Set Up a BIND DNS Server on Linux

By Kokil Thapa | Last reviewed: September 2026

When you need full control over hostname resolution, you set up a BIND DNS server on Linux instead of relying only on a registrar panel. Managed DNS from Cloudflare or your domain registrar works fine for most sites. Self-hosted BIND makes sense when you run private zones, staging hostnames, split-horizon routing, or internal service discovery on a VPS. I've deployed BIND on Ubuntu servers for client infrastructure where Laravel apps, mail, and staging environments all needed predictable internal names. This guide walks through a working authoritative setup you can copy on Ubuntu 22.04 or 24.04.

When should you set up a BIND DNS server on Linux?

Not every project needs its own nameserver. A registrar or CDN DNS panel handles public records with less ops overhead. BIND earns its place when requirements go beyond simple A and CNAME entries.

Common reasons to run BIND on a Linux box:

• Private internal zones — resolve db.internal or api.staging without exposing names publicly.
• Split-horizon DNS — return a private IP to office clients and a public IP to everyone else.
• Lab and staging — mirror production DNS locally before cutover.
• Learning and compliance — some teams must host DNS inside their own network boundary.
• Backup resolver — a local caching resolver reduces upstream dependency during outages.

If you only publish a marketing site and one API, stick with managed DNS. Pair that with our guide on DNS record types explained and domain registration and hosting instead of running BIND.

BIND9 is the standard implementation on Debian and Ubuntu. The daemon is called named. Configuration lives under /etc/bind/. Official documentation from ISC BIND remains the authoritative reference for directives and security advisories.

How do you install BIND9 on Ubuntu or Debian?

Start on a clean Ubuntu 22.04 or 24.04 VPS with a static IP. DNS servers need stable addresses. Floating IPs work, but document the mapping clearly.

Install packages

sudo apt update
sudo apt install -y bind9 bind9utils bind9-doc dnsutils

The dnsutils package gives you dig, nslookup, and host. You will use dig constantly during testing. On a fresh Ubuntu server setup, confirm the hostname resolves before touching BIND.

Check the default service

sudo systemctl enable named
sudo systemctl start named
sudo systemctl status named

Ubuntu may use the unit name bind9 on some images. Run systemctl list-units | grep bind if status fails. Learn service control patterns in our systemd guide for Linux services.

Set the server identity

Edit /etc/bind/named.conf.options and set a forwarders block only if this host acts as a caching resolver. For a pure authoritative server, leave recursion off — covered in the hardening section.

How do you configure named.conf and zone files?

Ubuntu splits BIND config into include files. You rarely edit the top-level named.conf directly. Add zones in /etc/bind/named.conf.local.

Declare a forward zone

Replace example.com and IP addresses with your domain and server IP. This example uses 203.0.113.10 as the VPS address (RFC 5737 documentation range).

zone "example.com" {
    type master;
    file "/etc/bind/db.example.com";
};

Append that block to named.conf.local. Then create the zone file at /etc/bind/db.example.com:

$TTL    86400
@       IN      SOA     ns1.example.com. admin.example.com. (
                        2026091001      ; serial (YYYYMMDDnn)
                        3600            ; refresh
                        1800            ; retry
                        604800          ; expire
                        86400 )         ; minimum

        IN      NS      ns1.example.com.
ns1     IN      A       203.0.113.10
@       IN      A       203.0.113.10
www     IN      A       203.0.113.10
api     IN      A       203.0.113.10
mail    IN      A       203.0.113.10
@       IN      MX      10 mail.example.com.

Increment the serial every time you edit the zone. BIND slaves use serial numbers to detect changes. A forgotten serial bump is a classic production mistake.

Add a reverse zone (optional but useful)

Reverse DNS maps IP back to hostname. Mail servers often need it. For 203.0.113.10, the reverse zone name is 113.0.203.in-addr.arpa.

zone "113.0.203.in-addr.arpa" {
    type master;
    file "/etc/bind/db.203.0.203";
};

Zone file content:

$TTL 86400
@   IN  SOA ns1.example.com. admin.example.com. (
            2026091001 3600 1800 604800 86400 )
    IN  NS  ns1.example.com.
10  IN  PTR mail.example.com.

Allow queries in named.conf.options

Find the options block and restrict who may query. Never leave allow-query { any; } on a public resolver without rate limits.

options {
    directory "/var/cache/bind";
    recursion no;
    allow-query { any; };
    listen-on { any; };
    dnssec-validation auto;
};

For an internal-only authoritative server, replace any with your office CIDR or VPN range. Pair this with UFW firewall rules for web servers — DNS uses port 53 on both UDP and TCP.

Validate before reload:

sudo named-checkconf
sudo named-checkzone example.com /etc/bind/db.example.com
sudo systemctl reload named

Fix every error reported by those commands. BIND fails silently in odd ways when zone syntax is wrong. Use our regex tester to debug complex TXT record patterns if needed.

How do you test and delegate DNS to your BIND server?

Local tests prove BIND works. Delegation proves the internet trusts your server.

Query locally with dig

dig @127.0.0.1 example.com A +short
dig @127.0.0.1 www.example.com A +short
dig @203.0.113.10 example.com NS +short

Expect clean answers with no REFUSED or SERVFAIL status. Query from a remote machine too:

dig @203.0.113.10 example.com A

If remote queries time out, check UFW, cloud security groups, and whether BIND listens on the public interface.

Register glue records at your registrar

When your nameserver hostname lives inside the zone it serves, you need glue records. At your registrar, set:

1. NS records pointing to ns1.example.com.
2. A glue record mapping ns1.example.com to 203.0.113.10.
3. Remove old NS entries if migrating from managed DNS.
4. Wait for TTL expiry — often 24 to 48 hours, sometimes faster.

During migration, lower TTLs at the old provider a day ahead. That speeds cutover. Our article on cross-cloud DNS and traffic routing covers failover patterns when you mix BIND with CDN DNS.

Compare managed DNS vs self-hosted BIND

On production Laravel stacks I maintain, public DNS stays managed. BIND handles staging hostnames and internal service names. That split keeps booking platforms and legal-tech portals reachable while dev environments stay isolated.

How do you secure and maintain a BIND DNS server?

An open recursive resolver on the public internet gets abused within hours. Attackers use it for amplification DDoS. Lock it down before port 53 faces the world.

Disable recursion on authoritative servers

recursion no;
allow-recursion { none; };

Put those in named.conf.options. Authoritative servers answer only for zones they own. Caching and forwarding belong on a separate internal resolver.

Restrict queries and transfers

allow-query { 203.0.113.0/24; 10.0.0.0/8; };
allow-transfer { none; };

Block zone transfers unless you run secondary nameservers. Use TSIG keys if slaves are required — see the BIND 9 Administrator Reference Manual for key generation.

Keep BIND patched

sudo apt update && sudo apt upgrade bind9
sudo systemctl restart named

Subscribe to ISC security advisories. DNS software bugs get exploited quickly. Combine patching with Ubuntu server security best practices and server hardening guides.

Monitor and back up zone files

Zone files are plain text. Back them up with your normal server backup routine. Our guides on Ubuntu server backup strategies and automated rsync backups apply directly.

Watch query volume with Netdata or similar. A sudden spike often means your resolver was left open. Read Linux server monitoring with Netdata for zero-config metrics.

After DNS propagates, issue certificates with Let's Encrypt and Certbot. Certificate validation depends on correct A and CNAME records. Wrong NS delegation breaks HTTPS before your web server ever gets traffic.

For API endpoints behind CDNs, remember that DNS TTL affects cache behaviour. See Cloudflare DNS cache bypass for API endpoints when mixing edge DNS with origin BIND zones.

Key Takeaways

• Install bind9 and dnsutils, then define zones in /etc/bind/named.conf.local with matching zone files under /etc/bind/.
• Always run named-checkconf and named-checkzone before systemctl reload named.
• Disable recursion and restrict allow-query on public authoritative servers to prevent abuse.
• Open UDP and TCP port 53 in UFW and your cloud security group, then verify with dig @your-ip domain.com from a remote host.
• Register NS and glue records at your registrar; bump zone serial numbers on every edit.
• Use managed DNS for public sites and BIND for private, staging, or split-horizon zones — not both fighting over the same records.

People Also Ask

What is the difference between BIND authoritative and recursive modes?

An authoritative server answers only for zones it hosts — example.com records live in its zone files. A recursive resolver chases queries across the internet on behalf of clients. Production authoritative servers should set recursion no. Mixing both roles on one public IP invites abuse.

Which port does BIND use on Linux?

BIND listens on port 53 for both UDP and TCP. Most queries use UDP. Large responses and zone transfers use TCP. Firewalls must allow both protocols. Cloud providers often block port 53 outbound on consumer tiers — confirm your VPS plan allows inbound 53.

Can I run BIND alongside Apache or Nginx on the same server?

Yes. DNS and web serving use different ports. A single small VPS can run BIND, Nginx, and PHP-FPM together. Separate concerns are cleaner at scale — DNS on dedicated low-traffic hosts, web on application servers. For typical client projects, co-location on one Ubuntu box is fine.

How long does DNS propagation take after pointing NS to BIND?

Propagation depends on TTL values at the previous provider. With TTL set to 300 seconds before migration, most resolvers pick up new NS records within an hour. Default TTLs of 86400 seconds mean up to 24 hours. Test with dig +trace example.com to follow delegation from root to your server.

Deploy DNS with confidence

You now have the full path to set up a BIND DNS server on Linux — install, zone files, validation, delegation, and hardening. Start in a staging VPC or lab VPS before touching production NS records. Keep managed DNS for public traffic unless you have a clear reason to self-host.

Need help wiring DNS into a broader server stack — Laravel apps, mail, SSL, monitoring, and backups? Support and maintenance and testing and optimization cover the full lifecycle. For greenfield infrastructure, see planning and research services or contact us to discuss your setup. Browse the home page, about page, services overview, portfolio, blog, and customer reviews for related work. Operators in Nepal should also read how to secure your website and server in Nepal and CIS benchmarks for server hardening. Use the JSON formatter when inspecting API responses from DNS automation tools, and base64 encoder for encoding TSIG keys during advanced BIND configurations.