BIND That Answers For Its Zones And Nothing Else

bind-authoritative

BIND (named) as an authoritative-only server: it answers for your zones and does nothing else. No recursion, no zone transfers to anyone you did not list, no version or hostname on request, response rate limiting on. Original role for EL 10, live-tested with podman on Rocky Linux 10.

The package is a resolver, not an authoritative server. The named.conf it installs has recursion yes, listens on loopback only and answers localhost. Add a zone to it and you have an authoritative server that also recurses, which is an open resolver the moment it is reachable. This role writes the whole file: recursion no, listening on every address, allow-query { any; } for the zones it carries.

Anyone who can query can copy the zone. allow-transfer is unset in the package, and unset means "whoever may query". The live test proved it: with one zone added and nothing else changed, dig AXFR from loopback pulled every record. This role sets allow-transfer { none; } unless you list your secondaries, and notifies only those (notify explicit), never every NS in the zone.

It tells you what it is. dig CH TXT version.bind answered 9.18.33 and hostname.bind answered the machine's hostname, out of the box. The role sets version none, hostname none and server-id none, and the live test asks all three and expects no answer.

Zones are data, not files. Each zone is a list of records in bind_authoritative_zones; the role renders the file, checks it with named-checkzone under its origin before it lands, checks named.conf with named-checkconf -z (every zone loaded) and reloads named through rndc, whose key the unit generates itself. Bump the serial on every change.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.