How To Configure Dns Server In Linux Centos 7

DNS, or Domain Name System, is a critical component of the internet’s infrastructure. It translates human-friendly domain names into IP addresses that computers use to identify each other on the network. Configuring a DNS server on your CentOS 7 system can improve network efficiency and security. This guide will walk you through setting up BIND (Berkeley Internet Name Domain), the most widely used DNS software on Linux.

Prerequisites for Configuring a DNS Server

A CentOS 7 system with root privileges.
Access to the terminal or command line interface.
Basic understanding of networking concepts.
An active internet connection for downloading packages.

Installing BIND on CentOS 7

To begin configuring your DNS server, you must first install BIND. Use the following commands to update your package repository and install BIND:

yum update -y
yum install bind bind-utils -y

Once installed, start and enable the BIND service to run on boot using the systemctl command:

systemctl start named
systemctl enable named

Configuring Firewall for DNS Traffic

Before diving into BIND configuration, ensure that your firewall allows DNS traffic. Add the necessary rules to the firewall with these commands:

firewall-cmd --permanent --add-service=dns
firewall-cmd --reload

Setting Up Forward and Reverse Zones

DNS zones are a way of dividing the global DNS space into manageable chunks. A forward zone file maps domain names to IP addresses, while a reverse zone file does the opposite.

Creating Zone Files

Create your forward and reverse zone files by copying the sample files provided by BIND:

cp /etc/named.rfc1912.zones /etc/named/zones.conf
cp /var/named/named.localhost /var/named/forward.mydomain
cp /var/named/named.loopback /var/named/reverse.mydomain

Editing Zone Configuration

Edit /etc/named/zones.conf to include your new zone files. Here’s an example of what the entries might look like:

// Forward zone
zone "mydomain.com" IN {
    type master;
    file "/var/named/forward.mydomain";
    allow-update { none; };
};

// Reverse zone
zone "0.168.192.in-addr.arpa" IN {
    type master;
    file "/var/named/reverse.mydomain";
    allow-update { none; };
};

Configuring Zone Files

Next, configure your forward and reverse zone files with the correct DNS records. For the forward zone file (/var/named/forward.mydomain), add A records for your domain:

$TTL 86400
@   IN  SOA     ns1.mydomain.com. admin.mydomain.com. (
                                            2023040801  ;Serial
                                            3600        ;Refresh
                                            1800        ;Retry
                                            604800      ;Expire
                                            86400       ;Minimum TTL
)
@       IN  NS      ns1.mydomain.com.
@       IN  A       192.168.0.10
ns1     IN  A       192.168.0.10
www     IN  A       192.168.0.10

For the reverse zone file (/var/named/reverse.mydomain), add PTR records:

$TTL 86400
@   IN  SOA     mydomain.com. admin.mydomain.com. (
                                            2023040801  ;Serial
                                            3600        ;Refresh
                                            1800        ;Retry
                                            604800      ;Expire
                                            86400       ;Minimum TTL
)
@       IN  NS      ns1.mydomain.com.
10      IN  PTR     mydomain.com.
10      IN  PTR     ns1.mydomain.com.

Tuning BIND’s Main Configuration

The main configuration file for BIND is /etc/named.conf. You’ll need to edit this file to specify the options for your DNS server. Here’s an example of some common settings:

options {
    listen-on port 53 { 127.0.0.1; 192.168.0.10; };
    directory       "/var/named";
    dump-file       "/var/named/data/cache_dump.db";
    statistics-file "/var/named/data/named_stats.txt";
    memstatistics-file "/var/named/data/named_mem_stats.txt";
    allow-query     { localhost; 192.168.0.0/24; };
    recursion yes;

    dnssec-enable yes;
    dnssec-validation yes;
    dnssec-lookaside auto;

    /* Path to ISC DLV key */
    bindkeys-file "/etc/named.iscdlv.key";

    managed-keys-directory "/var/named/dynamic";
};
include "/etc/named/zones.conf";

Testing Your DNS Configuration

After making all the necessary changes, validate your configuration files with the named-checkconf and named-checkzone utilities:

named-checkconf
named-checkzone mydomain.com /var/named/forward.mydomain
named-checkzone 0.168.192.in-addr.arpa /var/named/reverse.mydomain

If there are no errors, restart the BIND service to apply the changes:

systemctl restart named

Finally, test your DNS server using dig or nslookup:

dig @localhost mydomain.com
nslookup mydomain.com localhost

Maintaining and Monitoring Your DNS Server

Regular maintenance and monitoring are essential for keeping your DNS server running smoothly. Consider setting up logging for BIND and regularly checking the logs for any unusual activity. Additionally, keep your server updated with the latest security patches.

Frequently Asked Questions

How do I troubleshoot issues with my DNS server?

Check the BIND logs for error messages, verify your configuration files for syntax errors, and ensure that your firewall is not blocking DNS traffic.

Can I set up a secondary DNS server for redundancy?

Yes, it’s highly recommended to have at least one secondary DNS server. Configure BIND on another machine as a slave server and synchronize it with your primary server.

What is DNSSEC and should I enable it?

DNSSEC adds an extra layer of security by validating responses with digital signatures. If you’re concerned about security, enabling DNSSEC is a good practice.

How often should I update the serial number in my zone files?

Update the serial number every time you make changes to your zone files. This ensures that secondary servers will fetch the updated information.

Is it necessary to open both TCP and UDP ports for DNS?

Yes, DNS uses both TCP and UDP port 53. While most queries use UDP, TCP is required for larger responses, zone transfers, and DNSSEC.