BIND That Answers For Its Zones And Nothing Else
BIND as an authoritative-only server. The package is a loopback resolver; add a zone and anyone who can query can copy the whole zone, and version.bind names the 9.18 to attack. This role turns recursion off, refuses transfers to anyone not listed, hides the identity records, rate-limits responses, and renders zones from data checked before they land. Original role, live-tested on Rocky Linux 10.
Verification
Live-testedReally deployed to a container sandbox, proven idempotent (a second run changes nothing), verified against the role’s assertions, then torn down.
Conformance
- Static validation (yamllint · ansible-lint)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live-tested - applied, verified, destroyed
Last verified 2026-09-19 · podman 4.9.3 · ansible 2.21.4 · how we verify
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads live-tested because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/ansible-bind-authoritative?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Ansible role 1.0.0, live-tested on IaC Bazaar: [BIND That Answers For Its Zones And Nothing Else](https://www.iac-bazaar.com/catalog/ansible-bind-authoritative?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```yaml
# BIND That Answers For Its Zones And Nothing Else: https://www.iac-bazaar.com/catalog/ansible-bind-authoritative (download from your IaC Bazaar account)
```Preview:
Documentation
bind-authoritative
BIND (named) as an authoritative-only server: it answers for your zones and
does nothing else. No recursion, no zone transfers to anyone you did not list,
no version or hostname on request, response rate limiting on. Original role for
EL 10, live-tested with podman on Rocky Linux 10.
The package is a resolver, not an authoritative server. The named.conf it
installs has recursion yes, listens on loopback only and answers localhost.
Add a zone to it and you have an authoritative server that also recurses, which
is an open resolver the moment it is reachable. This role writes the whole
file: recursion no, listening on every address, allow-query { any; } for
the zones it carries.
Anyone who can query can copy the zone. allow-transfer is unset in the
package, and unset means "whoever may query". The live test proved it: with one
zone added and nothing else changed, dig AXFR from loopback pulled every
record. This role sets allow-transfer { none; } unless you list your
secondaries, and notifies only those (notify explicit), never every NS in the
zone.
It tells you what it is. dig CH TXT version.bind answered 9.18.33 and
hostname.bind answered the machine's hostname, out of the box. The role sets
version none, hostname none and server-id none, and the live test asks
all three and expects no answer.
Zones are data, not files. Each zone is a list of records in
bind_authoritative_zones; the role renders the file, checks it with
named-checkzone under its origin before it lands, checks named.conf with
named-checkconf -z (every zone loaded) and reloads named through rndc,
whose key the unit generates itself. Bump the serial on every change.
License
Commercial - IaC Bazaar EULA. (c) IaC Bazaar.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Variables
- Test
Related modules
ansible-unbound-resolver
Unbound on loopback: DNSSEC validated locally against the root anchor, query names minimised, version hidden, and upstream over DNS-over-TLS by default because many networks reset TCP 53 to anything but a known resolver, which breaks full recursion the moment a DNSKEY answer outgrows UDP. Recursion is one setting away. Original role, live-tested on Rocky Linux 10.
ansible-coredns
CoreDNS from the upstream release (sha256-verified) as a hardened system service answering authoritatively for your zones on 127.0.0.1:53 as a system user (CAP_NET_BIND_SERVICE through the unit), forwarding only when you name upstreams. The live test digs the example zone's A record with the aa flag, an NXDOMAIN in the zone and a REFUSED outside it. Original role, live-tested on Rocky Linux 10.
ansible-knot
Knot DNS from EPEL as an authoritative server that signs your zones with DNSSEC, keeps your zone files as written and serves a change with no serial to bump. As installed the package cannot start. The live test validates answers with delv against the zone's own key, and is refused a transfer without the TSIG key. Original role, live-tested on Rocky Linux 10.
ansible-nsd
NSD from EPEL: an authoritative-only server for your zones, the configuration and every zone checked by NSD's own tools first, transfers only to the addresses and TSIG keys you name, response rate limiting, and the state directory the package leaves unwritable fixed. The live test gets the zone with the key and is refused without it. Original role, live-tested on Rocky Linux 10.
ansible-pdns-recursor
PowerDNS Recursor from EPEL on loopback: DNSSEC validated, and every upstream query sent over DNS-over-TLS with each forwarder's certificate checked against the name it must carry. The live test counts every upstream query as TLS, gets SERVFAIL for a broken signature, and has a copy naming the wrong certificate answer nothing. Original role, live-tested on Rocky Linux 10.
ansible-powerdns
PowerDNS authoritative from EPEL with its SQLite backend; the live test adds a zone through the API, gets the record from dig and NXDOMAIN for an unknown name, sees the API refuse a caller with no key, and reads the query counter. The schema is recovered when a docs-stripped host lacks it. Original role, live-tested on Rocky Linux 10.