DNS with BIND9 on Debian

Question

I am trying to create my own dns using Bind9 and Debian 11 One Virtual Machine in Google Computing Engine has these configuration

Server 1 Google Cloud IP 35.206.115.212 The file /etc/hosts

127.0.0.1       localhost
::1             localhost ip6-localhost ip6-loopback
ff02::1         ip6-allnodes
ff02::2         ip6-allrouters
35.206.115.212 ns1.itinfrastructuretest.info ns1
10.128.0.2 instance-1.us-central1-a.c.dns-1902.internal instance-1  # Added by Google
169.254.169.254 metadata.google.internal  # Added by Google

The file /etc/hostname

ns1

The File /etc/bind/zones/db.35.206.115

; BIND reverse data file for local loopback interface
;
$TTL    604800
@       IN      SOA     itinfrastructuretest.info. root.itinfrastructuretest.info. (
                              2         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;
        IN      NS      ns1.itinfrastructuretest.info.
        IN      NS      ns2.itinfrastructuretest.info.


1       IN      PTR     ns1.itinfrastructuretest.info.
2       IN      PTR     ns2.itinfrastructuretest.info.
3       IN      PTR     www.itinfrastructuretest.info.

The File /etc/bind/zones/db.itinfrastructuretest.info

$TTL    604800
@       IN      SOA     ns1.itinfrastructuretest.info. root.itinfrastructuretest.info. (
                              5         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;

; Name servers
itinfrastructuretest.info.    IN      NS      ns1.itinfrastructuretest.info.
itinfrastructuretest.info.    IN      NS      ns2.itinfrastructuretest.info.

; A records for name servers
ns1             IN      A       35.206.115.212
ns2             IN      A       15.236.156.144

; Other A records
@               IN      A       15.236.147.109
www             IN      A       15.236.147.109
                IN      TXT     google-site-verification=EdC5AxyrHZ-HnRwyCgjckdIiFgFDzLniOyS2Tm6MwAk
; Mail server MX record

The File /etc/bind/named.conf.local

//
// Do any local configuration here
//

// Consider adding the 1918 zones here, if they are not used in your
// organization
//include "/etc/bind/zones.rfc1918";

zone "itinfrastructuretest.info" {
  type master;
  file "/etc/bind/zones/db.itinfrastructuretest.info";
 allow-transfer { 15.236.156.144; };
};

zone "115.206.35.in-addr.arpa" {
        type master;
        notify no;
        file "/etc/bind/zones/db.35.206.115";
};

The File /etc/bind/named.conf.options

options {
        directory "/var/cache/bind";

        dnssec-validation auto;

        listen-on-v6 { any; };

recursion no;
allow-transfer { none; };
auth-nxdomain no;
};

Server 2 Amazon Cloud IP 15.236.156.144 The Second Server on AWS The /etc/hosts

# Your system has configured 'manage_etc_hosts' as True.
# As a result, if you wish for changes to this file to persist
# then you will need to either
# a.) make changes to the master file in /etc/cloud/templates/hosts.tmpl
# b.) change or remove the value of 'manage_etc_hosts' in
#     /etc/cloud/cloud.cfg or cloud-config from user-data
#
127.0.1.1 ip-172-31-45-28.eu-west-3.compute.internal ip-172-31-45-28 ns2 ns2
127.0.0.1 localhost
15.236.156.144 ns2.itinfrastructuretest.info ns2
# The following lines are desirable for IPv6 capable hosts
::1 ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts

The file /etc/hostname

ns2

The File /etc/bind/named.conf.local

//
// Do any local configuration here
//

// Consider adding the 1918 zones here, if they are not used in your
// organization
//include "/etc/bind/zones.rfc1918";

zone "itinfrastructuretest.info"{
  type slave;
  file "db.itinfrastructuretest.info";
  masters { 35.206.115.212;};
};

zone "156.236.15.in-addr.arpa" {
        type slave;
        file "db.15.236.156";
        masters {35.206.115.212 ;};
};

The File /etc/bind/named.conf.options

options {
        directory "/var/cache/bind";

 dnssec-validation auto;

        auth-nxdomain no;    # conform to RFC1035
        listen-on-v6 { any; };
        allow-transfer { none; };
        recursion no;

};

I was following these tutorials

How To Configure Bind as an Authoritative-Only DNS Server on Ubuntu 14.04

and BIND9ServerHowto

The uploaded image shows that nothing was transferred from the master dns to the slave dns. enter image description here

When I run dig command in the master dns server I got this

 dig 35.206.115.212 115.206.35.in-addr.arpa. AXFR

; <<>> DiG 9.11.5-P4-5.1-Debian <<>> 35.206.115.212 115.206.35.in-addr.arpa. AXFR
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 39639
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;35.206.115.212.                        IN      A

;; AUTHORITY SECTION:
.                       86385   IN      SOA     a.root-servers.net. nstld.verisign-grs.com. 2020051700 1800 900 604800 86400

;; Query time: 1 msec
;; SERVER: 169.254.169.254#53(169.254.169.254)
;; WHEN: Sun May 17 09:38:42 UTC 2020
;; MSG SIZE  rcvd: 118

; Transfer failed.

I tried @ before dig command. However, there is something I am not sure about. Can I build my own DNS, SMTP, CA in cloud by cloud providers like AMAZON, GOOGLE, and MICROSOFT? or I have to use the services for these protocols that are provided by the cloud providers? Amazon Route 53, Amazon SES, and AWS Certificate Manager (ACM) Private Certificate Authority (CA)

I do not know if I need to register something for ns1.itinfrastructuretest.info and ns2.itinfrastructuretest.info at https://search.arin.net/rdap/ or

https://www.internic.net/ or my registrar or my hosting company Google Cloud and Amazon Cloud

Answer 1

1. You can certainly build your own nameserver on a cloud VM (e.g. AWS EC2).
2. Make sure that the firewall (both the OS and the cloud one - e.g. AWS Security Group) is open for TCP and UDP port 53
3. Make sure the VM has static, public IP address (in AWS called Elastic IP)
4. Once done register the IP as a nameserver with your registrar (e.g. godaddy or whoever you registered the domain with).

Or - better - use a managed DNS service. All cloud providers have one (e.g. AWS Route53) and it's generally a better idea to use that because it integrates with their other services, for example you can use your automation of choice (AWS CloudFormation) to create DNS records. Also it's probably more resilient and cheaper than whatever you can come up with.

Hope that helps :)