Setting up bind9 dns sever on VPS

Setting up bind can be a real pain in the arse.*
So here is the last working config that finally worked on enotch VPS

assuming:

example.com : the domain,
1.2.3.4 : the VPS first dedicated IP
ns1.myname.com, ns2.myname.com: the nameservers that you'd like to define on the vps
5.6.7.8 and 9.10.11.12 are IPs which are provided by your vps hosting and you find in /etc/resolv.conf


First and foremost all you need to define ns1 and ns2 in myname.com registrar and point them to 1.2.3.4 . Then define
ns1.myname.com
ns2.myname.com

in the control panel of example.com registrar.

It takes a couple of hours for dns servers to propogate. Be patient!

Note: It is recommended a separate IP for each ns so you'd better have 1.2.3.5 for ns2, but it is not absolutely necessary, and here I present the minimal approach that worked for me.

nano /etc/hosts

127.0.0.1 localhost.localdomain localhost
# Auto-generated hostname. Please do not remove this comment.
1.2.3.4 mx.example.com mx

nano /etc/bind/named.conf.local

note : the mx.example.com mx is the configuration recommended by DTC (Domain Techonologie Contorole, a free GPL control panel)

zone "example.com" {
type master;
file "/etc/bind/zones/example.com.db";
};

zone "3.2.1.in-addr.arpa" {
type master;
file "/etc/bind/zones/rev.3.2.1.in-addr.arpa";
};

Ok, now make a zone file and put the above files in it:

cd /etc/bind
mkdir zones
nano example.com.db

Here is a typical example.com.db zone using ns1.myname.com nameserver:

; BIND data file for example.com
;
$TTL 14400
@ IN SOA ns1.myname.com. info.myname.com. (
201006601 ; Serial
7200 ; Refresh
120 ; Retry
2419200 ; Expire
604800) ; Default TTL
;
example.com. IN NS ns1.myname.com.
example.com. IN NS ns2.myname.com.

example.com. IN MX 10 mail.myname.com.
example.com. IN A 1.2.3.4

ns1 IN A 1.2.3.4
ns2 IN A 1.2.3.4
www IN CNAME example.com.
mail IN A 1.2.3.4
ftp IN CNAME example.com.
example.com. IN TXT "v=spf1 ip4:1.2.3.4 a mx ~all"
mail IN TXT "v=spf1 a -all"

And also define the reverse dns lookup:

nano /etc/bind/zones/rev.3.2.1.in-addr.arpa

@ IN SOA myname.com. admin.myname.com. (
2010081401;
28800;
604800;
604800;
86400 );

IN NS ns1.myname.com.
4 IN PTR myname.com.

Also make sure that example.com is searched in /etc/resolv.conf.

search example.com
nameserver 127.0.0.1
nameserver 5.6.7.8
nameserver 9.10.11.12

Make sure that the hostname is properly defined:

nano /etc/hostname

And add 'mx.example.com' inside.

restart bind

/etc/init.d/bind9 restart

And now check whether everyting is ok. First install dnsutils to be able to use dig

apt-get install dnsutils

dig example.com

You should see a response like this:

; <<>> DiG 9.6-ESV-R1 <<>> example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5058
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 0


;; QUESTION SECTION: ;example.com. IN A ;; ANSWER SECTION: example.com. 3600 IN A 1.2.3.4

;; AUTHORITY SECTION: example.com. 3600 IN NS ns1.myname.com. example.com. 3600 IN NS ns2.myname.com.

;; Query time: 0 msec ;; SERVER: 127.0.0.1#53(127.0.0.1)

;; WHEN: Tue Jul 13 21:53:06 2010 ;; MSG SIZE rcvd: 93

Also double-check from outside the box. At some point, I had the weird problem that dig responded from inside the box but the domain was not accessible from outside. I guess this could be due to wrong configuration of any of resolv.conf, /etc/hosts or /etc/hostname or something else! But as the last resort, if you messed a lot with your server, probably you find it easier to rebuild your OS and start over.

Hope this helps other people confused by bind setting.

----------
* I am wondering how such a clunky, fiddly thing have survived for such a long time while there are better alternatives available!
So I strongly suggest that, if you can avoid bind at any cost and use nsd3 instead. As I experiences, nsd3 uses about 70Mb less of your precious ram and is far smoother to set up. I had to install bind because nsd was not an option among DNS servers supported by DTC


**Enotch's useless support just demanded to "upgrade to managed" in order to give any clue to sort out the nameserver mess, so I was left on my own to make my way).