NSD Authoritative DNS Server

Synopsis #

nsd(8) is an authoritative DNS server developed by NLnet Labs and included in the OpenBSD base system. It answers queries for configured zones and does not resolve other domains for clients.

This chapter describes the configuration and management of nsd(8) on OpenBSD for serving DNS zones to the public or within internal networks.

DNS Services Comparison #

Compare NSD with the other DNS daemons available on OpenBSD:

Installation #

nsd(8) is included in the OpenBSD 8.0 base system. No external packages are required.

Enable nsd at boot:

doas rcctl enable nsd

Start the daemon:

doas rcctl start nsd

The main configuration directory is /var/nsd. Configuration files are stored in:

/var/nsd/etc/nsd.conf

Zone files are typically stored in:

/var/nsd/zones/

Configuration #

Base Configuration File #

An example minimal configuration for a domain example.com is shown below:

server:
    hide-version: yes
    zonesdir: "/var/nsd/zones"
    ip-address: 192.0.2.1

remote-control:
    control-enable: yes
    control-interface: /var/run/nsd.sock

zone:
    name: "example.com"
    zonefile: "example.com.zone"

The server: section sets daemon options, and each zone: section defines a domain to serve. Keep remote-control: enabled: OpenBSD’s rcctl uses its local Unix socket to check, reload, and stop NSD.

Once this file is created at /var/nsd/etc/nsd.conf, test it:

doas nsd-checkconf /var/nsd/etc/nsd.conf

Zone File Format #

Zone files use standard BIND-style syntax:

$ORIGIN example.com.
$TTL 3600
@   IN  SOA ns1.example.com. hostmaster.example.com. (
        2025080401 ; serial
        3600       ; refresh
        1800       ; retry
        604800     ; expire
        86400 )    ; minimum TTL
    IN  NS  ns1.example.com.
    IN  NS  ns2.example.com.
ns1 IN  A   192.0.2.1
ns2 IN  A   192.0.2.2
www IN  A   192.0.2.100

Store this file as /var/nsd/zones/example.com.zone.

Permissions #

Ensure ownership and permissions are correct:

doas chown root:_nsd /var/nsd/zones/example.com.zone
doas chmod 640 /var/nsd/zones/example.com.zone

Zone Validation and Reload #

NSD reads zone files directly; current NSD does not use the old binary zone database or nsd-control rebuild command. Validate configuration and zone data:

doas nsd-checkconf /var/nsd/etc/nsd.conf
doas nsd-checkzone example.com /var/nsd/zones/example.com.zone

Increment the zone serial when updating published records. After successful checks, reload using the configured control channel or restart the service.

DNSSEC with NSD #

NSD serves signed zone data but does not perform recursive DNSSEC validation. Signing is a separate operation. Tools such as ldns-signzone require the appropriate package, a private signing key and its public-key companion, and a signing/renewal policy. Pass key basenames as documented by the installed tool, serve the resulting signed zone, and coordinate the DS record with the parent zone. Validate signatures before publishing that DS.

Controlling NSD #

The default /var/nsd/etc/nsd.conf includes this section for local administration:

remote-control:
    control-enable: yes
    control-interface: /var/run/nsd.sock

After checking the configuration and starting NSD with the socket enabled, use:

doas nsd-control status
doas nsd-control reload

A local Unix socket does not require the TLS files generated by nsd-control-setup. Remote TCP control needs explicit configuration and protected keys. nsd-control addzone takes a configured pattern name as its second argument, not a configuration-file path. Use a static zone: entry unless dynamic zone management is required.

Logging and Debugging #

Logging is sent to syslog(3) under the daemon facility. To view logs:

doas tail -f /var/log/daemon

Increase verbosity for debugging:

server:
    verbosity: 2

Then restart the service:

doas rcctl restart nsd

Example Usage #

To serve the domain example.com:

1. Place zone file at /var/nsd/zones/example.com.zone
2. Add configuration to /var/nsd/etc/nsd.conf
3. Run:

doas nsd-checkconf
doas rcctl restart nsd

To verify:

drill @192.0.2.1 www.example.com

Summary of Key Files and Directories #