To run an authoritative BIND server on Ubuntu, install the bind9 package, declare each zone in /etc/bind/named.conf.local, create and validate its zone file, restart bind9.service, and verify answers with dig. A server configured this way answers from the zone data you control; it is not automatically authoritative on the public internet until the domain’s parent or registrar delegates the domain to the nameserver addresses you operate.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
This guide builds a forward zone, adds reverse DNS, checks configuration safely, limits recursion and zone transfers, and explains when a secondary server or DNSSEC belongs in the design.
As an Amazon Associate I earn from qualifying purchases.
What an authoritative BIND server does
DNS distinguishes between an authoritative server and a recursive resolver. An authoritative server publishes the records for zones assigned to it. For a primary (also called master) zone, BIND reads those records from a local zone file and answers with the data in that file. A recursive resolver, by contrast, looks up answers on behalf of clients and caches results from other servers.
For an internet-facing authoritative-only host, keep recursion and access controls appropriate to that role. Leaving a server open for recursion can let unrelated clients use it as a resolver and can make abuse harder to contain. Review the global settings in /etc/bind/named.conf.options before exposing the service, and define narrower zone-specific settings where needed.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Ubuntu’s packaged configuration is under /etc/bind. The normal location for locally defined authoritative zones is /etc/bind/named.conf.local. The main configuration file, named.conf, combines these statements; BIND supports global options scope and zone-specific scope, with the narrower scope taking precedence.
Plan the names and addresses first
Choose the domain name, the authoritative nameserver hostname, and the addresses that will be published. The examples use example.com and documentation-only addresses from the reserved 192.0.2.0/24 range. Replace them with addresses assigned to your server before deployment.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →- Zone:
example.com. - Nameserver:
ns.example.com.(the final dot makes it a fully qualified DNS name). - Nameserver address:
192.0.2.10. - Web host address:
192.0.2.20.
If the nameserver is inside the domain it serves, the registrar may also require glue: an address supplied alongside the delegation so resolvers can find ns.example.com. Creating a zone locally does not update the parent zone or registrar delegation. Plan that external step separately.
Install BIND9 and review global options
- Update the package metadata if that is part of your normal Ubuntu maintenance routine.
- Install BIND9:
sudo apt install bind9Open /etc/bind/named.conf.options and check the global behavior before adding public zones. An authoritative-only deployment should not provide unrestricted recursion. Access controls should allow the clients you intentionally support and deny everyone else. Keep any changes to this file under configuration management, because a syntax error here prevents BIND from loading.
Ubuntu’s package also provides example files in /etc/bind. You can use their layout as a reference, but put your own zone declarations in named.conf.local and keep each zone’s data in a clearly named file.
Declare a forward zone
Edit /etc/bind/named.conf.local and add a zone statement. The type master setting identifies this server as the primary source for the zone, and file points to the local data file.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
zone "example.com" {
type master;
file "/etc/bind/db.example.com";
};The path can be different, but it must match the file you create and be readable by the BIND service. Keeping zone declarations in one file makes it easier to audit which domains the server is authoritative for.
Build the forward zone file
Create /etc/bind/db.example.com with an SOA record, an NS record, the nameserver address, and the host records clients should resolve.
$TTL 604800
@ IN SOA ns.example.com. root.example.com. (
1 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ; Negative Cache TTL
)
@ IN NS ns.example.com.
ns IN A 192.0.2.10
www IN A 192.0.2.20How to read the records
$TTL 604800supplies the default time-to-live in seconds for records that do not set one explicitly.- The SOA identifies the primary nameserver (
ns.example.com.) and the responsible mailbox in DNS form (root.example.com.). The first field inside the parentheses is the serial. - The refresh, retry, expire, and negative-cache values guide secondary synchronization and caching behavior.
- The apex NS record says which nameserver is authoritative for
example.com. - The
nsandwwwA records map hostnames to IPv4 addresses.
Use a fully qualified nameserver name with its trailing dot. Without that dot, BIND treats the name as relative to the current zone and can produce an unintended name. Increment the SOA serial every time you edit the zone. A secondary uses the serial to decide whether it needs a fresh copy, and caches also use it to recognize changed zone data.
Add other records required by your service—such as additional A or AAAA records, CNAME records, or mail-related records—using the same zone-file syntax. Ensure every hostname and target has the intended absolute or relative form; a missing trailing dot on a target that should be absolute is a common source of wrong names.
Recommended Free Tools
Add reverse DNS with an in-addr.arpa zone
Forward DNS maps names to addresses. Reverse DNS maps an IPv4 address back to a name through a zone below in-addr.arpa. Reverse labels are written with the address octets reversed. For the documentation network containing 192.168.1.20, a corresponding zone declaration is:
zone "1.168.192.in-addr.arpa" {
type master;
file "/etc/bind/db.192";
};Create /etc/bind/db.192 and place PTR records whose owner names represent the remaining octet:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
$TTL 604800
@ IN SOA ns.example.com. root.example.com. (
1 ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ; Negative Cache TTL
)
@ IN NS ns.example.com.
20 IN PTR www.example.com.In this example, the owner name 20 completes the reversed zone name and represents 192.168.1.20. Use the reverse zone that matches the address block delegated to you; the exact boundary depends on how your provider assigns reverse DNS authority. Reverse zones are optional for basic forward lookups, but they are useful for diagnostics, logging, and services that perform reverse checks.
Validate before activating changes
Check both the overall configuration and each zone before restarting BIND. Validation catches missing braces, invalid record syntax, and mismatched zone names without taking down a working service.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallsudo named-checkconf
sudo named-checkzone example.com /etc/bind/db.example.com
sudo named-checkzone 1.168.192.in-addr.arpa /etc/bind/db.192named-checkconf checks BIND’s configuration syntax. named-checkzone parses a zone file against the zone name you provide. A successful check reports the loaded serial and OK. Treat any warning or error as a release blocker until you understand and correct it. If the command says the zone name does not match, check both the argument and the zone’s owner names.
After validation, restart and inspect the service:
sudo systemctl restart bind9.service
sudo systemctl status bind9.serviceIf the restart fails, read the service’s journal output, correct the reported file or line, run the checks again, and restart only after they pass. Keeping a known-good copy of the previous zone file makes recovery straightforward.
Test authoritative answers with dig
Query the server directly rather than relying on a resolver that may still have cached data.
dig @192.0.2.10 example.com SOA
dig @192.0.2.10 www.example.com A +norecurse
dig @192.0.2.10 -x 192.0.2.20- The SOA query confirms that BIND loaded the forward zone and returns its current serial.
- The A query asks for the web address while disabling recursion. In the response flags, look for
aa, the authoritative-answer indicator, and verify the returned address. - The reverse query checks the PTR record for the address.
Also test from a separate network when firewalls or routing rules could differ between local and external clients. Confirm that UDP and TCP DNS traffic is permitted to the server as required by your network design. A successful local query proves that BIND loaded the zone; it does not prove that public resolvers will reach it.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Make the domain publicly authoritative
Public authority requires delegation at the parent zone. At your registrar or parent-zone operator, set the domain’s authoritative nameservers to the hostnames you operate and provide glue addresses when a nameserver hostname is inside the delegated domain. Wait for the parent’s delegation and cached NS data to expire before judging an external test.
Use an external dig query to inspect the delegation path, then query your server directly to separate parent-zone problems from local BIND problems. If direct queries return an authoritative answer but public queries do not, investigate delegation, glue, firewall reachability, or stale caches rather than rewriting the zone file.
Add a secondary server for resilience
A single primary has a clear operational weakness: if it is offline, clients cannot obtain fresh authoritative answers from that server. Ubuntu recommends adding a secondary server and transferring the zone to it. The secondary can continue answering while the primary is unavailable, provided the parent delegation includes both servers.
| Design | Availability | Transfer control | Operational work | Best fit |
|---|---|---|---|---|
| One primary | Answers stop when the server is unreachable or unavailable. | No inter-server transfer is required. | Simplest configuration and key management. | Small, controlled environments or initial setup. |
| Primary plus secondary | Secondary can answer during a primary outage. | Restrict transfers to the secondary’s address. | Requires synchronization, monitoring, and a second host. | Public zones and services where availability matters. |
On the primary, add an allow-transfer clause to the zone and replace the placeholder with the secondary’s address:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →zone "example.com" {
type master;
file "/etc/bind/db.example.com";
allow-transfer { SECONDARY_IP; };
};Apply the same restriction to every zone that the secondary should receive. Do not allow transfers to arbitrary clients. Configure the secondary as a slave for the zone and point it at the primary; the exact declaration belongs on the secondary host. After changing transfer policy, validate the configuration, restart BIND, and confirm that the secondary loads the same SOA serial. Include both nameservers in the parent delegation so clients can discover the backup.
Consider DNSSEC after the unsigned zone works
DNSSEC is a follow-on hardening step, not a substitute for a correct zone or delegation. Ubuntu describes DNSSEC as “a set of security extensions to DNS which allow DNS data to be verified for authenticity and integrity.” Signing adds records such as DNSKEY and RRSIG; the parent publishes a DS record to establish the chain of trust.
Ubuntu’s DNSSEC guidance starts from an existing authoritative zone and uses a writable directory such as /var/lib/bind for signed-zone operation. Plan file ownership and permissions so the BIND service can read the resulting data and write only where intended. Key generation, rollover, publication of the DS record, and monitoring for expired signatures are ongoing operational tasks. Do not enable signing on a zone you have not first validated and tested unsigned.
Common failures and recovery paths
“Zone not loaded” or a failed restart
Run sudo named-checkconf, then run named-checkzone with the exact zone name and file path. Check for an unmatched brace in named.conf.local, a typo in the filename, or a zone name that differs from the declaration. Correct the file, validate again, and restart.
The answer is not authoritative
Query the server directly with dig @SERVER_IP name type +norecurse. If the response lacks the aa flag, verify that the query reached the intended address and that the zone declaration matches the queried name. A recursive response from another resolver cannot prove that your server is authoritative.
A hostname resolves to the wrong address
Inspect the active zone file, confirm that the owner name is relative or fully qualified as intended, increment the SOA serial, validate the zone, and restart or reload BIND. Then query the server directly to avoid confusing an old cache with current data.
Reverse lookup returns NXDOMAIN
Confirm that the reverse zone matches the reversed network, that the PTR owner name contains the correct remaining octet, and that the PTR target ends with a dot when it is fully qualified. Ensure your address provider has delegated the reverse zone to your nameserver; local configuration cannot claim a reverse block that the provider still controls.
The secondary has stale data
Compare the SOA serial returned by the primary and secondary. Increment the serial after every zone edit, verify that allow-transfer includes the secondary’s actual address, and check connectivity and service logs on both hosts. An unchanged serial tells the secondary that no transfer is needed.
Quick Recap
Operational checklist
- Install
bind9and review/etc/bind/named.conf.options. - Declare each authoritative zone in
/etc/bind/named.conf.local. - Include a valid SOA, incrementing serial, NS record, nameserver address, and required host records.
- Use a matching
in-addr.arpadeclaration and PTR records for reverse DNS. - Run
named-checkconfandnamed-checkzonebefore every activation. - Restart
bind9.serviceand inspect its status. - Use direct
digqueries and check for theaaflag. - Complete parent-zone delegation and glue at the registrar or parent operator.
- For resilience, add a secondary and restrict
allow-transferto its address. - Plan DNSSEC separately, including writable signed-zone storage, DS publication, and key lifecycle management.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
