What Is an Authoritative DNS Server?
DNS servers fall into two broad categories. A recursive resolver queries other servers on behalf of clients to find answers (for example, 8.8.8.8). An authoritative nameserver holds the actual data for a given domain (a zone) and returns the “official answer” for queries about that domain.
If you own a domain and want to run it on your own nameservers such as ns1.example.com, you need an authoritative server. BIND9 (Berkeley Internet Name Domain) is the most widely used implementation. This guide focuses on configuring BIND9 as an authoritative master/slave nameserver. (Client-side lookup tools such as dig/nslookup are covered in a separate guide.)
Do not run an authoritative server and an open resolver on the same host. Open resolvers are abused for DNS amplification attacks. On an authoritative server, always disable recursion with recursion no;.
Installation
# Debian/Ubuntu
sudo apt install -y bind9 bind9utils bind9-dnsutils
# RHEL/Rocky
sudo dnf install -y bind bind-utils
named -v # checkThe daemon is named named; the systemd service name is named or bind9 depending on the distribution.
named.conf Structure
Configuration is typically split across these files.
| File | Role |
|---|---|
/etc/bind/named.conf | Top-level file; includes the files below |
named.conf.options | Global options (listen, recursion, and so on) |
named.conf.local | Local zone definitions |
/var/lib/bind/ or /etc/bind/zones/ | Zone file location |
Example global options:
// /etc/bind/named.conf.options
options {
directory "/var/cache/bind";
listen-on { any; };
listen-on-v6 { any; };
//
recursion no;
allow-query { any; };
//
allow-transfer { none; };
dnssec-validation auto;
version "not disclosed"; //
};Forward Zone File
Register the zone in named.conf.local.
// /etc/bind/named.conf.local
zone "example.com" {
type master;
file "/etc/bind/zones/db.example.com";
allow-transfer { 192.0.2.53; }; // IP
also-notify { 192.0.2.53; };
};Zone file contents:
; /etc/bind/zones/db.example.com
$TTL 86400
@ IN SOA ns1.example.com. admin.example.com. (
2026061801 ; Serial (YYYYMMDDnn)
3600 ; Refresh
1800 ; Retry
1209600 ; Expire
86400 ) ; Negative Cache TTL
;
@ IN NS ns1.example.com.
@ IN NS ns2.example.com.
; A
@ IN A 192.0.2.10
ns1 IN A 192.0.2.53
ns2 IN A 192.0.2.54
www IN A 192.0.2.10
;
@ IN MX 10 mail.example.com.
mail IN A 192.0.2.20
;
@ IN TXT "v=spf1 mx -all"
ftp IN CNAME wwwWhat the SOA Record Means
SOA (Start of Authority) is the zone’s metadata. The fields mean the following.
| Field | Meaning |
|---|---|
| Serial | Zone version. Must be incremented on every change so slaves pick up the update |
| Refresh | How often the slave checks the master |
| Retry | Retry interval if Refresh fails |
| Expire | When the slave discards its data if it cannot reach the master |
| Negative TTL | How long non-existent records (NXDOMAIN) are cached |
If you edit a zone file and do not bump the Serial, slaves and caches will never fetch the change. This is the most common mistake. A date-based (YYYYMMDDnn) scheme makes Serial management easy.
Reverse Zone (PTR)
IP-to-name lookups (reverse DNS) use in-addr.arpa zones. For the 192.0.2.0/24 block:
// named.conf.local
zone "2.0.192.in-addr.arpa" {
type master;
file "/etc/bind/zones/db.192.0.2";
};; /etc/bind/zones/db.192.0.2
$TTL 86400
@ IN SOA ns1.example.com. admin.example.com. (
2026061801 3600 1800 1209600 86400 )
@ IN NS ns1.example.com.
10 IN PTR example.com.
20 IN PTR mail.example.com.The number on the left of a PTR is the last octet of the IP. Mail servers are often rejected if reverse records are missing.
Validating and Applying Configuration
# settings
sudo named-checkconf
# file ( , filepath)
sudo named-checkzone example.com /etc/bind/zones/db.example.com
sudo named-checkzone 2.0.192.in-addr.arpa /etc/bind/zones/db.192.0.2
#
sudo rndc reload
#
sudo rndc reload example.comnamed-checkzone validates Serial and record syntax, so always run it before applying changes.
Master/Slave Zone Transfers
Slave server named.conf.local:
zone "example.com" {
type slave;
masters { 192.0.2.53; }; // IP
file "/var/cache/bind/db.example.com";
};When the master sends NOTIFY via also-notify, the slave immediately fetches the zone with AXFR/IXFR. Authenticating transfers with a TSIG key is recommended for security.
# TSIG
tsig-keygen -a hmac-sha256 transfer-keyPut the generated key in named.conf on both sides and restrict transfers with allow-transfer { key transfer-key; };.
Verifying Operation
# ( reply aa check)
dig @192.0.2.53 example.com SOA +norecurse
dig @192.0.2.53 www.example.com A
dig @192.0.2.53 -x 192.0.2.10 # PTR
# (allow-transfer )
dig @192.0.2.53 example.com AXFRIf the response header shows flags: ... aa (authoritative answer), the authoritative response is working correctly.
DNSSEC Basics
DNSSEC attaches digital signatures to responses to prevent tampering. BIND9 supports inline signing.
zone "example.com" {
type master;
file "/etc/bind/zones/db.example.com";
dnssec-policy default; // ·
inline-signing yes;
};After signing, register the generated DS record with the parent domain’s registrar so the chain of trust is complete.
Troubleshooting
| Symptom | Cause |
|---|---|
SERVFAIL | Zone file syntax error — check with named-checkzone |
| Slave not updating | Serial not incremented, missing allow-transfer |
| No authoritative answer (no aa) | Zone not loaded, missed rndc reload |
| named fails to start | Check journalctl -u named, named-checkconf |
Summary
| Item | Key point |
|---|---|
| Authoritative vs recursive | Authoritative servers must use recursion no; |
| Zone files | SOA + NS + A/MX/CNAME/PTR |
| Serial | Increment on every change; if you don’t, updates never propagate |
| Validation | named-checkconf, named-checkzone, then rndc reload |
| Master/slave | type slave + masters; authenticate transfers with TSIG |
| DNSSEC | dnssec-policy + register DS at the parent |
The core of running a BIND9 authoritative server is “Serial management and zone validation.” Make a change–validate–reload cycle a habit and you will prevent most outages.
AI tools may assist drafting. Check the evidence in each guide for whether commands were run and which environment was used. Confirm the current docs for your version before applying instructions, and email us about errors. email us
Questions & answers
Ask a question about this guide. We'll review and reply.