DNS
Saphira Linux dnsDragon
A Saphira feature for running your own authoritative DNS with BIND 9. The first dnsDragon is a proper, practical guide: install BIND from Saphira packages, understand where it lives, build your first zone, and sign it with DNSSEC — without hiding DNS behind a dashboard. You own the machine, the configuration and the DNS.
Declare an authoritative zone
An authoritative server needs to know which zones it is responsible for. That is a zone statement in named.conf. type master means this server holds the primary copy of the zone; file points at the zone file under /var/bind.
options {
directory "/var/bind";
recursion no;
listen-on port 53 { any; };
listen-on-v6 port 53 { any; };
allow-query { any; };
};
zone "example.com" {
type master;
file "/var/bind/example.com.zone";
};Create a simple working zone file
The zone file lists the records. The example below is a complete, minimal authoritative zone for example.com. Read it top to bottom: the SOA describes the zone itself, NS names the nameservers, and the remaining records describe the services.
$ORIGIN example.com.
$TTL 300
@ IN SOA ns1.example.com. hostmaster.example.com. (
2026082001 ; Serial: YYYYMMDDVV
3600 ; Refresh
1800 ; Retry
604800 ; Expire
300 ) ; Minimum (negative caching)
@ IN NS ns1.example.com.
@ IN NS ns2.example.com.
@ IN MX 10 mail.example.com.
@ IN TXT "v=spf1 mx -all"
@ IN A 203.0.113.10
@ IN AAAA 2001:db8:example::10
www IN A 203.0.113.10
www IN AAAA 2001:db8:example::10
mail IN A 203.0.113.10
; A name can have several records of the same type
www IN CNAME @
; Only issue certificates for our hosts
@ IN CAA 0 issue "letsencrypt.org"
@ IN CAA 0 issuewild ";"- SOA — Start of Authority: one per zone; names the primary nameserver, the responsible mailbox, and timing (serial, refresh, retry, expire, minimum). Bump the serial on every change.
- NS — the nameservers authoritative for the zone. These must match the delegation set at the parent.
- A / AAAA — IPv4 / IPv6 addresses for a name. @ refers to the zone apex (example.com itself).
- MX — mail exchanger; the priority (10) orders multiple servers.
- TXT — free text; commonly SPF, domain verification, and DKIM. Quoted as a string.
- CNAME — an alias to another name (here www points at the apex). A name with a CNAME cannot also have other record types.
- CAA — authorises which certificate authorities may issue certificates for the domain.
How Saphira organises zones in production
A single flat directory is fine to learn with, but a server holding many zones benefits from structure. On Saphira's own authoritative nameservers, zones are kept under /var/bind/pri/forward, grouped first by top-level domain and then by second-level domain:
/var/bind/pri/forward/
├── ltd
└── uk
├── az2
├── co
│ ├── az2
│ ├── breathcard
│ └── zerodns
└── vm2
└── vm2.uk.zoneEach zone is its own file, and named.conf pulls them in through included files such as named.conf.zerodns.zones and named.conf.production.zones. The layout is ordinary BIND — it just keeps many zones readable instead of heaping them into one directory.
A real Saphira zone: vm2.uk
Below is a real authoritative zone served by Saphira's own infrastructure (vm2.uk). It shows the same record types from the example above, plus a few you will meet later — DMARC and DKIM for mail authentication, and modern service records (SVCB) used by agent tooling. It is included as-is to show what a working zone looks like in the wild; the advanced records are labelled so you are not expected to understand them yet.
; 🐉 PROJECT WATERDRAGON — AUTHORITATIVE SECOND-LEVEL APEX FORWARD TREE
; File Path: /var/bind/pri/forward/uk/vm2/vm2.uk.zone [context]
$ORIGIN vm2.uk.
$TTL 300
@ IN SOA ns0.zerodns.co.uk. hostmaster.zerodns.co.uk. (
2026081702 ; Serial: YYYYMMDDVV (Year-Month-Day-Version) [context]
3600 ; Refresh: 1 Hour memory-sync interval for secondary slaves
1800 ; Retry: 30 Minute retry cadence if slave tracking falls out
604800 ; Expire: 1 Week absolute time before slaves invalidate memory
300 ) ; Minimum: 5 Minute negative lookup caching horizon
@ IN NS ns0.zerodns.co.uk.
@ IN NS ns1.zerodns.co.uk.
@ IN MX 10 mail.zerodns.co.uk.
@ 300 IN TXT "v=spf1 mx -all"
@ IN A 217.155.241.55
@ 300 IN AAAA 2a02:8012:bc57:fead::beef
stats 300 IN A 217.155.241.55
stats 300 IN AAAA 2a02:8012:bc57:fead:c0ff:ee:babe:face
saphira 300 IN A 217.155.241.55
saphira 300 IN AAAA 2a02:8012:bc57:fead::beef
dev.saphira 300 IN AAAA 2a02:8012:bc57:c0ff::1
@ 300 IN TXT "google-site-verification=iRowVdutop0-c9Sttd4jihZWMkSCimR7kjmsbLMJqKc"
saphira 300 IN TXT "google-site-verification=wvEQCU0StPzrSkiKozXKzaufetcetlrEsZ_rnPu9FZc"
; www IN CNAME @
_dmarc IN TXT "v=DMARC1; p=reject; sp=reject; pct=100; adkim=r; aspf=r; rua=mailto:dmarc@zerodns.co.uk; ri=43200"
mail._domainkey IN TXT ("v=DKIM1; k=rsa;" "p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArRQtYwdHx2udTehxSQioHFWYtgDwD5ZLvXNL1E6Ksjf+/5lzz9qftVNqB/Y+x3t4Po/ql7Pk3V9atrZcvjB8F5f8lS2JTZ1i2Voqqh2VZsAP2nVm6oKpym4cJVsLlmPpI2s3+kwJR9ik/mJIBM6Oe/JsyxQWnjjkE6u1hojP1vc6lREh/tTP9e/4NEfMbgjYaLNZXFd9HafiuVs9m" "xmvbjYNAtmSbnWFwHyV2e+s0NndpQywRKYDuEPG+wiCMNAuku9L/o7WywCuM3bJq+Xmhk25Uy8cu73meuWTq1ISkXbajct/pHjL4CE7utPbuvF6QpSQVbWv/YIaRXGvSd3oEwIDAQAB")
_index._agents.saphira 300 IN TXT "v=DNS-AID; index=https://saphira.vm2.uk/.well-known/api-catalog; mcp=https://saphira.vm2.uk/.well-known/mcp/server-card.json; webmcp=https://saphira.vm2.uk/webmcp.json"
_mcp._agents.saphira 300 IN TXT "v=DNS-AID; mcp=https://saphira.vm2.uk/mcp; card=https://saphira.vm2.uk/.well-known/mcp/server-card.json"
_openapi._agents.saphira 300 IN TXT "v=DNS-AID; openapi=https://saphira.vm2.uk/openapi.json; catalog=https://saphira.vm2.uk/.well-known/api-catalog"
_skills._agents.saphira 300 IN TXT "v=DNS-AID; skills=https://saphira.vm2.uk/.well-known/agent-skills/index.json"
_webmcp._agents.saphira 300 IN TXT "v=DNS-AID; webmcp=https://saphira.vm2.uk/webmcp.json"
_auth._agents.saphira 300 IN TXT ("v=DNS-AID;" "authmd=https://saphira.vm2.uk/auth.md; " "oidc=https://saphira.vm2.uk/.well-known/openid-configuration; " "as=https://saphira.vm2.uk/.well-known/oauth-authorization-server; " "prm=https://saphira.vm2.uk/.well-known/oauth-protected-resource")
_index._agents.saphira 300 IN SVCB 1 saphira.vm2.uk. mandatory=alpn,port alpn="h2" port=443
_mcp._agents.saphira 300 IN SVCB 1 saphira.vm2.uk. mandatory=alpn,port alpn="h2" port=443
_openapi._agents.saphira 300 IN SVCB 1 saphira.vm2.uk. mandatory=alpn,port alpn="h2" port=443
_skills._agents.saphira 300 IN SVCB 1 saphira.vm2.uk. mandatory=alpn,port alpn="h2" port=443
_webmcp._agents.saphira 300 IN SVCB 1 saphira.vm2.uk. mandatory=alpn,port alpn="h2" port=443
_auth._agents.saphira 300 IN SVCB 1 saphira.vm2.uk. alpn="h2" port=443- SOA, NS, MX, A, AAAA, TXT — the same records as the example.com zone, doing the same jobs.
- TXT here also carries SPF, Google site verification, DMARC policy and a DKIM public key — all public by design.
- _dmarc / mail._domainkey — DMARC and DKIM, the mail-authentication trio alongside SPF. Covered in mailDragon.
- _agents.* TXT and SVCB — modern service-records used by Saphira's own agent tooling. Advanced; not needed to run basic DNS.