Home » Blog » Setting up BIND DNS with Webmin on Debian 11

Information

Setting up BIND DNS with Webmin on Debian 11

Benhcmark Administrator

01/10/2025

1 View 0

SaveSavedRemoved 0

Master Your DNS: A Step-by-Step Guide to BIND and Webmin on Debian 11

Taking control of your own Domain Name System (DNS) is a powerful step toward managing your web infrastructure. By running your own DNS server, you gain direct control over your domain’s records, improve security, and can even speed up name resolution. This guide will walk you through setting up a BIND9 DNS server, the industry standard, on a Debian 11 system, all managed through the user-friendly Webmin control panel.

Prerequisites: Laying the Foundation

Before we begin, ensure you have the following in place. A solid foundation is crucial for a stable and reliable DNS server.

• A server running a fresh installation of Debian 11.
• Root or sudo access to execute administrative commands.
• A static IP address assigned to your server. DNS servers cannot use dynamic IPs.
• A Fully Qualified Domain Name (FQDN), such as server1.yourdomain.com, that you intend to use for the server itself.

Step 1: Installing and Securing Webmin

Webmin is a powerful web-based interface that simplifies server administration, turning complex command-line tasks into a few clicks. First, we need to add the Webmin repository to our system to ensure we get the latest version.

1. Update your package list and install the necessary dependencies:
   bash
sudo apt update
sudo apt install software-properties-common apt-transport-https wget

2. Next, add the Webmin repository GPG key and the repository itself:
   bash
wget -q http://www.webmin.com/jcameron-key.asc -O- | sudo apt-key add -
sudo add-apt-repository "deb [arch=amd64] http://download.webmin.com/download/repository sarge contrib"

3. Now, install Webmin using the apt package manager:
   bash
sudo apt install webmin

   Once the installation is complete, you can access the Webmin interface by navigating to https://your-server-ip:10000 in your web browser. You will likely see a browser warning about an invalid SSL certificate; this is normal for the default self-signed certificate, and you can safely proceed. Log in with your server’s root or sudo user credentials.

Step 2: Installing BIND9 DNS Server

With Webmin running, the next step is to install BIND9, the most widely used DNS software on the internet. The installation is straightforward from the command line.

Simply run the following command to install BIND and its essential utilities:

sudo apt install bind9 bind9utils bind9-doc dnsutils

This command installs the core BIND server, command-line tools for testing and management, and helpful documentation.

Step 3: Configuring Your First DNS Zone (Forward Zone)

Now it’s time to configure our first DNS zone. A “forward” zone is the most common type; it translates human-readable domain names (like www.yourdomain.com) into machine-readable IP addresses (like 192.168.1.10).

1. In the Webmin interface, navigate to the Servers section in the left-hand menu and click on BIND DNS Server.
2. If this is your first time, Webmin might prompt you to set up BIND. If so, follow the on-screen instructions.
3. Click on Create master zone.
4. Fill out the form with the following details:
   • Zone type: Keep this as Forward.
   • Domain name / Network: Enter your domain name (e.g., yourdomain.com).
   • Master server: Enter your server’s FQDN (e.g., server1.yourdomain.com).
   • Email address: Enter your administrative email, using a period instead of the “@” symbol (e.g., admin.yourdomain.com).
5. Click Create.

You have now created the zone file. Next, we need to add records to it. Click on the icon for Address records.

• Create an ‘A’ Record for the Root Domain: This record points your main domain to your server’s IP address.

  • Name: Leave this blank or use @.
  • Address: Enter your server’s static IP address.
  • Click Create.

• Create an ‘A’ Record for ‘www’: This ensures that www.yourdomain.com also points to your server.

  • Name: Enter www.
  • Address: Enter your server’s static IP address.
  • Click Create.

• Create an ‘MX’ Record for Mail: If you plan to host email, you need a Mail Exchanger (MX) record. Click on Mail Server in the zone’s record types.

  • Name: Leave this blank or use @.
  • Mail Server: Enter your server’s FQDN (e.g., server1.yourdomain.com).
  • Priority: Enter a number, typically 10. Lower numbers have higher priority.
  • Click Create.

After adding your records, click Apply Zone or Apply Configuration in the top-right corner of the BIND module to make your changes live.

Step 4: Configuring a Reverse Lookup Zone (PTR Records)

A reverse zone does the opposite of a forward zone: it maps an IP address back to a hostname. This is critical for email server reputation and is a best practice for any public-facing server.

1. Return to the BIND DNS Server module main page and click Create master zone.
2. Fill out the form:
   • Zone type: Select Reverse.
   • Domain name / Network: Enter the first three octets of your server’s IP address in reverse order, followed by .in-addr.arpa. For example, if your IP is 192.168.1.10, you would enter 1.168.192.in-addr.arpa.
3. Click Create.
4. Inside the new reverse zone, click on the Reverse Address record type.
5. Add a new PTR record:
   • Address: Enter the last part of your server’s IP address (e.g., 10 for 192.168.1.10).
   • Hostname: Enter your server’s FQDN (e.g., server1.yourdomain.com.). Note the trailing dot! It is crucial.
6. Click Create, and then apply the configuration again.

Step 5: Testing Your DNS Server

Configuration is complete, but verification is essential. You can test your new DNS server directly from its command line using the dig tool.

• Test the forward lookup:

  dig @localhost yourdomain.com
  

  Look for the ANSWER SECTION in the output. It should show the ‘A’ record you created, pointing yourdomain.com to your server’s IP address.

• Test the reverse lookup:
  bash
dig @localhost -x your-server-ip

  The ANSWER SECTION for this query should show the PTR record, mapping your IP address back to your server’s FQDN.

If both tests return the correct results, your DNS server is working properly.

Final Security and Best Practices

To ensure your DNS server is robust and secure, consider these final steps:

• Limit Zone Transfers: In the zone options, restrict zone transfers (AXFR requests) to only trusted secondary DNS servers. This prevents outsiders from easily downloading your entire DNS record database.
• Disable Recursion: For a server that is only authoritative for your own domains, you should disable recursive queries. This prevents your server from being used in DNS amplification attacks. This can be configured in the BIND module’s global options.
• Keep Software Updated: Regularly run sudo apt update && sudo apt upgrade to ensure BIND, Webmin, and all system packages are patched against known vulnerabilities.
• Use a Firewall: Configure a firewall like UFW to only allow traffic on necessary ports. For DNS, you must allow incoming traffic on port 53 (TCP and UDP).

By following this guide, you have successfully deployed a powerful and reliable BIND9 DNS server on Debian 11. You now have a critical piece of internet infrastructure under your complete control, providing a solid foundation for hosting websites, email, and other services.

Source: https://kifarunix.com/configure-bind-dns-server-using-webmin-on-debian-11/