A Step-by-Step Guide to Setting Up a DNS Server in Linux

Posted on by

Ever wondered how typing google.com into your browser magically takes you to the right place? The unsung hero behind this daily magic is the Domain Name System (DNS), the internet’s global address book. But what if you could run your own private address book? Setting up your own DNS server in Linux gives you unparalleled control, speed, and privacy over your network.

In this guide, we’ll walk you through setting up a powerful DNS server using BIND9, the most widely used DNS software on the internet. Let’s dive in!

Why Run Your Own DNS Server?

Before we get our hands dirty, let’s look at a few powerful use cases:

  • Local Network Resolution: Access devices on your network like nas.home.lan or printer.office.local by name instead of memorizing IP addresses.
  • Improved Performance: By caching DNS queries locally, you can significantly speed up browsing for frequently visited sites.
  • Enhanced Security & Privacy: Take control of your data. Prevent your ISP from logging your DNS queries and implement your own filtering rules (like ad-blocking!).
  • Learning & Development: It’s an excellent way to understand the core mechanics of internet infrastructure.

Prerequisites

Make sure you have the following before you start:

  • A Linux server (we’ll use a Debian/Ubuntu-based system for examples).
  • A static IP address configured on your server. For this guide, we’ll use 192.168.1.10.
  • Root or sudo privileges.

Step 1: Installing BIND9

First, we need to install the BIND9 software package and its utilities. Open your terminal and run the following commands:

sudo apt update
sudo apt install bind9 bind9utils bind9-doc -y

This installs the core BIND9 server (bind9), helpful testing tools (bind9utils), and documentation (bind9-doc).

Step 2: Core DNS Configuration

BIND’s configuration is split into several files, but we’ll focus on the main ones: named.conf.options and named.conf.local.

A. Configuring Forwarders in named.conf.options

When your DNS server doesn’t know the IP for a domain (like google.com), it needs to ask another DNS server. These are called forwarders. Let’s configure BIND to use public DNS servers like Cloudflare or Google for this.

Edit the file with your favorite editor, like nano:

sudo nano /etc/bind/named.conf.options

Modify the file to look like this snippet. We’ll add a forwarders block and restrict queries to our local network.

acl "trusted" {
    localhost;
    192.168.1.0/24; // Your local network range
};

options {
    directory "/var/cache/bind";

    // Add this block for forwarding
    forwarders {
        1.1.1.1;
        1.0.0.1;
    };
    recursion yes;

    // Security: Listen only on localhost and our static IP
    listen-on { 127.0.0.1; 192.168.1.10; }; 
    allow-query { trusted; }; // Allow queries only from our trusted clients

    dnssec-validation auto;
    listen-on-v6 { any; };
};

B. Defining Your Local Zone in named.conf.local

Now, let’s tell BIND about our local domain. We’ll define a “zone” for our domain, let’s call it home.lan. This involves creating a forward lookup zone (name to IP) and a reverse lookup zone (IP to name).

sudo nano /etc/bind/named.conf.local

Add the following zone definitions to the file:

// Our Forward Lookup Zone
zone "home.lan" {
    type master;
    file "/etc/bind/db.home.lan"; // Path to the zone file
};

// Our Reverse Lookup Zone for 192.168.1.x network
zone "1.168.192.in-addr.arpa" {
    type master;
    file "/etc/bind/db.192.168.1"; // Path to the reverse zone file
};

Step 3: Creating the Zone Files

We’ve defined our zones, but now we need to create the files that contain the actual DNS records.

A. Forward Zone File (db.home.lan)

This file maps names like server.home.lan to their IP addresses. We’ll create it from a template for simplicity.

sudo cp /etc/bind/db.local /etc/bind/db.home.lan
sudo nano /etc/bind/db.home.lan

Make the file look like this, replacing server.home.lan. with your server’s fully qualified domain name.

; BIND data file for home.lan
;
$TTL    604800
@       IN      SOA     server.home.lan. admin.home.lan. (
                              2         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;
; Name Server Information
@       IN      NS      server.home.lan.

; A Records for our devices
server  IN      A       192.168.1.10
nas     IN      A       192.168.1.20
printer IN      A       192.168.1.30

; CNAME (Alias) Record
www     IN      CNAME   server.home.lan.

B. Reverse Zone File (db.192.168.1)

This file does the opposite, mapping IPs back to names. This is crucial for many network services.

sudo cp /etc/bind/db.127 /etc/bind/db.192.168.1
sudo nano /etc/bind/db.192.168.1

Edit it to contain the PTR records for your devices.

; BIND reverse data file for 192.168.1.x
;
$TTL    604800
@       IN      SOA     server.home.lan. admin.home.lan. (
                              2         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;
; Name Server Information
@       IN      NS      server.home.lan.

; PTR Records (IP to Name)
10      IN      PTR     server.home.lan.
20      IN      PTR     nas.home.lan.
30      IN      PTR     printer.home.lan.

Note: Remember to increment the ‘Serial’ number in both zone files every time you make a change!

Step 4: Validation and Launch!

We’re almost there! It’s critical to check our configuration for syntax errors before restarting the service.

1. Check the main configuration:

sudo named-checkconf

If this command returns no output, your files are syntactically correct.

2. Check the zone files:

sudo named-checkzone home.lan /etc/bind/db.home.lan
sudo named-checkzone 1.168.192.in-addr.arpa /etc/bind/db.192.168.1

You should see an “OK” message for each zone.

3. Restart and Test BIND9:

sudo systemctl restart bind9
sudo systemctl status bind9

Now, let’s test it using the dig command:

# Test a local name
dig nas.home.lan @localhost

# Test a public name (should use the forwarder)
dig google.com @localhost

If you get back an IP address in the “ANSWER SECTION” for both queries, congratulations! Your DNS server is working. The final step is to configure your router or individual client devices to use your server’s IP address (192.168.1.10) for DNS resolution.

Conclusion

You’ve successfully set up a fully functional caching and authoritative DNS server for your local network. You now have a faster, more private, and more customizable internet experience. From here, you can explore more advanced topics like DNS-based ad blocking, setting up secondary DNS servers, or enhancing security with DNSSEC. Happy networking!