To configure DNS servers for db.system.com and db.testing.com in Kali Linux, you must install BIND9, define the zones in named.conf.local, and place the zone data files in /etc/bind. This ensures proper permissions and allows the service to reload correctly without runtime errors associated with incorrect directory placement.
Installing and Verifying BIND9
Kali Linux uses Debian-based package management, so the first step is installing the Berkeley Internet Name Domain (BIND) software. Open a terminal and update your package list to ensure you have the latest definitions, then install the server package.
sudo apt update
sudo apt install bind9 bind9-utils dnsutilsAfter installation, verify that the BIND9 service is installed correctly by checking its version. The command named -v should return the installed version string. It is also prudent to check if the service is currently running or enabled on boot using systemctl status bind9. By default, Kali may not start the DNS service immediately after installation, so you will need to enable it later in the configuration process.
Configuring Zone Definitions
The core of the configuration lies in telling BIND where to find the data for your specific domains. You must edit the local configuration file, which acts as the entry point for zone declarations. Use a text editor such as nano or vim to open /etc/bind/named.conf.local.
sudo nano /etc/bind/named.conf.localAdd the following lines to this file. Each block defines a forward lookup zone. Replace db.system.com and db.testing.com with the actual filenames you intend to create. The type master indicates that this server is the authoritative source for these zones.
zone "system.com" {
type master;
file "/etc/bind/db.system.com";
};
zone "testing.com" {
type master;
type master;
file "/etc/bind/db.testing.com";
};Note that the domain names in the zone directive must match the actual domain suffixes (e.g., system.com, not db.system.com). The file parameter points to the physical location of the zone database. As previously noted in editorial feedback, these files must reside in /etc/bind, which is the standard directory for BIND configuration and data on Debian-based systems. Placing them in /var/lib/bind is incorrect because that directory is intended for runtime state files like named.run and journal files, not static configuration data.
Creating Zone Data Files
Now that the paths are defined in the configuration, you must create the actual zone files. These files contain the records that map hostnames to IP addresses. Start by creating a template file that you can copy for each domain. Create /etc/bind/db.system.com with the following content:
$TTL 86400
@ IN SOA ns1.system.com. admin.system.com. (
2023101001 ; Serial
3600 ; Refresh
1800 ; Retry
604800 ; Expire
86400 ) ; Minimum TTL
; Name Servers
@ IN NS ns1.system.com.
; A Records
ns1 IN A 192.168.1.10
server1 IN A 192.168.1.11Ensure you replace the IP addresses and hostnames with values relevant to your network topology. The SOA record is mandatory and contains administrative information about the zone. The serial number should be incremented every time you make changes to the file to ensure secondary servers (if any) can detect updates. Copy this structure to create /etc/bind/db.testing.com, adjusting the domain-specific details accordingly.
Setting Permissions and Starting the Service
Permissions are critical for BIND security. The named user needs read access to the zone files. Run the following commands to set the correct ownership and permissions:
sudo chown root:bind /etc/bind/db.system.com
sudo chown root:bind /etc/bind/db.testing.com
sudo chmod 640 /etc/bind/db.system.com
sudo chmod 640 /etc/bind/db.testing.comBefore starting the service, it is highly recommended to test the configuration syntax. Use the named-checkconf utility to validate named.conf.local and the main config. Then use named-checkzone to validate the individual zone files:
sudo named-checkconf
sudo named-checkzone system.com /etc/bind/db.system.com
sudo named-checkzone testing.com /etc/bind/db.testing.comIf all checks pass, start the BIND9 service and enable it to start at boot:
sudo systemctl start bind9
sudo systemctl enable bind9Verify the service is active with systemctl status bind9. If the service fails to start, check the logs in /var/log/syslog for detailed error messages. Common issues include typos in the zone files or permission denials.
Testing the Configuration
Once the service is running, test resolution from the local machine. Use dig or nslookup to query the local DNS server. For example:
dig @127.0.0.1 system.com
dig @127.0.0.1 testing.comIf you encounter connectivity issues while testing, refer to our guide on Troubleshooting: Cannot Connect to the Internet to rule out broader network stack problems. Additionally, if you are running this setup inside a virtual machine, ensure your NAT settings are not interfering with local DNS resolution, as discussed in VMWare 17 Player Linux NAT guest can ping but cannot resolve DNS names.
Frequently Asked Questions
Why did my DNS service fail to start after copying files?
This is most often caused by incorrect file permissions or ownership. Ensure that the zone files in /etc/bind are owned by root:bind and have permissions set to 640. BIND runs as the named user, which belongs to the bind group, and it requires read access to these files.
What is the difference between /etc/bind and /var/lib/bind?
/etc/bind is the configuration directory where zone files and named.conf reside. /var/lib/bind is a runtime directory used for dynamic updates, journal files, and cache data. Static zone data must always be placed in /etc/bind to adhere to Debian standards and ensure proper loading on startup.
How do I increment the serial number in a zone file?
The serial number is typically formatted as YYYYMMDDNN, where NN is a sequence number. When you modify the zone file, increase the last two digits. For example, change 2023101001 to 2023101002. After changing it, reload the service with systemctl reload bind9.
Can I use dnsmasq instead of BIND for simple setups?
Yes, dnsmasq is lighter and easier to configure for small networks. However, if you need complex zone transfers or advanced BIND features, stick with BIND9. If you encounter socket binding errors with dnsmasq, check our article on Why dnsmasq failed to create listening socket for 172.17.0.1.
How do I verify that my zone files are syntactically correct?
Use the named-checkzone command followed by the zone name and the file path. For example: sudo named-checkzone system.com /etc/bind/db.system.com. This tool will report specific line numbers and errors if the syntax is invalid, allowing you to fix issues before reloading the service.