Creating Name Servers

You will need to install BIND prior to configuring it:

# yum install bind bind-utils

You should then enable the service, but not start it until configuration is complete:

# systemctl enable named

You will need to edit the primary configuration file: /etc/named.conf

You can find sample configurations under: /usr/share/doc/bind-$VERSION

Add the local IP to the listen-on line:

listen-on port 53 { 127.0.0.1; 10.0.1.10;};

Limit queries to localhost and Secondary DNS host, and permit transfers to the Secondary DNS host:

allow-query     { localhost; 10.0.1.11; };
allow-transfer  { localhost; 10.0.1.11; };

Disable recursion:

recursion no;

Add forward and reverse zones above the includes at the bottom:

zone "example.com" IN {
type master;
file "forward.example.com";
allow-update { none; };
};
zone "1.0.10.in-addr.arpa" IN {
type master;
file "reverse.example.com";
allow-update { none; };
};

Sample config files may be found in /usr/share/doc/bind-$VERSION

The files should be located in /var/named/ and must match the files referenced in /etc/named.conf: forward.example.com, and reverse.example.com.

Use the following if you don't want to construct the files from scratch:

forward.example.com:

$TTL 86400
@   IN  SOA     ns1.example.com. server1.example.com. (
        2018091201  ;Serial
        3600        ;Refresh
        1800        ;Retry
        604800      ;Expire
        86400       ;Minimum TTL
)
@           IN  NS  ns1.example.com.
@           IN  NS  ns2.example.com.
server1     IN  A   10.0.1.10
ns1         IN  A   10.0.1.10
server2     IN  A   10.0.1.11
ns2         IN  A   10.0.1.11
client1     IN  A   10.0.1.12

reverse.example.com:

$TTL 86400
@   IN  SOA     ns1.example.com. server1.example.com. (
        2018091201  ;Serial
        3600        ;Refresh
        1800        ;Retry
        604800      ;Expire
        86400       ;Minimum TTL
)
@           IN  NS  ns1.example.com.
@           IN  NS  ns2.example.com.
server1     IN  A   10.0.1.10
ns1         IN  A   10.0.1.10
server2     IN  A   10.0.1.11
ns2         IN  A   10.0.1.11
client1     IN  A   10.0.1.12
10          IN PTR server1.example.com.
10          IN PTR ns1.example.com.
11          IN PTR server2.example.com.
11          IN PTR ns2.example.com.
12          IN PTR client1.example.com.

You should verify the syntax of the files prior to starting the service:

# named-checkconf /etc/named.conf

# named-checkzone example.com /var/named/FORWARD ZONE FILE

# named-checkzone example.com /var/named/REVERSE ZONE FILE

# systemctl start named

Be sure to watch for any errors. You can look in /var/log/messages for more details. If your configuration is sane, BIND should be running, and can be verified with:

# dig @localhost server1.example.com

Modify the firewall to the Secondary DNS Host:

# firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.1.11" destination address=10.0.1.10 port port=53 protocol=tcp accept'

# firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.1.11" destination address=10.0.1.10 port port=53 protocol=udp accept'

# firewall-cmd --reload

On Server2, install BIND and enable it:

# yum install bind bind-utils

# systemctl enable named

Edit /etc/named.conf like on Server1:

Add the local IP to the listen-on line:

listen-on port 53 { 127.0.0.1; 10.0.1.11;};

Limit queries to the local subnet:

allow-query     { localhost; 10.0.1.0/24; };

Disable recursion:

recursion no;

Add forward and reverse (slave) zones above the includes at the bottom:

zone "example.com" IN {
type slave;
file "/slaves/example.com.fwd";
masters { 10.0.1.10; };
};
zone "1.0.10.in-addr.arpa" IN {
type slave;
file "/slaves/example.com.rev";
masters { 10.0.1.10; };
};

Verify the configuration:

# named-checkconf /etc/named.conf

And start BIND:

# systemctl start named

Be sure to watch for any errors. You can look in /var/log/messages for more details. If your configuration is sane, BIND should be running and can be verified with:

# dig @localhost server1.example.com

Enable DNS traffic through the firewall

# firewall-cmd --permanent --add-service=dns && firewall-cmd --reload

Install NetworkManager and start the service:

# yum install NetworkManager

# systemctl enable NetworkManager && systemctl start NetworkManager

Configure the interface to be static, then assign the secondary host IP as the DNS, and the DNS search to be example.com:

# nmcli con mod System\ ens5 ipv4.method manual ipv4.addresses 10.0.1.12/24 ipv4.gateway 10.0.1.1 ipv4.dns 10.0.1.11 ipv4.dns-search example.com

Remove the ec2.internal search domain from /etc/resolv.conf:

# sed -i '/ec2.internal/d' /etc/resolv.conf

Restart networking to pickup the configuration change:

# systemctl restart network

Verify that it works with dig:

# dig server1.example.com