activated: $SECONDARY_DNS"
fi