From cd833bc2852ec204fbaecde7ada56798eba005da Mon Sep 17 00:00:00 2001
From: Mike Crute <mike@crute.us>
Date: Mon, 18 Jan 2021 06:24:42 +0000
Subject: bind: new hosting config update

---
 bind/conf/named.conf | 82 ++++++++++++++++++++++++++++++----------------------
 1 file changed, 48 insertions(+), 34 deletions(-)

(limited to 'bind/conf/named.conf')

diff --git a/bind/conf/named.conf b/bind/conf/named.conf
index dcf0cf3..b7d563d 100644
--- a/bind/conf/named.conf
+++ b/bind/conf/named.conf
@@ -2,41 +2,47 @@
 
 include "/etc/bind/rndc.key";
 
-options {
-	directory "/etc/bind/local/cache";
-	bindkeys-file "/etc/bind/bind.keys";
-
-	//========================================================================
-	// If BIND logs error messages about the root key being expired,
-	// you will need to update your keys.  See https://www.isc.org/bind-keys
-	//========================================================================
+//========================================================================
+// If BIND logs error messages about the root key being expired,
+// you will need to update your keys.  See https://www.isc.org/bind-keys
+//========================================================================
 
-	// mcrute: disable dnssec because the AWS resolvers return invalid zone
-	// signatures
-	dnssec-validation no;
-
-	zone-statistics full;
+options {
+	directory "/etc/bind/local/zones";
+	managed-keys-directory "/etc/bind/local/managed-keys";
+	bindkeys-file "/etc/bind/bind.keys"; // Default is /etc/bind.keys :-(
 
-	auth-nxdomain no;    # conform to RFC1035
-	notify master-only;  # don't send NOTIFY from secondaries
+	dnssec-validation no; // AWS resolvers return invalid zone signatures
+	zone-statistics full; // Track full stats for prometheus export
+	masterfile-format text; // Write zonefiles in text even for secondary zones
+	auth-nxdomain no; // conform to RFC1035
+	notify master-only; // don't send NOTIFY from secondaries
 
 	version none;
 	hostname none;
 
-	listen-on {
-		any;
-	};
+	// Force TCP if response would be larger than IPv6 fragment size
+	// see: https://blog.apnic.net/2020/09/17/dns-flag-day-2020-what-you-need-to-know/
+	max-udp-size 1220;
+	edns-udp-size 1220;
 
-	listen-on-v6 {
-		any;
-	};
+	// Allow more transfers at once to improve secondary convergence
+	transfers-in 50;
+	transfers-out 50;
+
+	listen-on { any; };
+	listen-on-v6 { any; };
+	allow-update-forwarding { any; };
 
-	allow-update-forwarding {
-		any;
+	// Typically this ACL is empty but exists so that it can be populated
+	// during an attack to block bad clients.
+	blackhole {
+		blackhole-clients;
 	};
 
 	allow-notify {
-		all-dns-servers;
+		internal-keys;
+		external-keys;
 	};
 
 	allow-recursion {
@@ -48,15 +54,6 @@ options {
 		internal-nets;
 		localhost;
 	};
-
-	// Force TCP if response would be larger than IPv6 fragment size
-	// see: https://blog.apnic.net/2020/09/17/dns-flag-day-2020-what-you-need-to-know/
-	max-udp-size 1220;
-	edns-udp-size 1220;
-
-	// Allow more transfers at once to improve secondary convergence
-	transfers-in 50;
-	transfers-out 50;
 };
 
 statistics-channels {
@@ -69,4 +66,21 @@ controls {
 	inet ::1 allow { localhost; } keys { "rndc-key"; };
 };
 
-include "/etc/bind/named_local.conf";
+acl internal-nets {
+	// Internal RFC1918
+	172.16.0.0/12;
+
+	// Unknown? Maybe Docker bridge?
+	192.168.255.0/24;
+
+	// Pomona ARIN
+	23.149.16.0/24;
+	2602:0803:4000::/40;
+
+	// AWS
+	2600:1f14:f39:e000::/56;
+	2600:1f16:33:500::/56;
+	2a05:d01c:7ba:b800::/56;
+};
+
+include "/etc/bind/local/named.conf";
-- 
cgit v1.2.3