Hands-on guide series
DNS on a Server: A Hands-On Guide
A five-part, hands-on guide to running DNS on a single VPS: how resolution walks from root to authoritative, an authoritative BIND9 server with a real zone file, a validating caching resolver with unbound, split-horizon views for internal names, and DNSSEC with troubleshooting. Every command tested on a live Ubuntu 24.04 server with the demo servers bound to loopback.
What you will build
Security is layers, not a switch. Each part closes a different category of attack, from the automated sweep that finds a brand-new server, to the day one gets in anyway. Read them in order, or jump to what you need.
- 1
How DNS Resolution WorksInstall bind9 and unbound on a bare Ubuntu 24.04 slice, then read DNS resolution: authoritative versus recursive servers, dig +trace and the common record types.9 min - 2
Run an Authoritative DNS Server with BIND9Run an authoritative DNS server with BIND9 on Ubuntu 24.04: a real boxlab.space zone file, named-checkconf and named-checkzone, and answers with the aa flag.6 min - 3
A Recursive DNS Resolver with CachingBuild a recursive DNS resolver with unbound on Ubuntu 24.04: validating caching on 127.0.0.1, a cold versus warm query proving the cache, forwarding and prefetch.6 min - 4
Split-Horizon DNS for Internal NamesSet up split-horizon DNS with BIND9 views on Ubuntu 24.04: one name answers a private address to internal clients and a public address to everyone else.6 min - 5
DNSSEC and DNS TroubleshootingSign a zone with DNSSEC on Ubuntu 24.04 and read the DNSKEY, RRSIG and DS records, validate the ad flag, then troubleshoot SERVFAIL, NXDOMAIN and a broken record.6 min