Card, PayPal or bank transfer · Morocco and worldwideتعلَّم · مارِس · أتقِن

Catalogue / Infrastructure & systems

Production DNS with BIND 9 and Unbound

Run a company DNS end to end — BIND 9 authoritative servers, TSIG-protected secondaries, split-horizon views, an Unbound resolver, DNSSEC and mail records — then monitor and troubleshoot it like in production.

  • Intermediate to advanced
  • 12 lessons
  • 12 h 40 min
  • Versions BIND 9.18, BIND 9.20, Unbound 1.17+, Debian 12, Debian 13, Ubuntu 24.04, Rocky 9, BIND 9.16, Unbound 1.17 (Debian 12), Unbound 1.19 (Ubuntu 24.04), Unbound 1.22 (Debian 13), Unbound 1.16+ (Rocky 9), BIND 9.16+, toute zone DNS, Unbound 1.16+, Rocky 9 (BIND 9.16 ou bind9.18), Debian 12/13

A MasterLinux course · Original text

What you will learn

  • Follow a resolution step by step (recursion, referrals, glue, positive and negative caching) and read every flag of a response
  • Use dig, host and delv like an operator (+norec, +nssearch, +dnssec, +cd, +trace) and automate reading their output
  • Write an authoritative BIND 9 configuration and complete zones (SOA, NS, A/AAAA, MX, TXT, SRV, CAA)
  • Manage IPv4 and IPv6 reverse zones, classless delegation and $GENERATE
  • Build a primary/secondary pair with NOTIFY, IXFR and TSIG-signed transfers
  • Serve different answers to the internal network and to the Internet with split-horizon views
  • Deploy a safe and fast Unbound resolver (access control, cache, prefetch, serve-expired, DNS over TLS)
  • Sign a zone with dnssec-policy, understand key rollovers and troubleshoot a DNSSEC SERVFAIL
  • Publish SPF, DKIM and DMARC without mistakes and monitor your servers (logs, rndc, serial numbers)
  • Fix the most common real-world incidents and deliver the complete DNS of a site as a final project

Course content

12 lessons · 12 h 40 min
Section 1 — Resolution and tools2 lessons · 1 h 35 min
  1. Resolution from the inside: referrals, glue, positive and negative caching Preview45 min
  2. dig, host and delv in depth: query, compare, validate 50 min
Section 2 — Authoritative BIND4 lessons · 3 h 50 min
  1. Authoritative BIND 9: named.conf and complete zones (SOA, NS, MX, TXT, SRV, CAA) 1 h
  2. Advanced reverse zones: ip6.arpa, classless delegation and $GENERATE 55 min
  3. Primary and secondary: NOTIFY, AXFR/IXFR and TSIG-signed transfers 1 h
  4. Split-horizon views: one answer for the internal network, another for the Internet 55 min
Section 3 — Resolver, DNSSEC and mail3 lessons · 3 h 5 min
  1. Unbound resolver: access control, cache, internal zones and DNS over TLS 1 h
  2. DNSSEC: sign with dnssec-policy, roll keys, validate and troubleshoot 1 h 10 min
  3. Mail on the DNS side: SPF, DKIM, DMARC, MTA-STS and TLS-RPT without errors 55 min
Section 4 — Production and project3 lessons · 4 h 10 min
  1. Monitor and troubleshoot: BIND logs, rndc, zone checks and probes 1 h
  2. Real DNS incidents: broken delegation, missing glue, failed migration, DNSSEC SERVFAIL 1 h 10 min
  3. Final project: the complete DNS of the Casablanca branch on Rocky 9 2 h

Requirements

  • DNS basics (A, MX, CNAME records, the role of the TTL), for example the DNS lesson of the “Networks and VPN” course
  • Solid hands-on experience with the Linux command line (files, permissions, simple shell scripts)
  • A Debian 12/13 or Rocky 9 virtual machine to reproduce the examples with BIND and Unbound

Who is this course for?

  • System and network administrators who run or take over a company DNS
  • IT services technicians who handle “the site is down” or “our emails land in spam” incidents
  • DevOps and cloud engineers who want to understand what Route 53, Azure DNS or Cloud DNS do under the hood