DNS Setup

DNS software should be selected by role and operational requirements, not by a universal “best server.” An authoritative service publishes zones; a recursive service answers clients by resolving and caching; a forwarding resolver sends queries to another resolver. Combining roles changes the attack surface.

Choosing a Role and Implementation

• BIND can provide authoritative and recursive service with extensive standards support.
• Unbound is commonly deployed as a validating recursive resolver.
• dnsmasq provides lightweight forwarding, caching, and DHCP features for smaller controlled networks.
• PowerDNS offers separate authoritative and recursive products with several data backends.

Capabilities and packaging change, so consult the installed version's official documentation. Deploy only the role needed and disable unintended recursion or zone service.

CheckWhich role publishes definitive records for zones it serves?

Authoritative DNS server. Ethernet switch. A recursive resolver answering arbitrary client queries.

Designing Before Installing

Define zones, clients, query volume, update mechanism, DNSSEC needs, logging, monitoring, backups, and recovery. Authoritative zones need redundant servers and correctly registered delegations. Recursive service needs explicit client access control, cache policy, upstream or iterative reachability, and protection against abuse.

Never expose unrestricted recursion to the Internet. Open resolvers can be abused for reflection attacks and consume local resources.

CheckWhy restrict recursive queries to authorized clients?

Recursive DNS cannot cache any record. Authoritative delegations require every user to be root. Open recursion can be abused for amplification and resource consumption.

Validating Configuration and Zone Data

Use the implementation's syntax and zone-checking tools before reload. For BIND, common examples are:

$ named-checkconf
$ named-checkzone example.com /etc/bind/zones/db.example.com

Run with appropriate permissions and paths for the host. A parser success does not prove delegation, serial propagation, DNSSEC chain, firewall reachability, or correct answers, so follow with controlled queries.

CheckWhat does a successful zone syntax check fail to prove?

That delegation and end-to-end authoritative answers work. That the zone text can be parsed by the checker. That the file has a record owner field.

Applying and Testing Safely

Preserve current configuration and recovery access, validate, then reload rather than restart when supported. Query each authoritative server directly with recursion disabled and compare SOA serial, NS set, positive records, nonexistent names, and both UDP and TCP behavior:

$ dig @192.0.2.53 example.com SOA +norecurse
$ dig @192.0.2.53 missing.example.com A +norecurse
$ dig @192.0.2.53 example.com SOA +norecurse +tcp

For recursion, test allowed and denied client networks, DNSSEC validation, cache behavior, and failure of upstream dependencies.

CheckWhy query an authoritative server with +norecurse?

Test authoritative answers without asking for recursion. To remove every record from its zone. To force all responses through HTTP.

Operating the Service

Monitor query failures, latency, cache behavior, resource use, zone transfers, serial consistency, DNSSEC expiry, and delegation health. Back up source configuration and signing material securely, but verify that a fresh instance can load zones and serve correct answers. Patch supported versions and limit control interfaces, dynamic updates, and transfer access.

CheckWhat should authoritative DNS redundancy testing include?

Querying each server and testing operation when another is unavailable. Checking only that all servers have similar hostnames. Using one shared process and disk for every advertised server.

Summary

You can now design a DNS deployment around explicit authority or recursion roles.

1. Choose software only after defining the required role.
2. Restrict recursion and administrative interfaces.
3. Validate configuration and zones before reload.
4. Test authority, denial, transport, and client policy directly.
5. Monitor redundancy, DNSSEC, data consistency, and recovery.