Configure BIND as a private DNS service by binding it to the server’s internal address, allowing queries and recursion only from approved subnets, and defining any internal forward and reverse zones locally. Validate the configuration and zone files before reloading, then verify both an allowed client and a rejected outside client.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The examples below use BIND 9, an internal IPv4 network of 192.168.50.0/24, the DNS host at 192.168.50.10, and an IPv6 documentation prefix. Replace every example address with addresses from your own network.
As an Amazon Associate I earn from qualifying purchases.
Decide what the server must do
BIND can provide recursive resolution, authoritative answers for private names, or both. Decide this before writing configuration because the access policy and zone layout depend on the role.
| Design | Who may query | Who may recurse | Authoritative data | Forwarding | Views |
|---|---|---|---|---|---|
| Resolver only | Approved internal clients | The same approved clients | None beyond local configuration | Usually required for names not answered locally | Needed only when different client groups need different answers |
| Resolver plus private zones | Approved internal clients | Approved recursive clients | Internal forward and, when needed, reverse zones | Used for names outside the private zones | Optional |
| Split DNS | Separate ACLs select each view | Configured independently per view | Trusted clients can receive full internal data while other clients receive restricted data | Configured globally, per view, or per zone | Required |
Plan the network boundary
- Give the DNS host a fixed address, such as
192.168.50.10, so clients and firewall rules always target the same endpoint. - List every IPv4 and IPv6 subnet that is allowed to query. A home or laboratory network might use
192.168.50.0/24and an IPv6 ULA prefix. - Choose a namespace controlled by the local network.
home.arpais intended for home networks; an internal subdomain delegated to your organization is appropriate in a managed environment. - Decide whether reverse lookups are useful. They are required by some logging, monitoring, and access-control tools but are not needed for ordinary forward lookups.
- Do not expose an unrestricted recursive listener on a public-facing interface. Private recursion belongs on internal interfaces and behind a firewall.
Install and start BIND 9
Use the BIND package supported by the operating system. Package names, configuration paths, and service names differ between distributions, so confirm the layout after installation.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Red Hat-family systems
On Red Hat Enterprise Linux and closely related distributions, the service is normally named; a chroot installation uses named-chroot. A typical package installation is:
sudo dnf install bind bind-utils
sudo systemctl enable --now namedThe main configuration is commonly /etc/named.conf, with zone files under /var/named. If you selected a chroot package, the effective paths are under the chroot directory and the service must be managed as named-chroot.
Free tools Windows power users keep installed
One-click scans. No signup required.
Debian-family systems
Debian and Ubuntu commonly use the bind9 service and place configuration under /etc/bind. The equivalent installation pattern is:
sudo apt update
sudo apt install bind9 bind9utils dnsutils
sudo systemctl enable --now bind9Use the paths supplied by the installed package rather than copying Red Hat paths into a Debian configuration. The examples that follow show the BIND syntax; adapt filenames and service commands to your distribution.
Define a trusted ACL and resolver options
BIND ACLs are ordered address-match lists. The first applicable match determines the result, so put narrow exceptions before broad networks. A broad match placed first can grant access you intended to deny.
Add a named ACL near the top of the main configuration:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
acl "trusted" {
127.0.0.1;
192.168.50.0/24;
2001:db8:50::/64;
};2001:db8::/32 is an IPv6 documentation range. Replace it with your actual ULA or routed internal prefix. If the server has no IPv6 service, omit the IPv6 network and explicitly disable IPv6 listening as shown below.
Define resolver behavior in the options block:
options {
directory "/var/named";
listen-on { 192.168.50.10; };
listen-on-v6 { none; };
recursion yes;
allow-query { trusted; };
allow-recursion { trusted; };
forwarders {
192.0.2.53;
2001:db8::53;
};
// forward only;
};The example forwarder addresses are documentation values and must be replaced with resolvers reachable from your network and acceptable under its privacy policy. You can configure forwarders globally, inside a view, or for a particular zone.
Understand the access controls
listen-onlimits the IPv4 interfaces and addresses on which BIND accepts DNS traffic. Binding only to the internal address prevents accidental service on another interface.listen-on-v6performs the same job for IPv6. Use an internal IPv6 address or prefix when IPv6 clients are part of the design;nonedisables IPv6 listening.allow-querycontrols which clients may ask this server questions, including questions for authoritative private zones.allow-recursioncontrols which clients may use the server to resolve names it is not authoritative for. Set it explicitly instead of relying on defaults.recursion yesenables recursive service. A server that is authoritative-only should disable recursion and omit recursive client access.forwarderslists upstream resolver addresses for names that BIND cannot answer locally. Addforward only;only when policy requires BIND to use those forwarders exclusively; otherwise normal resolution fallback remains available.
BIND includes built-in ACL names such as none, any, localhost, and localnets. Do not use any for a private recursive service unless a separate, deliberate design protects it from untrusted networks.
Add an internal forward zone
A forward zone maps names to addresses and aliases. Declare the zone in the main configuration or in the appropriate view. The following example uses home.arpa and keeps the zone readable only to the trusted clients:
Recommended Free Tools
zone "home.arpa" {
type primary;
file "/var/named/home.arpa.zone";
allow-query { trusted; };
};On a Debian-family system, place the file where the package expects local zone data and use that path in the declaration. The BIND service account must be able to read the file.
Create home.arpa.zone with an SOA record, an authoritative nameserver record, and the host records you need:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
$TTL 300
@ IN SOA ns1.home.arpa. hostmaster.home.arpa. (
2026101501 ; serial YYYYMMDDnn
3600 ; refresh
600 ; retry
86400 ; expire
300 ; negative cache TTL
)
IN NS ns1.home.arpa.
ns1 IN A 192.168.50.10
nas IN A 192.168.50.20
files IN CNAME nas.home.arpa.
Maintain the zone correctly
- The SOA serial is an unsigned version number. Increment it every time you change the zone; the displayed
YYYYMMDDnnstyle uses the date followed by a change counter. - A trailing dot marks a fully qualified domain name. The dots in
ns1.home.arpa.,hostmaster.home.arpa., and the CNAME target prevent BIND from appending the zone origin a second time. $TTL 300gives ordinary records a five-minute cache lifetime. Use an explicit TTL on a record when it needs a different value.- Add AAAA records for internal IPv6 addresses when IPv6 clients should receive them. Keep private addresses in this internal zone rather than publishing them in a public zone.
- The addresses in this example are illustrative. Substitute the actual addresses of your DNS host, storage server, and other internal systems.
Add a private reverse zone
Reverse DNS maps an address back to a name through a PTR record. For the 192.168.50.0/24 network, the reverse zone name is 50.168.192.in-addr.arpa:
zone "50.168.192.in-addr.arpa" {
type primary;
file "/var/named/50.168.192.rev";
allow-query { trusted; };
};A corresponding zone file can contain:
$TTL 300
@ IN SOA ns1.home.arpa. hostmaster.home.arpa. (
2026101501 ; serial
3600 ; refresh
600 ; retry
86400 ; expire
300 ; negative cache TTL
)
IN NS ns1.home.arpa.
10 IN PTR ns1.home.arpa.
20 IN PTR nas.home.arpa.
The owner names 10 and 20 represent the final octet of each address. For a network boundary other than a /24, construct the reverse-zone name and delegation according to that boundary. Keeping private reverse zones local prevents queries for private addresses from being sent unnecessarily to the public DNS hierarchy.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Use views for split DNS
Views make BIND answer differently according to the requesting client. They are useful when a trusted LAN should receive internal records while a guest or other untrusted network must not see those records or use the trusted recursive cache.
Define separate ACLs and place each zone declaration inside the view that should serve it:
acl "trusted" {
127.0.0.1;
192.168.50.0/24;
};
acl "guests" {
192.168.60.0/24;
};
view "internal" {
match-clients { trusted; };
recursion yes;
allow-query { trusted; };
allow-recursion { trusted; };
zone "home.arpa" {
type primary;
file "/var/named/home.arpa.zone";
};
zone "50.168.192.in-addr.arpa" {
type primary;
file "/var/named/50.168.192.rev";
};
};
view "guest" {
match-clients { guests; };
recursion yes;
allow-query { guests; };
allow-recursion { guests; };
zone "home.arpa" {
type primary;
file "/var/named/guest-home.arpa.zone";
};
};The guest zone file can contain only the names that guests are permitted to resolve, or a deliberately restricted answer set. If guests should not receive recursive service, set recursion no; and omit their recursive ACL. Every zone needed by a view, including any forwarding or root-hints arrangement required by that view, must be declared in that view. Do not define the same zone outside the views or accidentally create duplicate declarations. View order matters: the first matching client ACL selects the view.
Check the configuration before reloading
Never test a major edit by restarting blindly. Check syntax and each zone file first.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
- Run the configuration checker against the active configuration path:
sudo named-checkconf /etc/named.confFor a Debian-family installation, use its active path, commonly
/etc/bind/named.conf. No output normally indicates that the syntax check passed. - Check every zone file against its origin. For example:
sudo named-checkzone home.arpa /var/named/home.arpa.zone sudo named-checkzone 50.168.192.in-addr.arpa /var/named/50.168.192.revThe command reports the parsed records and a final status. Fix an error before proceeding.
- Confirm ownership, permissions, and mandatory access-control labels where your operating system uses them. The
namedservice account needs read access to zone files and directory traversal permission on their parent directories. - Reload through the service manager or with
rndcafter the checks succeed:sudo systemctl reload named sudo rndc reloadUse
bind9instead ofnamedon systems whose service has that name. Choose one reload method;rndc reloadis useful when the control channel is configured and protected. - Inspect the service journal and BIND log after the reload:
sudo systemctl status named sudo journalctl -u named --since "10 minutes ago"Substitute the distribution’s service name. Look for zone-load failures, permission errors, duplicate zones, or view-selection mistakes.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteSpecial offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. - From an allowed client, query the server explicitly rather than relying on the client’s default resolver:
dig @192.168.50.10 nas.home.arpa A dig @192.168.50.10 -x 192.168.50.20 dig @192.168.50.10 example.net AThe first command tests the internal A record, the second tests the PTR record, and the third tests recursive or forwarded resolution.
- Repeat a query from a client outside the trusted ACL. It should receive
REFUSEDor a timeout, depending on whether the firewall drops the packet or BIND receives and rejects it. - Verify that the host is listening only on intended interfaces and that the firewall permits both UDP and TCP DNS traffic only from approved networks. DNS normally uses UDP, but TCP is required for some larger responses and protocol operations.
Troubleshoot the common failures
BIND will not start or reload
Run named-checkconf first. Missing semicolons, misspelled directives, duplicate zones, invalid view ordering, and a file path that does not exist are common causes. If syntax is valid, inspect the journal for permission failures or mandatory access-control denials. A zone file can be syntactically valid but still unreadable by the service account.
Allowed clients receive REFUSED
Check the client’s actual source address, not the address you expected it to use. Confirm that the address matches the ACL and that both allow-query and, for a recursive request, allow-recursion include that ACL. In a view configuration, verify that the client is selecting the intended view and that the zone is declared there.
Internal names return NXDOMAIN
Use dig @server name to ensure the client is asking this BIND instance rather than a router or public resolver. Confirm that the zone loaded successfully, that the record owner has the correct origin and trailing dot, and that you incremented the SOA serial before reloading. An NXDOMAIN response means the server has determined that the name does not exist; it is different from a timeout caused by transport or firewall problems.
Reverse lookups fail
Verify that the reverse-zone name matches the network boundary and address octets. For 192.168.50.20 in a /24, the query belongs in 50.168.192.in-addr.arpa and the record owner is 20. Check that a PTR record exists, the zone is loaded, and the client is querying the private BIND server.
Public names fail while internal names work
Check that the configured forwarders are reachable on the required network path, that firewall egress permits DNS traffic, and that the addresses are correct for your environment. If forward only; is enabled, BIND will not use its normal fallback behavior when those forwarders fail; remove that setting unless exclusive forwarding is intentional.
Views return unexpected answers
Review ACL order and the order of the view blocks. A client that matches an earlier view will never reach a later one. Ensure every zone used by a view is declared inside that view and that no duplicate declaration outside the views competes with it. Test each network separately with an explicit server address.
Keep the private service secure
- Keep recursion closed to trusted networks. An open recursive resolver can be abused for reflection attacks and can expose internal policy or cache data.
- Bind DNS only to intended internal interfaces and enforce the same boundary with host and network firewalls.
- Use explicit
allow-queryandallow-recursionsettings. Do not substituteanyfor a carefully defined client ACL. - Protect administrative channels such as
rndc; permit them only from management addresses and use the distribution’s secure key setup. - Do not publish private addresses in public authoritative zones. Keep internal forward and reverse data in private zones or in a trusted view.
- Review logs for unexpected source addresses, repeated refused requests, failed forwarding, and zone-load errors.
- When an internal subnet changes, update the ACL, firewall rules, view matching, and client resolver settings together. Leaving one layer unchanged can produce either outages or an unintended exposure.
Operate the server after deployment
Record the authoritative server address, approved client networks, zone filenames, and the procedure used to increment serials. Any change to a forward or reverse record should follow the same sequence: edit the file, increment its SOA serial, run the zone checker, run the configuration checker, reload, and test from an allowed client.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →If you later add IPv6, give the server an internal IPv6 address, add that prefix to the trusted ACL, configure listen-on-v6, and create AAAA records where appropriate. Test IPv4 and IPv6 clients independently because an ACL or firewall rule can permit one protocol while blocking the other.
A correctly deployed private BIND server has a narrow listening surface, explicit client and recursion policies, locally authoritative internal data where needed, and an auditable validation and reload process. Outside clients cannot use it as an unrestricted resolver, while approved clients can resolve both internal names and permitted external names.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
