BIND9 from
First Principles

  SUBSCRIBER DEVICE                  YOUR INFRASTRUCTURE              THE INTERNET
  ──────────────────                 ──────────────────────────       ─────────────────────

  Phone looks up                     [RESOLVER — Raxio DC]
  youtube.com                  ───►  Cache miss. Not seen yet.
                                     Start recursive walk.
                                                                  ───►  Root server (.)
                                                                         "Who handles .com?"
                                                                  ◄───  "Ask Verisign at 192.5.6.30"

                                                                  ───►  Verisign .com TLD
                                                                         "Who handles youtube.com?"
                                                                  ◄───  "Ask ns1.google.com"

                                     [RESOLVER]                   ───►  [AUTHORITATIVE — Google]
                                     Receives answer                     ns1.google.com
                                     Caches: youtube.com                 "A record = 142.250.185.78"
                                     A = 142.250.185.78           ◄───   aa flag set
                                     TTL: 300 seconds
  ◄────────────────────────────────  Returns answer to phone
  Phone connects to YouTube
  ──────────────────

  [30 seconds later — different subscriber]

  Another phone looks up      ─────►  [RESOLVER]
  youtube.com                          Cache HIT.
                                       Answer returned in <1ms.
                              ◄─────   No internet query needed.
  ──────────────────

  [Now — subscriber looks up sprintug.com]

  Phone looks up              ─────►  [RESOLVER — Raxio DC]
  sprintug.com                         Zone forward: "sprintug.com
                                       → ask our own auth server"
                                                                  ───►  [AUTHORITATIVE — ns1.sprintug.com]
                                                                         Your server. Your zone file.
                                                                         aa flag set.
                              ◄─────   Answer returned               ◄─── A record = 196.43.10.100
  ──────────────────

# named reads ONE entry point:
named
  └── /etc/bind/named.conf               # dispatcher — includes the rest
        ├── named.conf.options            # global tuning, forwarders, ACLs
        ├── named.conf.local              # YOUR zones (authoritative)
        └── named.conf.default-zones      # localhost + RFC zones
              └── zones.rfc1918           # included from default-zones

# Crypto & control:
bind.keys                                 # DNSSEC root KSK anchors (auto-managed)
rndc.key                                  # HMAC key for rndc control channel

# Zone data files (the actual DNS records):
db.local    db.127    db.0    db.255    db.empty
# Plus your own: db.sprintug.com, db.10.10.10.rev, etc.

// This is the primary configuration file for the BIND DNS server named.
// Please read /usr/share/doc/bind9/README.Debian for information on the
// structure of BIND configuration files in Debian/Ubuntu.

include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";

// ═══════════════════════════════════════════════════════════
// SprintUG Internet Limited — Authoritative + Resolver DNS
// Authored: David Emiru Egwell  |  AS328939
// ═══════════════════════════════════════════════════════════

// ── ACL Definitions (available to all included files) ──────
acl "trusted_resolvers" {
    10.0.0.0/8;        // All SprintUG private space
    196.43.0.0/16;     // SprintUG allocated prefixes
    41.220.0.0/16;     // Sprint Tanzania
    127.0.0.1;         // Loopback
    ::1;               // IPv6 loopback
};

acl "noc_mgmt" {
    10.255.0.0/24;     // NOC management VLAN
};

// ── Logging ─────────────────────────────────────────────────
logging {
    channel default_log {
        file "/var/log/named/named.log" versions 5 size 50m;
        severity warning;
        print-time yes;
        print-severity yes;
    };
    channel query_log {
        file "/var/log/named/query.log" versions 3 size 100m;
        severity info;
        print-time yes;
    };
    category default   { default_log; };
    category queries   { query_log;   };   // Enable for debugging only — expensive at scale
    category security  { default_log; };
};

// ── Include Chain ───────────────────────────────────────────
include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";

options {
    directory "/var/cache/bind";

    // If there is a firewall between you and nameservers you want
    // to talk to, you may need to fix the firewall to allow multiple
    // ports to talk.  See http://www.kb.cert.org/vuls/id/800113

    // If your ISP provided one or more IP addresses for stable
    // nameservers, you probably want to use them as forwarders.
    // Uncomment the following block, and insert the addresses replacing
    // the all-0's placeholder.

    // forwarders {
    //      0.0.0.0;
    // };

    dnssec-validation auto;
    listen-on-v6 { any; };
};

rate-limit {
    responses-per-second 10;        // Per-client response rate
    referrals-per-second 5;         // Referral responses
    nodata-per-second   5;         // NODATA (empty answers)
    nxdomains-per-second 5;        // NXDOMAIN rate
    errors-per-second   5;         // Error responses
    window              15;        // Sliding window in seconds
    slip                2;         // 1 in N slip through as TC (encourages TCP)
    min-table-size      500;
    max-table-size      20000;
    exempt-clients     { 127.0.0.1; 10.0.0.0/8; };
};

options {
    directory             "/var/cache/bind";
    dump-file             "/var/cache/bind/named_dump.db";
    statistics-file       "/var/log/named/named.stats";
    memstatistics-file    "/var/log/named/named_mem.stats";

    // ── Listening ──────────────────────────────────────────────
    listen-on             { 127.0.0.1; 10.10.10.1; };
    listen-on-v6          { none; };

    // ── Recursion — open only to your subscribers ─────────────
    recursion             yes;
    allow-query           { trusted_resolvers; };
    allow-recursion       { trusted_resolvers; };
    allow-query-cache     { trusted_resolvers; };
    allow-transfer        { none; };  // No zone transfers from resolver

    // ── Forwarding — NONE: full recursion from roots ──────────
    // forwarders { }; // intentionally empty

    // ── DNSSEC ─────────────────────────────────────────────────
    dnssec-validation     auto;

    // ── Cache ──────────────────────────────────────────────────
    max-cache-size        512m;
    max-cache-ttl         3600;
    max-ncache-ttl        300;

    // ── Rate Limiting (amplification defence) ─────────────────
    rate-limit {
        responses-per-second 10;
        slip                 2;
        exempt-clients      { 127.0.0.1; 10.0.0.0/8; };
    };

    // ── Source port randomisation ──────────────────────────────
    query-source          address * port *;

    // ── Misc security ──────────────────────────────────────────
    version               "not disclosed";  // Don't reveal BIND version
    hostname              "not disclosed";
    hide-identity         yes;
    hide-version          yes;
};

controls {
    inet 127.0.0.1 port 953
        allow { 127.0.0.1; }
        keys { "rndc-key"; };
};

// ═══════════════════════════════════════════════════════════
// SprintUG — Zone Declarations
// Primary authoritative for SprintUG + SprintTZ domains
// ═══════════════════════════════════════════════════════════

// ── Forward Zones ───────────────────────────────────────────
zone "sprintug.com" {
    type            master;
    file            "/etc/bind/zones/db.sprintug.com";
    allow-transfer { 196.43.10.2; };  // ns2 secondary
    notify          yes;
    also-notify    { 196.43.10.2; };
};

zone "sprinttz.co.tz" {
    type            master;
    file            "/etc/bind/zones/db.sprinttz.co.tz";
    allow-transfer { 41.220.10.2; };   // TZ secondary
    notify          yes;
};

// ── Reverse Zones (PTR records) ─────────────────────────────
// 196.43.X.X — Sprint public block
zone "43.196.in-addr.arpa" {
    type            master;
    file            "/etc/bind/zones/db.196.43.rev";
    allow-transfer { 196.43.10.2; };
};

// Internal management range 10.255.0.0/24 (NOC VLAN)
zone "0.255.10.in-addr.arpa" {
    type            master;
    file            "/etc/bind/zones/db.10.255.0.rev";
    allow-transfer { none; };
};

// ── Secondary Zones (pulled from external primaries) ────────
zone "savannah.co.tz" {
    type            slave;
    masters        { 197.250.1.10; };   // Savannah Comms primary NS
    file            "/var/cache/bind/db.savannah.co.tz";
};

// ── Zone-specific forwarding override ───────────────────────
// Route queries for internal.sprintug.local to the AD DNS server
zone "internal.sprintug.local" {
    type            forward;
    forwarders     { 10.10.10.100; };   // Windows AD DC
    forward         only;
};

zone "example.com" {

    type            master;
    // master = I own this data (primary)
    // slave  = I replicate from another NS
    // forward = pass-through to another resolver

    file            "/etc/bind/zones/db.example.com";
    // Path to the zone data file.
    // Relative to 'directory' in options if not absolute.

    allow-transfer { 203.0.113.2; };
    // Only ns2 may AXFR this zone.
    // 'none' = no transfers allowed.
    // Use TSIG keys in production for authenticated transfers.

    notify          yes;
    // When this zone changes, send NOTIFY to all NS records
    // AND anything in also-notify.

    also-notify    { 203.0.113.2; };
    // Secondary servers that should be notified on zone change.
    // Must match allow-transfer on the secondary.

    allow-update   { none; };
    // Dynamic DNS updates (DDNS). 'none' unless you use DHCP+DDNS.
    // If you enable this, restrict to a TSIG key, not an IP.
};

// prime the cache with the root zone hint
zone "." {
    type    hint;
    file    "/usr/share/dns/root.hints";
    // This file contains the 13 root server IP addresses.
    // Updated rarely. Ubuntu ships a current copy.
    // type hint = "use these to bootstrap, then cache what you learn"
};

// localhost forward lookup
zone "localhost" {
    type    master;
    file    "/etc/bind/db.local";
    // Authoritative for 'localhost' — serves A 127.0.0.1
};

// localhost reverse lookup (127.0.0.1)
zone "127.in-addr.arpa" {
    type    master;
    file    "/etc/bind/db.127";
    // PTR 1.0.0.127.in-addr.arpa → localhost
};

// 0.0.0.0 (this network — RFC 1122)
zone "0.in-addr.arpa" {
    type    master;
    file    "/etc/bind/db.0";
};

// 255.255.255.255 (broadcast — RFC 1122)
zone "255.in-addr.arpa" {
    type    master;
    file    "/etc/bind/db.255";
};

// RFC 1918 private address reverse zones
// (stops BIND from forwarding PTR queries for 10.x.x.x
//  and 192.168.x.x to the public internet)
include "/etc/bind/zones.rfc1918";

; BIND data file for local loopback interface
;
$TTL    604800   ; Default TTL: 1 week (in seconds)
; SOA record — Start of Authority. MANDATORY first record.
@       IN      SOA     localhost. root.localhost. (
                            2         ; Serial — must increment on every change
                        604800    ; Refresh — how often secondary checks for updates
                         86400    ; Retry   — how often secondary retries if refresh fails
                       2419200   ; Expire  — secondary stops answering if no contact for this long
                        604800 ) ; Negative Cache TTL — how long NXDOMAIN is cached
@       IN      NS      localhost.   ; Name server for this zone
@       IN      A       127.0.0.1    ; localhost → 127.0.0.1
@       IN      AAAA    ::1          ; localhost → ::1 (IPv6)

; BIND reverse data file for local loopback interface
$TTL    604800
@       IN      SOA     localhost. root.localhost. (
                            1         ; Serial
                        604800
                         86400
                       2419200
                        604800 )
@       IN      NS      localhost.
1       IN      PTR     localhost.   ; 127.0.0.1 → "localhost."
; Note: only the last octet is written here because the zone
; name "127.in-addr.arpa" already provides the context.

$TTL    86400
@       IN      SOA     localhost. root.localhost. (
                            1
                        604800
                         86400
                       2419200
                         86400 )
@       IN      NS      localhost.
; No PTR records — this zone intentionally empty.
; It exists to answer queries authoritatively with NXDOMAIN
; rather than forwarding to the public internet.

$TTL    3600           ; Default TTL: 1 hour
$ORIGIN sprintug.com.  ; All unqualified names are relative to this

; ── SOA ──────────────────────────────────────────────────────
@   IN  SOA     ns1.sprintug.com.  hostmaster.sprintug.com. (
                    2024031501    ; Serial: YYYYMMDDNN format
                        3600    ; Refresh: 1 hour
                         900    ; Retry:   15 min
                      604800    ; Expire:  1 week
                        300 )  ; Negative TTL: 5 min

; ── Name Servers ─────────────────────────────────────────────
@           IN  NS      ns1.sprintug.com.
@           IN  NS      ns2.sprintug.com.

; ── Glue Records (A records for the NS themselves) ───────────
ns1         IN  A       196.43.10.1     ; Primary NS
ns2         IN  A       196.43.10.2     ; Secondary NS

; ── Mail ─────────────────────────────────────────────────────
@           IN  MX  10  mail.sprintug.com.
@           IN  MX  20  mail2.sprintug.com.
mail        IN  A       196.43.10.10
mail2       IN  A       196.43.10.11

; ── SPF / DMARC ──────────────────────────────────────────────
@           IN  TXT     "v=spf1 mx ip4:196.43.10.0/24 -all"
_dmarc      IN  TXT     "v=DMARC1; p=quarantine; rua=mailto:[email protected]"

; ── Web ──────────────────────────────────────────────────────
@           IN  A       196.43.10.100   ; Root domain → web server
www         IN  CNAME   sprintug.com.   ; www → root
portal      IN  A       196.43.10.101   ; Customer portal
noc         IN  A       10.255.0.10     ; Internal only — NOC dashboard

; ── Infrastructure ───────────────────────────────────────────
raxio-mx1   IN  A       196.43.1.1      ; MX80 — Raxio DC
raxio-mx2   IN  A       196.43.1.2      ; MX204 — Raxio DC
airtel-bng  IN  A       196.43.2.1      ; BNG — Airtel House

; ── Radius / AAA ─────────────────────────────────────────────
radius1     IN  A       10.255.0.50
radius2     IN  A       10.255.0.51

; ── Zabbix ───────────────────────────────────────────────────
zabbix      IN  A       10.255.0.60

$TTL    3600
; Zone: 43.196.in-addr.arpa
@   IN  SOA     ns1.sprintug.com.  hostmaster.sprintug.com. (
                    2024031501
                        3600
                         900
                      604800
                        300 )

@           IN  NS  ns1.sprintug.com.
@           IN  NS  ns2.sprintug.com.

; PTR records — only last two octets in 43.196.in-addr.arpa context
1.10        IN  PTR raxio-mx1.sprintug.com.    ; 196.43.10.1
2.10        IN  PTR raxio-mx2.sprintug.com.    ; 196.43.10.2
1.2         IN  PTR airtel-bng.sprintug.com.   ; 196.43.2.1
10.10       IN  PTR mail.sprintug.com.         ; 196.43.10.10
100.10      IN  PTR portal.sprintug.com.       ; 196.43.10.100

key "rndc-key" {
    algorithm hmac-sha256;
    secret    "base64-encoded-secret-here==";
    // Generated by: rndc-confgen -a
    // File permissions must be: -rw-r----- bind:bind (640)
};

# Generate rndc.key automatically (writes to /etc/bind/rndc.key)
rndc-confgen -a -b 512

# Verify permissions
ls -la /etc/bind/rndc.key
# Should be: -rw-r----- root bind
chown root:bind /etc/bind/rndc.key
chmod 640 /etc/bind/rndc.key

// This file is managed by BIND itself.
// Manual edits will be overwritten.
// Trust anchor for the DNS root zone — IANA-published KSKs.

trust-anchors {
    // KSK-2010 (retired) and KSK-2017 (current)
    "."    initial-key 257 3 8
        "AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTO
         iW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN
         7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5L
         KyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3tCt
         ...base64-continues...";
};

// RFC 1918 private address space
// These empty zones prevent PTR queries for private IPs
// from leaking to the public DNS infrastructure.

zone "10.in-addr.arpa"           { type master; file "/etc/bind/db.empty"; };
zone "16.172.in-addr.arpa"       { type master; file "/etc/bind/db.empty"; };
zone "17.172.in-addr.arpa"       { type master; file "/etc/bind/db.empty"; };
// ... 172.16.0.0/12 covered across 172.16–172.31
zone "168.192.in-addr.arpa"       { type master; file "/etc/bind/db.empty"; };

// RFC 6598 — Shared Address Space (CGNAT — 100.64.0.0/10)
zone "64.100.in-addr.arpa"       { type master; file "/etc/bind/db.empty"; };
// ... continues through 100.127.x.x

// APIPA — 169.254.0.0/16 (link-local)
zone "254.169.in-addr.arpa"       { type master; file "/etc/bind/db.empty"; };

options {
    directory               "/var/cache/bind";
    dump-file               "/var/cache/bind/named_dump.db";
    statistics-file         "/var/log/named/named.stats";

    listen-on               { 127.0.0.1; 10.10.10.1; };
    listen-on-v6            { none; };

    // Performance — small server
    recursive-clients       1000;      // Max simultaneous recursive queries
    tcp-clients             150;       // Max simultaneous TCP connections

    // Cache sizing
    max-cache-size          512m;
    max-cache-ttl           3600;
    max-ncache-ttl          300;

    // Recursion: subscribers only
    recursion               yes;
    allow-query             { trusted_resolvers; };
    allow-recursion         { trusted_resolvers; };
    allow-query-cache       { trusted_resolvers; };
    allow-transfer          { none; };

    // Full recursion — no external forwarders
    dnssec-validation       auto;
    query-source            address * port *;

    // Security hardening
    version                 "not disclosed";
    hide-identity           yes;
    hide-version            yes;

    rate-limit {
        responses-per-second   10;
        slip                   2;
        window                 15;
        exempt-clients        { 127.0.0.1; 10.0.0.0/8; };
    };
};

controls {
    inet 127.0.0.1 port 953
        allow { 127.0.0.1; }
        keys { "rndc-key"; };
};

# 1. Edit the zone file, increment the serial
nano /etc/bind/zones/db.sprintug.com

# 2. Validate the zone syntax
named-checkzone sprintug.com /etc/bind/zones/db.sprintug.com

# 3. Validate all config files
named-checkconf

# 4. Reload just that zone (no service disruption)
rndc reload sprintug.com

# 5. Verify it loaded
rndc zonestatus sprintug.com

# 6. Test from a client
dig @10.10.10.1 sprintug.com A
dig @10.10.10.1 -x 196.43.10.1

┌─────────────────────────────────────────────────────────┐
│                    ANYCAST RESOLVER CLUSTER              │
│  BGP-anycast 196.43.53.1/32 and 196.43.53.2/32          │
│                                                          │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐     │
│  │  resolver-1 │  │  resolver-2 │  │  resolver-3 │     │
│  │  Raxio DC   │  │  Airtel     │  │  Wingu TZ   │     │
│  │  named inst │  │  named inst │  │  named inst │     │
│  │  32GB cache │  │  32GB cache │  │  32GB cache │     │
│  └─────────────┘  └─────────────┘  └─────────────┘     │
└─────────────────────────────────────────────────────────┘
                         │ forwards queries for
                         │ your own zones only
                         ▼
┌─────────────────────────────────────────────────────────┐
│               AUTHORITATIVE NS CLUSTER                   │
│  ns1.sprintug.com  (primary)   196.43.10.1               │
│  ns2.sprintug.com  (secondary) 196.43.10.2               │
│  No recursion. No cache. Pure auth only.                 │
└─────────────────────────────────────────────────────────┘

options {
    directory                 "/var/cache/bind";
    dump-file                 "/var/cache/bind/named_dump.db";
    statistics-file           "/var/log/named/named.stats";

    listen-on                 { 196.43.53.1; 127.0.0.1; };
    listen-on-v6              { any; };

    // ── Threading ────────────────────────────────────────────
    // Match to physical CPU count on the resolver node.
    // Each task-cpus thread handles queries independently.
    task-cpus                 32;            // Adjust to your CPU count
    tcp-listen-queue          1024;
    clients-per-query         100;
    max-clients-per-query     1000;
    recursive-clients         500000;       // 500K simultaneous recursive
    tcp-clients               10000;

    // ── Cache — sized for the working set ────────────────────
    // At national scale the working set is ~2M unique names.
    // Each cache entry is ~200 bytes → 400MB minimum useful cache.
    // Larger cache = better hit rate = fewer upstream queries.
    max-cache-size            32g;          // 32GB on a 128GB node
    max-cache-ttl             3600;
    max-ncache-ttl            300;
    min-cache-ttl             30;           // Floor on low-TTL records

    // ── Recursion ─────────────────────────────────────────────
    recursion                 yes;
    allow-query               { trusted_resolvers; };
    allow-recursion           { trusted_resolvers; };
    allow-query-cache         { trusted_resolvers; };
    allow-transfer            { none; };

    // ── FULL RECURSION — no external forwarders ──────────────
    dnssec-validation         auto;

    // ── Source port randomisation ─────────────────────────────
    query-source              address * port *;
    use-queryport-pool        yes;
    queryport-pool-ports      8192;         // Large ephemeral port pool
    queryport-pool-updateinterval 10;

    // ── TCP performance ──────────────────────────────────────
    tcp-initial-timeout       300;          // 30 seconds in units of 0.1s
    tcp-idle-timeout          3000;
    tcp-keepalive-timeout     3000;
    tcp-advertised-timeout    3000;

    // ── Stale cache (serve-stale) ─────────────────────────────
    // If upstream unreachable, serve expired cache up to 1 day.
    // Massive resilience win for subscriber experience.
    stale-answer-enable       yes;
    stale-answer-ttl          30;
    max-stale-ttl             86400;        // Stale for up to 24 hours

    // ── Rate Limiting ─────────────────────────────────────────
    rate-limit {
        responses-per-second   50;
        referrals-per-second   20;
        nodata-per-second      20;
        nxdomains-per-second   20;
        errors-per-second      20;
        slip                   2;
        window                 15;
        min-table-size         10000;
        max-table-size         200000;
        exempt-clients        { 127.0.0.1; };
    };

    // ── Security ──────────────────────────────────────────────
    version                   "not disclosed";
    hide-identity             yes;
    hide-version              yes;
};

controls {
    inet 127.0.0.1 port 953
        allow { 127.0.0.1; 10.255.0.0/24; }
        keys { "rndc-key"; };
};

options {
    directory             "/var/cache/bind";

    listen-on             { 196.43.10.1; 127.0.0.1; };
    listen-on-v6          { any; };

    // ── CRITICAL: No recursion on authoritative servers ───────
    recursion             no;
    allow-query           { any; };     // Anyone can query our zones
    allow-recursion       { none; };    // Nobody gets recursive service
    allow-transfer        { 196.43.10.2; }; // ns2 only

    // ── DNSSEC signing (if signing your zones) ────────────────
    dnssec-validation     auto;

    // ── Cache — not needed, but set a floor to avoid 0-byte alloc
    max-cache-size        32m;

    version               "not disclosed";
    hide-identity         yes;
    hide-version          yes;

    rate-limit {
        responses-per-second 100;
        slip                 2;
    };
};

# UDP receive/send buffer — critical for high-QPS DNS
net.core.rmem_max = 134217728
net.core.wmem_max = 134217728
net.core.rmem_default = 33554432
net.core.wmem_default = 33554432

# Increase max open files (each query = 1 socket fd)
fs.file-max = 2097152

# Ephemeral port range — more ports = better randomisation
net.ipv4.ip_local_port_range = 1024 65535

# Time-wait socket reuse
net.ipv4.tcp_tw_reuse = 1

# Increase backlog
net.core.somaxconn = 65535
net.ipv4.tcp_max_syn_backlog = 65535

[Service]
LimitNOFILE=1048576    # Open files — 1 million
LimitNPROC=65536       # Max threads
LimitMEMLOCK=infinity  # Allow named to lock cache in RAM

# Query rate from named statistics (after rndc stats)
grep "queries resulted in" /var/log/named/named.stats

# Cache hit ratio — the key performance indicator
# (cache hits / total queries) × 100 → target >85% at scale

# Real-time QPS monitoring
watch -n1 'rndc stats && grep "query (cache)" /var/log/named/named.stats | tail -5'

# Named statistics over HTTP (enable in options)
# Add to named.conf.options:
# statistics-channels { inet 127.0.0.1 port 8080 allow { 127.0.0.1; }; };
curl http://127.0.0.1:8080/json/v1/server

/opt/dns/
├── docker-compose.yml          # The orchestration file — your source of truth
├── config/                     # Mounted to /etc/bind/ inside the container
│   ├── named.conf
│   ├── named.conf.options
│   ├── named.conf.local
│   ├── named.conf.default-zones
│   ├── bind.keys
│   ├── rndc.key
│   ├── db.local
│   ├── db.127
│   ├── db.0
│   ├── db.255
│   ├── db.empty
│   ├── zones.rfc1918
│   └── zones/
│       ├── db.sprintug.com
│       └── db.196.43.rev
└── logs/                       # Mounted to /var/log/named/ inside the container
    ├── named.log
    └── query.log

# Create it:
mkdir -p /opt/dns/config/zones /opt/dns/logs
chown -R 101:101 /opt/dns/logs   # UID 101 = bind user inside the container

# Remove any old Docker packages
apt remove -y docker.io docker-doc docker-compose docker-compose-v2 \
              podman-docker containerd runc 2>/dev/null

# Add Docker's official repository
apt install -y ca-certificates curl
install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
     -o /etc/apt/keyrings/docker.asc
chmod a+r /etc/apt/keyrings/docker.asc

echo \
  "deb [arch=$(dpkg --print-architecture) \
  signed-by=/etc/apt/keyrings/docker.asc] \
  https://download.docker.com/linux/ubuntu \
  $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
  tee /etc/apt/sources.list.d/docker.list > /dev/null

apt update
apt install -y docker-ce docker-ce-cli containerd.io \
               docker-buildx-plugin docker-compose-plugin

# Verify
docker version
docker compose version

version: "3.9"

services:

  # ── Primary nameserver: authoritative + recursive ────────────
  bind9:
    image: internetsystemsconsortium/bind9:9.18
    container_name: sprintug-dns
    restart: unless-stopped

    # Port mapping: host:container
    # UDP and TCP both required for DNS
    ports:
      - "53:53/udp"
      - "53:53/tcp"
      - "127.0.0.1:953:953/tcp"    # rndc — localhost only on the host

    volumes:
      # Config files: read-only into /etc/bind
      - ./config:/etc/bind:ro
      # Log files: read-write
      - ./logs:/var/log/named:rw

    # Capabilities BIND9 needs
    # CAP_NET_BIND_SERVICE: bind to port 53 (below 1024)
    cap_add:
      - NET_BIND_SERVICE

    # Resource limits — prevent this container consuming all RAM
    # on a shared host
    deploy:
      resources:
        limits:
          memory: 1g       # Hard ceiling: 1GB RAM
          cpus: "2.0"      # Max 2 CPU cores
        reservations:
          memory: 256m     # Guarantee 256MB

    # Health check: ask named if it is alive every 30 seconds
    # dig @127.0.0.1 . SOA is a lightweight always-valid query
    healthcheck:
      test: ["CMD", "dig", "@127.0.0.1", ".", "SOA", "+time=3"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s

    # Log driver: send named stdout/stderr to journald on the host
    # so you can read them with: journalctl -u docker -f
    logging:
      driver: journald
      options:
        tag: "sprintug-dns"

    # Timezone — important for log timestamps
    environment:
      - TZ=Africa/Kampala

version: "3.9"

# Internal network — containers talk to each other on this
# without being exposed to the host network
networks:
  dns-internal:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.53.0/24

services:

  # ── 1. Authoritative nameserver ──────────────────────────────
  # Serves your zones only. No recursion. No cache.
  # NOT exposed directly on port 53 — only the resolver talks to it.
  bind9-auth:
    image: internetsystemsconsortium/bind9:9.18
    container_name: sprintug-auth
    restart: unless-stopped
    networks:
      dns-internal:
        ipv4_address: 172.20.53.10    # Fixed IP on internal network
    ports:
      - "127.0.0.1:5353:53/udp"      # Only accessible from host loopback
      - "127.0.0.1:5353:53/tcp"      # for rndc and debug — not public
    volumes:
      - ./config/auth:/etc/bind:ro   # Separate config dir for auth
      - ./logs/auth:/var/log/named:rw
    cap_add:
      - NET_BIND_SERVICE
    deploy:
      resources:
        limits:
          memory: 512m
          cpus: "2.0"
    healthcheck:
      test: ["CMD", "dig", "@127.0.0.1", "sprintug.com", "SOA", "+time=3"]
      interval: 30s
      timeout: 10s
      retries: 3
    environment:
      - TZ=Africa/Kampala

  # ── 2. Recursive resolver ────────────────────────────────────
  # Serves subscribers. Full recursion from root hints.
  # Forwards queries for internal zones to bind9-auth above.
  # This is the container whose port 53 is exposed publicly.
  bind9-resolver:
    image: internetsystemsconsortium/bind9:9.18
    container_name: sprintug-resolver
    restart: unless-stopped
    depends_on:
      bind9-auth:
        condition: service_healthy   # Wait for auth to be healthy first
    networks:
      dns-internal:
        ipv4_address: 172.20.53.20
    ports:
      - "53:53/udp"                  # PUBLIC — subscriber-facing
      - "53:53/tcp"
      - "127.0.0.1:953:953/tcp"      # rndc control — host only
    volumes:
      - ./config/resolver:/etc/bind:ro
      - ./logs/resolver:/var/log/named:rw
    cap_add:
      - NET_BIND_SERVICE
    deploy:
      resources:
        limits:
          memory: 2g
          cpus: "4.0"
        reservations:
          memory: 512m
    healthcheck:
      test: ["CMD", "dig", "@127.0.0.1", "google.com", "A", "+time=3"]
      interval: 30s
      timeout: 10s
      retries: 3
    environment:
      - TZ=Africa/Kampala

// In the resolver container, forward queries for your own domains
// to the auth container at its fixed IP on the internal network.
// The resolver handles everything else via full recursion.

zone "sprintug.com" {
    type    forward;
    forward only;
    forwarders { 172.20.53.10; };  // bind9-auth container IP
};

zone "sprinttz.co.tz" {
    type    forward;
    forward only;
    forwarders { 172.20.53.10; };
};

zone "43.196.in-addr.arpa" {
    type    forward;
    forward only;
    forwarders { 172.20.53.10; };
};

# ── Start / Stop ────────────────────────────────────────────
cd /opt/dns
docker compose up -d                  # Start all containers in background
docker compose down                   # Stop and remove containers (config safe)
docker compose restart bind9-resolver # Restart one container

# ── After editing a zone file ───────────────────────────────
# 1. Validate on the host (named-checkzone must be installed)
named-checkzone sprintug.com /opt/dns/config/zones/db.sprintug.com

# 2. Reload named inside the container without restart
docker exec sprintug-auth rndc reload sprintug.com

# 3. Verify it loaded
docker exec sprintug-auth rndc zonestatus sprintug.com

# ── After editing named.conf.options ───────────────────────
docker exec sprintug-auth rndc reconfig

# ── View live logs ──────────────────────────────────────────
docker compose logs -f bind9-auth
docker compose logs -f bind9-resolver
# Or from journald if you used that log driver:
journalctl -t sprintug-dns -f

# ── Get a shell inside the container (for debugging) ───────
docker exec -it sprintug-auth /bin/bash
# From inside you can run: dig, rndc, cat /etc/bind/named.conf

# ── Check resource usage ────────────────────────────────────
docker stats sprintug-auth sprintug-resolver

# ── Upgrade BIND9 ───────────────────────────────────────────
# Change image tag in docker-compose.yml, then:
docker compose pull
docker compose up -d
# Containers are recreated with new image. Config untouched.

# ── Test from outside the container ────────────────────────
dig @127.0.0.1 sprintug.com SOA
dig @YOUR-HOST-IP google.com A

# Start from the official BIND9 image
FROM internetsystemsconsortium/bind9:9.18

# Add dnsutils so rndc and dig are available inside the container
RUN apt-get update && apt-get install -y --no-install-recommends \
    dnsutils \
    && rm -rf /var/lib/apt/lists/*

# Copy your config into the image
# Use this pattern when deploying to remote PoPs where
# you cannot guarantee the config directory is present.
COPY config/ /etc/bind/

# Create log directory with correct ownership
RUN mkdir -p /var/log/named && chown bind:bind /var/log/named

# named runs as UID 101 (bind) inside the container
USER bind

# named is the entrypoint — this is what runs when the container starts
ENTRYPOINT ["/usr/sbin/named"]
CMD ["-g", "-u", "bind"]
# -g = run in foreground (required for Docker)
# -u bind = run as bind user

# Ask BIND what version it is running
dig version.bind chaos txt @ns1.sprintug.com
# Without hardening returns: "9.18.12-1ubuntu1"
# Attacker now knows exactly which CVEs apply to your build.

# Request a full zone transfer
dig axfr sprintug.com @ns1.sprintug.com
# Without hardening: every A, MX, CNAME, TXT record in your zone.
# noc.sprintug.com, radius1.sprintug.com, zabbix.sprintug.com —
# a complete labelled map of your infrastructure in one command.

# Test whether your resolver answers the entire internet
dig @ns1.sprintug.com google.com A
# If you get an answer: your resolver is open.
# You are available as a DDoS amplification platform.

// Identity
version               "not disclosed";
hostname              "not disclosed";
hide-version          yes;
hide-identity         yes;

// Access control — closes open resolver
recursion             yes;
allow-recursion       { trusted_resolvers; };
allow-query           { trusted_resolvers; };
allow-query-cache     { trusted_resolvers; };
allow-transfer        { none; };

// Cache poisoning
dnssec-validation     auto;
query-source          address * port *;
use-queryport-pool    yes;
queryport-pool-ports  8192;

// Amplification
rate-limit {
    responses-per-second  10;
    referrals-per-second  5;
    nodata-per-second     5;
    nxdomains-per-second  5;
    slip                  2;
    exempt-clients       { 127.0.0.1; 10.0.0.0/8; };
};

// Resource exhaustion
recursive-clients      10000;
clients-per-query      10;
max-clients-per-query  100;
resolver-query-timeout 10000;

// Resilience during attacks
stale-answer-enable    yes;
stale-answer-ttl       30;
max-stale-ttl          86400;

# 1. Version hidden
dig version.bind chaos txt @YOUR-SERVER
# Expect: "not disclosed"

# 2. Resolver closed
dig @YOUR-SERVER google.com A       # from outside your ACL
# Expect: status: REFUSED

# 3. Zone transfer blocked
dig axfr sprintug.com @YOUR-SERVER
# Expect: Transfer failed or connection refused

# 4. DNSSEC validation active
dig @YOUR-SERVER google.com A +dnssec
# Expect: flags include "ad" (authenticated data)

# 5. Source port randomisation active
tcpdump -i eth0 -nn 'udp and dst port 53' -c 20
# Expect: source ports vary — not fixed to one value

# 6. Dangling CNAMEs
while IFS= read -r t; do
    [ -z "$(dig "$t" A +short +time=3)" ] && echo "DANGLING: $t"
done < <(grep -i CNAME /etc/bind/zones/db.sprintug.com | awk '{print $NF}')
# Expect: no output

SIGNING (done by the zone owner, on the authoritative server):

  1. Take the DNS record you want to sign
     e.g.  sprintug.com.  A  196.43.10.100

  2. Run it through a hash function (SHA-256)
     Produces a fixed-length fingerprint of the data:
     e.g.  8f14e45fceea167a5a36dedd4bea2543...

  3. Encrypt that fingerprint with your PRIVATE key
     The result is the signature.

  4. Publish the signature alongside the record in your zone.
     Anyone who has your PUBLIC key can verify it.

VERIFICATION (done by the resolver, on behalf of your subscriber):

  1. Resolver receives the DNS record AND its signature.

  2. Decrypts the signature using the PUBLIC key (published in DNS).
     Recovers the original fingerprint.

  3. Independently hashes the received record.
     Gets its own fingerprint.

  4. Compares the two fingerprints.
     If they match: the record is genuine. Nobody tampered with it.
     If they differ: the record was altered. Resolver discards it → SERVFAIL.

What an attacker cannot do:
  They cannot produce a valid signature for a forged record
  without possessing the private key.
  The private key never leaves your server.
  The forgery is mathematically detectable.

; Zone contains: sprintug.com, mail.sprintug.com, www.sprintug.com
; NSEC chain (alphabetical order, loops at end):

sprintug.com.      NSEC  mail.sprintug.com.  A NS MX SOA RRSIG NSEC DNSKEY
; "After sprintug.com the next name is mail.sprintug.com"
; "sprintug.com has these record types: A NS MX SOA RRSIG NSEC DNSKEY"

mail.sprintug.com. NSEC  www.sprintug.com.   A RRSIG NSEC
; "After mail the next name is www"
; If someone queries noc.sprintug.com, it falls between mail and www.
; The resolver receives this NSEC record, verifies its signature,
; and proves noc does not exist — without you ever having to say so directly.

www.sprintug.com.  NSEC  sprintug.com.       A RRSIG NSEC
; Chain loops back to the start (last name → first name)

// A dnssec-policy block defines the key parameters and rotation schedule.
// Define it once, apply it to any number of zones.

dnssec-policy "sprintug-policy" {

    // How long signatures (RRSIG records) are valid.
    // Resolver caches will serve signed responses for this long.
    // 14 days is standard — long enough to survive a weekend outage.
    signatures-validity          14d;

    // How far in advance to re-sign records before signatures expire.
    // 5 days gives you a comfortable window to detect and fix problems
    // before any signature actually expires.
    signatures-refresh           5d;

    // Key parameters
    keys {
        // KSK: larger key, rotated annually (365 days)
        ksk lifetime 365d algorithm ecdsap256sha256;

        // ZSK: smaller key (same algorithm), rotated every 90 days
        zsk lifetime 90d  algorithm ecdsap256sha256;
    };

    // Use NSEC3 instead of NSEC — prevents zone walking
    nsec3param iterations 0 optout no salt-length 8;
    // iterations 0 = one hash round — NIST-recommended, avoids CPU DoS
    // optout no  = sign every record including empty non-terminals
    // salt-length 8 = 8 bytes of random salt per zone

    // DNSKEY TTL — how long resolvers cache your public keys
    dnskey-ttl                   3600;

    // DS TTL — this should match what your registrar publishes
    ds-ttl                       3600;

    // Zone propagation delay — time for changes to reach all secondaries.
    // BIND waits this long during key rollovers to ensure new keys
    // are propagated before retiring old ones.
    zone-propagation-delay       300;

    // Maximum zone TTL — the longest TTL in your zone.
    // BIND needs this to know how long old signatures must remain valid
    // during rollovers (cached answers may live this long).
    max-zone-ttl                 3600;
};

// BIND also ships a built-in "default" policy which is a sensible baseline:
//   dnssec-policy "default";
// It uses ECDSAP256SHA256, 1 year KSK, 1 year ZSK, NSEC3.
// Using your own named policy gives you explicit control over rotation timing.

zone "sprintug.com" {
    type           master;
    file           "/etc/bind/zones/db.sprintug.com";

    // Attach the DNSSEC policy — this is the only change needed.
    // BIND will generate keys, sign the zone, and manage rollovers
    // automatically from this point forward.
    dnssec-policy  "sprintug-policy";

    // inline-signing is implied by dnssec-policy — BIND maintains
    // a signed copy of your zone internally without modifying
    // your zone file. You continue editing the unsigned source file normally.

    allow-transfer { key "transfer-key-sprintug"; };
    notify         yes;
};

# Reload configuration
rndc reconfig

# BIND will immediately:
# 1. Generate a KSK and ZSK for the zone
# 2. Sign every record set in the zone
# 3. Add DNSKEY, RRSIG, and NSEC3 records
# Watch the logs to confirm:
journalctl -u named -f | grep -i "dnssec\|signing\|keygen"

# Verify the zone is signed — look for RRSIG records
dig @127.0.0.1 sprintug.com DNSKEY +short
# Should return two DNSKEY records: one with flag 257 (KSK), one with 256 (ZSK)

dig @127.0.0.1 sprintug.com A +dnssec
# Should return the A record AND an RRSIG record beneath it

# Check where BIND stored the keys it generated
ls -la /var/cache/bind/K*.key /var/cache/bind/K*.private
# You will see files like:
# Ksprintug.com.+013+12345.key     (public key — safe to share)
# Ksprintug.com.+013+12345.private (PRIVATE KEY — never share, back this up)

# Show the full DNSSEC status of a zone: active keys,
# scheduled rollovers, signature expiry times
rndc dnssec -status sprintug.com

# Show DNSKEY records published in the zone (flag 257=KSK, 256=ZSK)
dig @127.0.0.1 sprintug.com DNSKEY

# Check signature expiry on a specific record
dig @127.0.0.1 sprintug.com A +dnssec | grep RRSIG
# The RRSIG record contains: algorithm, key tag, inception date, expiry date
# Expiry must be in the future — if it is in the past, signatures have expired

# Check whether the DS record at the parent matches your KSK
dig sprintug.com DS +short            # what the parent publishes
dnssec-dsfromkey Ksprintug.com.+013+NNNNN.key   # what your KSK produces
# These must match. If they do not: chain is broken.

# Full end-to-end DNSSEC verification from the root
dig @127.0.0.1 sprintug.com A +dnssec +cd
# +cd = checking disabled — shows the raw chain for debugging
# Without +cd: a broken chain returns SERVFAIL with no useful error

# Check NSEC3 is in place (should see NSEC3PARAM record)
dig @127.0.0.1 sprintug.com NSEC3PARAM