Saphira Linux dnsDragon

dnsDragon is a Saphira feature set for authoritative DNS. For this first release it is a guide, not a product: it walks you from installing BIND 9 through to a signed, delegated zone that the rest of the Internet can trust. The point is to make running DNS yourself understandable, not to wrap it in another SaaS control panel.

It exists because DNS is infrastructure you can operate directly. When your nameserver is your own machine running ordinary packages, you are not dependent on someone else's hosted dashboard to answer questions about your own domain. dnsDragon removes the mystery, not your control.

That is the whole philosophy. BIND was chosen because its configuration is plain text you can read, and its zone files are the same format the Internet has used for decades. Learn DNS through dnsDragon and you are learning DNS itself — not the abstractions of a particular interface.

Saphira packages BIND 9. We picked it deliberately over newer alternatives such as PowerDNS. BIND's text configuration and zone-file format are old-school by design, and that is the point: the skills you learn transfer directly to any BIND server anywhere, and the documentation you read is the documentation of DNS, not of a product.

Before any configuration, it helps to see the whole shape of DNS. A domain is registered with a registrar. The registrar sets the delegation — the NS records published by the parent zone that point at your nameservers. Those nameservers serve your zone, which is made of records. DNSSEC then extends that chain with a signed link of trust up to the parent. Miss any step and the chain does not hold.

• Domain — you register example.com with a registrar.
• Registrar — sets the delegation: NS records in the parent (.com) naming your authoritative nameservers.
• Authoritative nameserver — the server (BIND on Saphira) that answers for your zone.
• Zone — the collection of records for example.com held on that server.
• Records — SOA, NS, A, AAAA, MX, TXT and the rest that describe the domain.
• DNSSEC chain of trust — a signed DS record at the parent ties your signed zone to the root.

dnsDragon is one member of a family of Saphira feature sets. mailDragon handles self-hosted mail; webDragon runs the web stack; and dnsDragon is the DNS side. Later Dragons such as databaseDragon are separate efforts and do not expand the present dnsDragon scope.

This first dnsDragon is intentionally modest: BIND 9 on Saphira plus a careful guide to running authoritative DNS yourself. BIND is capable of far more, and dnsDragon can eventually grow into management tooling — creating zones, adding and removing records, maintaining serials, DNSSEC signing and rotation, checking delegation and managing secondaries. That tooling does not exist yet.