Preperations

Firewall:

firewall-cmd --permanent --add-service=dns
firewall-cmd --reload

Installation

dnf install bind bind-utils
mkdir /var/named/zones
chown named:named /var/named/zones
chmod 770 /var/named/zones

Configuration

Configure Listener

(Master/Slave):/etc/named.conf
options {
    listen-on port 53 { any; };
    listen-on-v6 port 53 { none; };
}

Query Restrictions

Query restrictions are important when the DNS server is publicly accessible to prevent DNS amplification attacs.

(Master/Slave):/etc/named.conf
acl "internal-networks" {
    127.0.0.1;
    10.80.32.0/20;
}
options {
    allow-query     { internal-networks; };
}

Configure Recursion over Forwarders

(Master/Slave):/etc/named.conf
options {
    recursion yes;
    forward only;
    forwarders {
        10.80.0.1;
    };
}

Allow Zone Transfers

(Master):/etc/named.conf
options {
    allow-transfer {
        10.80.32.12;
    };
    notify yes;
  }

Configuration Check

named-checkconf

Zone Definition

Forward Zone

Define Zones

(Master):/etc/named.conf
zone "lab.mueller.world" IN {
    type master;
    file "zones/lab.mueller.world.zone";
};
(Slave):/etc/named.conf
zone "lab.mueller.world" IN {
        type slave;
        masters { 10.80.32.11; };
        file "slaves/lab.mueller.world.zone";
};

Zone File

(Master):/var/named/zones/lab.mueller.world.zone
$TTL 86400
@ IN SOA infra-01a.lab.mueller.world. admin.lab.mueller.world. (
  2026102601
  3600
  900
  604800
  86400 
)

@           IN NS infra-01a.lab.mueller.world.
@           IN NS infra-01b.lab.mueller.world.

router-01   IN A 10.80.32.1
router-01a  IN A 10.80.32.2
router-01b  IN A 10.80.32.3

infra-01a   IN A 10.80.32.11
infra-01b   IN A 10.80.32.12

dc-01a      IN A 10.80.32.21
dc-01b      IN A 10.80.32.22

Validation:

named-checkzone lab.mueller.world /var/named/zones/lab.mueller.world.zone

Reverse Zone

Define Zones

(Master):/etc/named.conf
zone "32.80.10.in-addr.arpa" IN {
    type master;
    file "zones/reverse-32.80.10.zone";
};
(Slave):/etc/named.conf
zone "32.80.10.in-addr.arpa" IN {
        type slave;
        masters { 10.80.32.11; };
        file "slaves/reverse-32.80.10.zone";
};

Zone File

(Master):/var/named/zones/reverse-32.80.10.zone
$TTL 86400
@ IN SOA infra-01a.lab.mueller.world. admin.lab.mueller.world. (
  2026102601
  3600
  900
  604800
  86400 
)

@   IN NS infra-01a.lab.mueller.world.
@   IN NS infra-01b.lab.mueller.world.

1   IN PTR router-01.lab.mueller.world.
2   IN PTR router-01a.lab.mueller.world.
3   IN PTR router-01b.lab.mueller.world.

11  IN PTR infra-01a.lab.mueller.world.
12  IN PTR infra-01b.lab.mueller.world.

21  IN PTR dc-01a.lab.mueller.world.
21  IN PTR dc-01b.lab.mueller.world.

Zone Validation

named-checkzone 32.80.10.in-addr.arpa /var/named/zones/reverse-32.80.10.zone

SELinux

restorecon -Rv /var/named

Start service and configure for automatic start

systemctl enable --now named.service