I would like to know how to configure bind9 to resolve all DNS requests given to it iteratively starting with a root server.

My goal with this is to set up bind9 as a dns resolver in my local network, however my preferences are rather specific in that I do not wish to trust any external recursive resolver, be it Google’s or any of the sort. I would like my recursive resolver to resolve a A query for let’s say test.example.com as follows:
1. ask a root server for the NS entry for .com
2. ask the server given by 1. for the NS entry for example.com
3. ask the server given by 2. for the NS entry for test.example.com
4. ask the server given by 3. for the A entry for test.example.com

(I am not entirely sure but from what I understand this scheme is called iterative resolving?)

Ideally I want the intermediary servers to know as little as possible on what domain I am actually querying and preferably as many requests as possible should be made using dnsseq. Caching of all these entries is desired, but not required.

Sidenote: My network does not support ipv6.

I know that this kind of resolver is probably going to be slower than, but for me this loss in performance is negligible /acceptable.

I did not find instructions on how to configure bind9 to perform requests exactly this way.

Is it even possible to configure bind9 this way or do i have to write my own resolver from scratch?

If it is possible could someone post a snipped of

that makes this possible or points me in the right direction.

I am also open to any alternatives that will serve my purpose.
In case it matters I am using Ubuntu 16.04 LTS (Armbian Linux)

  • 3
    This is bind's default behaviour unless you provide forwarders. – user996142 Apr 19 '18 at 17:42
  • 1
    I appears nobody talked about this, because it indeed is the default configuration. I expected the default configuration to just forward the dns requests to whatever server the system was configured to use in resolv.conf. Thank you for pointing this out. – UXELDUXEL Apr 19 '18 at 17:52
  • bind is not "proxy dns" like "pdnsd": it is real DNS used by many ISPs, and since all DNS clients (except dig recursive) are not recursive, bind does recursive resolving starting from named.root. It is covered in "DNS and BIND" book – user996142 Apr 19 '18 at 18:30
  • It's a fair question. It would be worth creating an answer that explains it's the default OOTB configuration, to help future readers. – roaima Apr 19 '18 at 23:00

It appears i did not do my homework properly, as pointed out in the comment by user996142 this is indeed the default configuration for bind9.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.