Dit deel is nog niet vertaald. Je ziet de Engelse tekst.
Wat het doet
BIND 9 (named, port 53 UDP/TCP) can be an authoritative server (holds your zones, e.g. lab.local) and/or a recursive resolver for your network. Zones are text files with records (A, AAAA, CNAME, MX, TXT, NS, SOA). After a change you raise the SOA serial, check the zone, and reload. rndc talks to named over a control channel (key in /etc/rndc.key).
Internal DNS is a basic platform service: Kubernetes, AD, mail and TLS all depend on it. DNS problems look like "everything is broken".
Zo schrijf je het
rndc reload [ZONE] | reconfig | flush | status | dumpdb
named-checkconf [-z] ; named-checkzone ZONE FILEBelangrijkste delen
rndc commands
status- Server status.
reload[ZONE]- Reload config and zones / one zone.
reconfig- Read named.conf and new zones only.
flush[VIEW]/flushnameNAME- Empty the cache (or one name).
dumpdb-cache- Write the cache to a file.
querylogon|off- Log every query (debugging).
freeze/thawZONE- Stop / start dynamic updates to edit a zone file.
retransferZONE- Pull a secondary zone again.
signing-listZONE- DNSSEC key status.
Opties 4
Meest gebruikt
Check tools
Niets past bij dit filter.
Voorbeelden 11
$ als gewone gebruiker# als root (of met sudo)
1Install on RHEL
dnf install -y bind bind-utils systemctl enable --now named firewall-cmd --permanent --add-service=dns && firewall-cmd --reload2A zone for the lab
cat /var/named/lab.local.zone $TTL 3600 @ IN SOA ns1.lab.local. admin.lab.local. ( 2026102701 3600 900 1209600 300 ) IN NS ns1.lab.local. ns1 IN A 192.168.122.2 web1 IN A 192.168.122.11 k8s IN A 192.168.122.10 www IN CNAME web13Add the zone and allow queries only from the lab
cat /etc/named.conf options { listen-on port 53 { 127.0.0.1; 192.168.122.2; }; allow-query { localhost; 192.168.122.0/24; }; recursion yes; allow-recursion { localhost; 192.168.122.0/24; }; }; zone "lab.local" IN { type primary; file "lab.local.zone"; allow-update { none; }; };4Check everything before reload
named-checkconf -z named-checkzone lab.local /var/named/lab.local.zone zone lab.local/IN: loaded serial 2026102701 OK5Reload after a change
rndc reload lab.local dig @192.168.122.2 web1.lab.local +short6Status and cache
rndc status rndc flushname shop.example.com rndc flush7Log queries for a short time
rndc querylog on journalctl -u named -f rndc querylog off8Edit a dynamic zone safely
rndc freeze lab.local vim /var/named/dynamic/lab.local.zone rndc thaw lab.local9Stop zone transfers to strangers
grep allow-transfer /etc/named.conf allow-transfer { 192.168.122.3; };10Check DNSSEC for a public domain
11SELinux and file rights for zone files
chown root:named /var/named/lab.local.zone && restorecon -v /var/named/lab.local.zone
Niets past bij dit filter.
Let op
- Always raise the SOA serial; secondaries ignore changes with the same serial.
- An open resolver (recursion for everyone) is used in DDoS attacks — limit
allow-recursion. - A missing dot at the end of a name (
ns1.lab.local) adds the zone name again.
Bestanden
/etc/named.conf- Main config.
/var/named/- Zone files (RHEL).
/etc/rndc.key- rndc control key.
Tips om te onthouden
- Use the date + number as serial (2026102701).
Exitcodes
0 | Success. |
1 | Error (config or zone invalid, server not reachable). |