BIND DNS Server

Synopsis #

BIND (Berkeley Internet Name Domain) is a full-featured DNS server implementation maintained by ISC. Unlike unbound(8) or nsd(8), which each serve one DNS function (resolver or authoritative server), named(8) from BIND can act as both. BIND is suitable for advanced use cases that require flexible DNS views, dynamic updates, or complex zone configurations. However, due to its complexity and historical security issues, it is not included in the OpenBSD base system and must be installed from packages.

This chapter explains how to install, configure, and operate BIND on OpenBSD 8.0, including authoritative and recursive modes.

DNS Services Comparison #

To clarify BIND’s position among DNS software available on OpenBSD, consider the following table:

Installation #

BIND is not part of the OpenBSD base system. Install it using the package system:

doas pkg_add isc-bind

This installs named(8) and its configuration tools under /usr/local/, with chrooted configuration and data beneath /var/named/.

To enable BIND at boot:

doas rcctl enable isc_named

To start the service immediately:

doas rcctl start isc_named

Configuration #

The main configuration file is:

/var/named/etc/named.conf

The packaged service runs as _bind chrooted to /var/named. Paths inside named.conf are relative to that root: /etc/named.conf inside the daemon is /var/named/etc/named.conf on the host.

Example Recursive Resolver #

To configure BIND as a caching recursive resolver:

options {
    directory "/";
    allow-query { localhost; };
    recursion yes;
    allow-recursion { localhost; };
    listen-on { 127.0.0.1; };
    listen-on-v6 { ::1; };
    forwarders {
        8.8.8.8;
        1.1.1.1;
    };
};

After saving the configuration:

doas named-checkconf -t /var/named /etc/named.conf
doas rcctl restart isc_named

Use drill or dig to verify:

drill @127.0.0.1 openbsd.org

Example Authoritative Server #

For an authoritative-only server, use recursion no, explicitly select its public IPv4/IPv6 listeners, and permit queries to the published zones. Add this zone to that configuration; the loopback-only recursive example above does not expose it publicly:

zone "example.com" {
    type master;
    file "example.com.zone";
};

Create the zone file:

$ORIGIN example.com.
$TTL 3600
@   IN  SOA ns1.example.com. hostmaster.example.com. (
        2025080401 ; serial
        3600       ; refresh
        1800       ; retry
        604800     ; expire
        86400 )    ; minimum
    IN  NS  ns1.example.com.
    IN  NS  ns2.example.com.
ns1 IN  A   192.0.2.1
ns2 IN  A   192.0.2.2
www IN  A   192.0.2.100

Store this file as /var/named/example.com.zone.

Check syntax and reload:

doas named-checkzone example.com /var/named/example.com.zone
doas rcctl restart isc_named

Logging #

Logging must be explicitly enabled:

logging {
    channel default_log {
        file "/named.log";
        severity info;
        print-time yes;
    };
    category default { default_log; };
};

Ensure the directory and file are writable:

doas touch /var/named/named.log
doas chown _bind:_bind /var/named/named.log

DNSSEC Support #

BIND supports DNSSEC signing and validation. For recursive resolvers, validation is enabled by:

options {
    dnssec-validation auto;
};

For authoritative DNSSEC, configure a signing policy using the installed BIND ARM and preserve its private keys. If signing offline, point the zone’s file setting at the signed output, verify the signatures, and publish the corresponding DS record through the parent-zone operator. Reloading an unsigned input file does not enable DNSSEC. Do not publish a DS until the signed zone is being served correctly.

Runtime Control #

BIND uses rndc(8) for control:

doas rndc reload
doas rndc flush
doas rndc status

To enable rndc, generate keys and add control configuration:

include "/etc/rndc.key";

controls {
    inet 127.0.0.1 allow { localhost; } keys { "rndc-key"; };
};

Run:

doas rndc-confgen -a

This creates /etc/rndc.key on the host. The packaged rc script copies the control key into the chroot when starting the service. Keep the key private and verify rndc status.

Example Usage #

As a Local Resolver #

To use BIND locally:

1. Enable and configure with recursion yes
2. Set /etc/resolv.conf:

nameserver 127.0.0.1

As Authoritative Server #

To serve a zone:

1. Create zone section in named.conf
2. Create the zone file in /var/named
3. Test and reload configuration

Use drill to query:

drill @192.0.2.1 www.example.com

Files and Directories #

Security Considerations #

Due to its size and complexity, BIND has historically had more security vulnerabilities than minimal alternatives. It should be run in a chroot or jailed environment (OpenBSD does this via chroot(2) automatically). Prefer unbound(8) or nsd(8) when functionality permits.