Is it possible, to set up BIND as DNS server on my local network, and make execute scripts when it gets a lookup?

I would like to execute a Python or Bash script, based on the incoming DNS lookup, how can I solve this?

If possible in Bind, please tell me how, and if not, tell me if it is possible in other DNS server implementations, that run on Ubuntu.

Thank you very much.

  • 1
    This appears a little odd to me, may I ask what you're trying to achieve?
    – sr_
    Feb 1, 2012 at 11:14
  • It might be kind of odd ;) What I am trying to do, is to lookup in my database, if the destination IP of the lookup is in a certain foreign country, and if it is, I want to set up a route on my server, that also acts as a router, to a specific ISP, or in some cases a VPN connection. I have tried to set up a lot of routes, 99% will never be used, and the performance is very bad. If I can do it on demand, the DNS performance will be bad, but in my case, this does not have any influence.
    – Gunnar
    Feb 1, 2012 at 12:10
  • Hmm, this might fail horribly if the, say, Hungarian website uses Google Ad-blah, doesn't it? (But I have no alternative idea either, sorry.)
    – sr_
    Feb 1, 2012 at 15:04
  • I am rather curious as to what you are trying to accomplish since what will have to happen you will get a request from an IP which you will have to match against a geographic location, which may be false and then set up a route on your DNS server to respond to that IP via a particular route, which makes no sense since request already made it into BIND?
    – Karlson
    Feb 4, 2012 at 4:32
  • If my guess of what you're trying to achieve is correct (route certain connections via non-standard gateways), isn't BIND the wrong place to do it? Have you looked into policy routing and/or iptables?
    – Alexios
    Feb 7, 2012 at 13:34

3 Answers 3


I can think of two additional options that don't require parsing BIND logs or interfering with BIND at all.

1) Port mirroring - duplicate packets and send them to a separate port where an application is listening, parsing the DNS requests, and taking action. dpkt or scapy or similiar packet crafting libraries will help you parse the raw requests.

2) Use some type of packet sniffing library to passively monitor the requests. Here is an example using scapy:

from scapy.all import *

def handler(req):
    if req.haslayer(DNS) and req.getlayer(DNS).qr == 0:
        ip = req.getlayer(IP)
        dns = req.getlayer(DNS)

        q = dns.qd
        print q.qname # simply print domain name

if __name__ == '__main__':
    sniff(iface="eth0", filter="udp and port 53", prn=handler, store=0)

Obviously, this is just a primitive example. It only prints the name of the domain that was queried, but you can of course add a great deal of logic. If you reference scapy documentation you'll find that all the fields from the DNS request are readily available.

  • This looks interesting. I will look into this. Thanks :-)
    – Gunnar
    Apr 9, 2012 at 8:59

You could do so by monitoring the bind-server log (query logging has to be turned on). Good luck...

  • Note that logging all bind queries is a severe performance drain. I would not recommend this on any production-level authoritative server.
    – Shadur
    Feb 3, 2012 at 21:19
  • Depends on the load of that bind-server. And one could write the logs to a ram-disk e.g. /dev/shm, too.
    – Nils
    Feb 3, 2012 at 21:41
  • log and then run swatch or OSSEC on the logs to call your script. not a very good idea in the long run, either way.
    – Jodie C
    Apr 8, 2012 at 0:59

No such things as events are implemented in bind, it doesn't need that.

You could look around applicative firewalls, who are used in some organizations to restrict access to some users. There you would have more chances of achieving what you want.

Setting up routes seems a good idea too, in the end what you want to achieve with bind and triggered script execution will be inefficient as well: you have to:

for each dest IP 
look up through your database  
if match set the route
then the OS will see and use the root

Setting up loads of routes isn't a problem and won't affect performance in a noticeable way. How many routes do you think corporate routers have? hundreds? not quite... And they don't necessarily have a fancy hardware configuration. Seriously, you are fine, serious operating systems are specifically designed to handle many routes and optimize the look up.

Besides what you wanted to do in the first place is using a database on top of the routing table, which would be another kind of database. Keep it simple. On BGP servers, many routes are actually selected/prefered for political/financial reasons, each ISP/organization can do that and they all add specific routes for this purpose. The cost of transit or a court order is often the cause of such measures.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .