Set Up BIND9 DNS Server on VPS Ubuntu
Home › Set Up BIND9 DNS Server on VPS Ubuntu

Set Up BIND9 DNS Server on VPS Ubuntu

June 2026 · 8 min read

BIND9 (Berkeley Internet Name Domain) is the most widely used DNS server in the world. Setting up an authoritative DNS server on your own VPS gives you complete control over DNS records without relying on external DNS providers. This is ideal for internal domains, split-horizon DNS, or when you need custom TTLs and zone management capabilities.

Install BIND9

sudo apt update
sudo apt install bind9 bind9utils bind9-doc -y

# Check version
named -version

# Check status
sudo systemctl status bind9

Configure named.conf.options

sudo nano /etc/bind/named.conf.options
options {
    directory "/var/cache/bind";

    // Who can query DNS
    allow-query { any; };

    // Recursion only for internal network (set to none if authoritative-only)
    recursion yes;
    allow-recursion { 127.0.0.1; 10.0.0.0/8; };

    // Forward to upstream DNS
    forwarders {
        1.1.1.1;
        8.8.8.8;
    };
    forward only;

    dnssec-validation auto;
    listen-on { any; };
    listen-on-v6 { any; };
};

Create DNS Zone for Your Domain

sudo nano /etc/bind/named.conf.local
zone "yourdomain.com" {
    type master;
    file "/etc/bind/zones/db.yourdomain.com";
    allow-transfer { none; };  // Add secondary NS IP if you have one
};

// Reverse zone (PTR records)
zone "1.168.192.in-addr.arpa" {
    type master;
    file "/etc/bind/zones/db.192.168.1";
};

Create Zone File

sudo mkdir -p /etc/bind/zones
sudo nano /etc/bind/zones/db.yourdomain.com
$TTL 3600
@   IN  SOA ns1.yourdomain.com. admin.yourdomain.com. (
            2026061401  ; Serial (YYYYMMDDnn)
            3600        ; Refresh
            1800        ; Retry
            604800      ; Expire
            300 )       ; Negative Cache TTL

; Name Servers
@       IN  NS  ns1.yourdomain.com.
@       IN  NS  ns2.yourdomain.com.

; A Records
@       IN  A   203.0.113.10
ns1     IN  A   203.0.113.10
ns2     IN  A   203.0.113.11
www     IN  A   203.0.113.10
mail    IN  A   203.0.113.10

; MX Record
@       IN  MX  10  mail.yourdomain.com.

; TXT Records (SPF)
@       IN  TXT "v=spf1 ip4:203.0.113.10 ~all"
sudo named-checkzone yourdomain.com /etc/bind/zones/db.yourdomain.com
sudo systemctl restart bind9
Tip: Update the Serial number every time you modify the zone file. Use the format YYYYMMDDnn (e.g., 2026061401) so secondary nameservers can properly sync the new records.

Verify BIND9 is Working Correctly

# Check config has no errors
sudo named-checkconf
sudo named-checkzone yourdomain.com /etc/bind/zones/db.yourdomain.com

# Query DNS server directly
dig @127.0.0.1 yourdomain.com A
dig @127.0.0.1 www.yourdomain.com A
dig @127.0.0.1 yourdomain.com MX

# Check BIND9 logs
sudo journalctl -u bind9 -n 50
Tip: Use dig @127.0.0.1 to query BIND9 directly without going through the system resolver, ensuring you get responses from your local DNS server.

Common Issues & Troubleshooting

Error: "zone yourdomain.com/IN: loading from master file failed"

The zone file has a syntax error. Verify using named-checkzone:

sudo named-checkzone yourdomain.com /etc/bind/zones/db.yourdomain.com
# This will show the error and line number

# Check file permissions
sudo chown bind:bind /etc/bind/zones/db.yourdomain.com
sudo chmod 640 /etc/bind/zones/db.yourdomain.com

DNS query timeout / No response

Check if port 53 is open and firewall isn't blocking:

sudo ss -tulnp | grep :53
sudo ufw allow 53/tcp
sudo ufw allow 53/udp
# Test query from outside
dig @YOUR-VPS-IP yourdomain.com

SERVFAIL when querying from outside

Often caused by recursion enabled but no forwarder configured, or allow-recursion blocking external IPs:

sudo nano /etc/bind/named.conf.options
# Set recursion to none; if authoritative-only
# Or add external IPs to allow-recursion
sudo systemctl reload bind9

Serial number not updating causes secondary to not sync

Secondary NS will only refresh when the Serial number increases. Check:

# View current serial
dig @127.0.0.1 yourdomain.com SOA
# Serial must always be greater than secondary's serial

Frequently Asked Questions

What's the difference between BIND9 and Unbound?

BIND9 is a full-featured DNS server supporting both authoritative and recursive modes. Unbound is a recursive resolver focused on speed and DNSSEC. For setting up an authoritative DNS server for a real domain, BIND9 is the standard choice.

Do I need 2 nameservers?

Most registrars require at least 2 nameservers for redundancy. If you have only one VPS, you can use Cloudflare as secondary by configuring a slave zone at Cloudflare that points to your BIND9 master server.

Should I enable DNSSEC?

Yes, DNSSEC protects against DNS spoofing by signing zones with cryptographic keys. BIND9 supports DNSSEC out of the box, but you'll also need to upload the DS record to your registrar to establish a complete chain of trust.

Related Articles