DNS

Saphira Linux dnsDragon

A Saphira feature for running your own authoritative DNS with BIND 9. The first dnsDragon is a proper, practical guide: install BIND from Saphira packages, understand where it lives, build your first zone, and sign it with DNSSEC — without hiding DNS behind a dashboard. You own the machine, the configuration and the DNS.

In testing, functionality present — helpers missing

Install BIND 9 from Saphira

BIND 9 is shipped by Saphira as the bind package (currently 9.20.x). Installing it pulls in bind-progs, which provides the command-line tools you need: named-checkconf and named-checkzone for validation, dnssec-keygen and dnssec-signzone for DNSSEC, and dig and delv for querying.

apk update
apk add bind

# Confirm the tools are present
command -v named named-checkconf named-checkzone dig delv

Where the configuration lives

BIND's main configuration is /etc/bind/named.conf. On Saphira this file usually includes other files (such as per-zone includes), so a single tidy named.conf can pull in many zones without becoming one giant file.

# View the main configuration
cat /etc/bind/named.conf

# Validate the entire configuration before (re)starting
named-checkconf

Tipnamed-checkconf reads named.conf and reports syntax errors before they take your nameserver down. Run it after every edit to the configuration.

Where zones live

Zone files live under /var/bind. A simple server can keep one file per zone directly in /var/bind, named after the zone. Larger setups group them into subdirectories (see the production layout on the Zones page). The directory option in named.conf tells BIND where to look for files referenced by a zone.

ls -l /var/bind

Start and operate the service

On Saphira the DNS service is named. Start it, enable it to come up on boot, and check its status with OpenRC. After changing zones or configuration, reload rather than fully restart so live queries are not interrupted.

rc-service named start
rc-update add named
rc-service named status

# After editing zones or configuration:
rc-service named reload

named also listens on a control channel (port 953) for rndc, the name daemon control utility. rndc reload does the same job as the service reload and can target a single zone. The control channel is restricted to localhost in a normal configuration.

rndc reload example.com
rndc status

Checking your work

Two habits keep DNS boring in the right way: validate the configuration, and query the result. dig asks a nameserver for records; delv does the same with DNSSEC validation, which matters once zones are signed.

# Ask the local server directly
dig @127.0.0.1 example.com NS

# With DNSSEC validation once signed
delv @127.0.0.1 example.com +vtrace

NoteThe commands above use dig and delv against 127.0.0.1. Until the zone is delegated to this server (NS set at your registrar), the rest of the Internet cannot reach it — only your local queries will succeed.

No dnsDragon tool yet

Unlike webDragon, which ships the saphira-site helper, dnsDragon does not yet provide a management command. For this release you edit named.conf and zone files directly, exactly as on any BIND server. That is the point: you are learning the real system. Future dnsDragon tooling may generate and maintain these files for you, but it is not present today.