BIND Zone File Example

A zone file lists the DNS records for a domain. Its syntax is old and unforgiving: a missing dot or a stale serial number does not produce an error, it produces a domain that quietly points the wrong way.

Names are relative

Inside a zone file, a name without a trailing dot has the zone appended. Writing www.example.com instead of www makes www.example.com.example.com. A full name must end in a dot.

www    IN CNAME  @
mail   IN A      203.0.113.20
@      IN MX 10  mail
@      IN CNAME  other.example.net.   ; a full name needs the trailing dot

The SOA and the serial

The serial number tells secondary servers when the zone changed. Use YYYYMMDDnn and raise it on every edit; if it does not increase, secondaries keep serving the old data.

What cannot coexist

A CNAME cannot share a name with any other record, and cannot sit at the zone apex, which already holds SOA and NS records. A name server inside the zone needs an address record, or resolvers cannot find the server that serves the zone.

Reverse DNS

A reverse zone maps addresses back to names with PTR records, under in-addr.arpa for IPv4 and ip6.arpa for IPv6. It covers a whole /8, /16 or /24, and one address should have one PTR.

10    IN PTR  example.com.
20    IN PTR  mail.example.com.

Check before you reload

named-checkzone reads the file the way the server will and reports errors; named-checkconf checks the configuration that loads it.

named-checkzone example.com db.example.com

Open the DNS zone (BIND) generator

Frequently asked questions

Why does my TXT record need quotes?

The data may contain spaces and semicolons, so BIND wants it quoted. Strings longer than 255 characters are split into several quoted strings.

Do I need a reverse zone?

Mail servers are often checked by reverse lookup. The reverse zone for a block normally belongs to whoever owns the addresses, so ask your provider if it is not yours.

What does allow-transfer none do?

It refuses zone transfers, so nobody can copy your zone. List your secondary servers when you add them.

Guides

• Nginx Reverse Proxy Configuration
• Caddy Reverse Proxy Configuration
• Nginx Static Site Configuration
• Caddy Static Site Configuration
• Nginx + PHP-FPM Configuration
• Caddy + PHP-FPM Configuration
• Nginx SSL/TLS Configuration
• Nginx Load Balancer Configuration
• Caddy Load Balancer Configuration
• Nginx Rate Limiting Configuration
• Nginx Security Headers Configuration
• Caddy Security Headers Configuration
• Nginx Gzip Compression Configuration
• Nginx Caching Configuration
• Caddy HTTPS Redirect Configuration
• Nginx WebSocket Proxy Configuration
• Nginx Content-Security-Policy Header
• Block Bad Bots and Scanners in Nginx
• fail2ban for Nginx
• nginx.conf Best Practices
• Nginx Location Regex Tester
• Deploy Nginx Config with GitHub Actions
• Nginx CORS Headers Configuration
• Nginx Cache-Control Headers Configuration
• Nginx 301 Redirect Map Configuration
• robots.txt, Sitemap and security.txt
• Apache .htaccess Configuration
• Docker Compose and Dockerfile Configuration
• systemd Service and Timer Configuration
• Cron Expression Explainer
• SSH Hardening with sshd_config
• Linux Firewall Rules: ufw, nftables and iptables
• Glob Pattern Tester
• Analysing Nginx Access Logs with awk
• Subnet Mask and CIDR Calculator
• VLAN Configuration on Linux
• Static Routes and Policy Routing on Linux
• NAT and Port Forwarding with nftables
• DHCP Server Configuration
• BIND Zone File Example
• WireGuard Server and Client Configuration