What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Configure BIND on a fixed internal address, permit queries only from your approved LAN prefixes, and keep recursion closed to every other network. The result can be a private recursive resolver, an authoritative server for internal names, or both. This guide uses BIND 9 syntax and shows how to add forward records, reverse lookups, forwarding, split-DNS views, validation, firewall rules, and recovery steps.
The sample address space is documentation-only: 192.168.50.0/24, 192.168.50.10, 192.168.50.20, and 2001:db8:50::/64 must be replaced with addresses from your network. A private DNS server should not become an open resolver on a public interface.
Choose the BIND design before installing it
BIND can perform two different jobs. A resolver-only server answers clients by consulting its cache and, when necessary, forwarding requests to upstream resolvers. A resolver plus authoritative server also hosts private zones such as home.arpa or an internal subdomain, so it answers local names directly.
| Design | Who may query | Who may recurse | Authoritative data | Forwarders | Typical use |
|---|---|---|---|---|---|
| Private recursive resolver | Trusted LAN and VPN prefixes | The same trusted clients | None, or only local host records | Usually required unless the server resolves from root hints | One DNS service for internet lookups inside a private network |
| Resolver plus private zones | Trusted clients, with zone-level controls | Trusted clients only | Forward and optional reverse zones on the BIND host | Used for names outside the private zones | Internal hostnames, service discovery, and normal internet resolution |
| Split DNS with views | Different answers for different client ACLs | Set separately in each view | Each view has its own zone data | Can be global or configured per view/zone | Full internal records for staff, restricted answers for guests |
Keep recursion disabled for an authoritative-only deployment. For a combined server, explicitly set both allow-query and allow-recursion; allowing one does not safely substitute for the other.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Plan addresses, names, and trust boundaries
Give the DNS host a stable address
Choose an address that will not change through DHCP, for example 192.168.50.10. Clients, DHCP scopes, firewall rules, and any static host records must all use that address. If the server has multiple interfaces, decide which one is internal and avoid listening on a public-facing interface.
List every approved client network
Write down each IPv4 subnet and IPv6 ULA prefix that may use DNS. The example ACL later permits localhost, 192.168.50.0/24, and 2001:db8:50::/64. Add VPN ranges if VPN users should resolve internal names. Do not use any for a private recursive service unless another, separately enforced design makes that exposure intentional.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Pick a private namespace
Home networks can use home.arpa. An organization can use a delegated internal subdomain of a domain it controls. Avoid publishing private addresses in the public version of a zone. A trailing dot in a fully qualified name, such as ns1.home.arpa., tells BIND that the name is absolute rather than relative to the zone origin.
Install BIND 9 and start the service
Use the supported BIND 9 package supplied by your operating system. Package names, configuration paths, service names, mandatory access-control labels, and zone-file directories differ by distribution.
Red Hat Enterprise Linux and compatible systems
- Install the server and client utilities:
sudo dnf install bind bind-utils. - Enable and start the service:
sudo systemctl enable --now named. - If you intentionally use the chroot package, the service is commonly
named-chroot; keep its configuration and zone paths consistent with that package. - The usual main configuration path is
/etc/named.conf, and a common zone directory is/var/named.
Debian and Ubuntu
- Refresh package metadata and install BIND and DNS utilities:
sudo apt update && sudo apt install bind9 bind9-utils dnsutils. - Enable and start the service:
sudo systemctl enable --now bind9. - The main configuration is commonly under
/etc/bind/, with distribution-managed files such as/etc/bind/named.confand a writable cache or zone directory under/var/cache/bindor another path defined by the package.
Do not copy a Red Hat path into a Debian configuration, or vice versa. Check the installed service unit and include statements before creating files.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Define an ACL and lock down resolver options
BIND ACLs are ordered address-match lists. A broad match placed before a narrower exclusion can grant access unintentionally, so put specific decisions first and review every network in the list.
acl "trusted" {
127.0.0.1;
192.168.50.0/24;
2001:db8:50::/64;
};
options {
directory "/var/named";
listen-on { 192.168.50.10; };
listen-on-v6 { none; };
recursion yes;
allow-query { trusted; };
allow-recursion { trusted; };
forwarders { 192.0.2.53; 2001:db8::53; };
// forward only;
};Place the ACL and options block in the main configuration, adapting the directory and listen addresses to your host.
listen-onlimits IPv4 sockets to the listed address. If BIND should answer on all internal IPv4 addresses, list them deliberately rather than relying on an accidental default.listen-on-v6 { none; };disables IPv6 listening in this example. If IPv6 clients are approved, replace it with the server’s internal IPv6 address and include the corresponding prefix in the ACL.recursion yes;enables recursive service. It should be paired with a restrictiveallow-recursion.allow-querycontrols who may ask the server questions, including authoritative questions.allow-recursioncontrols who may use the server to chase answers it does not already have.forwarderslists upstream resolver addresses for unresolved names. The sample addresses are documentation ranges, not usable public resolvers.
The built-in ACL names none, any, localhost, and localnets are available, but a named ACL is easier to audit when your network includes VPNs, multiple VLANs, or IPv6.
Choose forwarding behavior
Normal forwarding
With forwarders configured and no forward only; statement, BIND can use the listed upstream servers and may fall back to its normal resolution behavior if forwarding does not produce an answer. Select upstreams that satisfy your network’s availability and privacy policy, and permit outbound DNS traffic from the BIND host.
Forward-only mode
Add forward only; when policy requires every non-local query to go exclusively to the selected upstreams. This prevents direct recursive lookups but makes upstream reachability essential. A broken forwarder, blocked egress, or an incorrect address will make public names fail.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Per-zone forwarding
Forwarding can be global, associated with a view, or attached to a particular zone. A private authoritative zone should be answered locally; do not forward a zone that this server is meant to host. For special internal domains hosted elsewhere, a forward zone can direct only that namespace to the responsible servers.
Create an internal forward zone
Declare the zone
Add a zone declaration to the main configuration (or to the appropriate view):
zone "home.arpa" {
type primary;
file "/var/named/home.arpa.zone";
allow-query { trusted; };
};Some BIND documentation and older configurations use type master; primary is the current terminology, while both may be accepted depending on the installed version. Use the syntax documented for your BIND release.
Write the zone file
$TTL 300
@ IN SOA ns1.home.arpa. hostmaster.home.arpa. (
2026101501 ; serial YYYYMMDDnn
3600 ; refresh
600 ; retry
86400 ; expire
300 ) ; negative cache TTL
IN NS ns1.home.arpa.
ns1 IN A 192.168.50.10
nas IN A 192.168.50.20$TTL 300 supplies a five-minute default cache lifetime. The SOA serial is an incrementing value; the date-plus-counter format makes daily changes easy to recognize. Increase it whenever you edit the zone so secondaries and caches can detect new data. The SOA names the primary server and the mailbox for the zone administrator, written with the customary dot replacing the @ character.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchThe owner nas expands to nas.home.arpa. because it has no trailing dot. The ns1 A record gives clients an address for the name server itself. Add AAAA records for approved IPv6 addresses and CNAME records only when an alias is genuinely useful; an A or AAAA record is usually clearer for the canonical service name.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Set ownership and access
The named service account must be able to read the zone file, while ordinary users should not be able to modify it. On systems with SELinux or another mandatory access-control framework, apply the distribution’s expected file context. A syntactically valid file that the daemon cannot read will still prevent the zone from loading.
Add reverse DNS for private addresses
Reverse DNS maps an address back to a name through a PTR record. For the IPv4 network 192.168.50.0/24, the reverse zone is 50.168.192.in-addr.arpa.
zone "50.168.192.in-addr.arpa" {
type primary;
file "/var/named/50.168.192.in-addr.arpa.zone";
allow-query { trusted; };
};$TTL 300
@ IN SOA ns1.home.arpa. hostmaster.home.arpa. (
2026101501 3600 600 86400 300 )
IN NS ns1.home.arpa.
10 IN PTR ns1.home.arpa.
20 IN PTR nas.home.arpa.The left-hand owner is the final octet: 20 represents 192.168.50.20. Test it with dig @192.168.50.10 -x 192.168.50.20. Keep private reverse zones local so requests for RFC 1918-style addresses are not needlessly sent into the public DNS hierarchy. For IPv6, create the appropriate nibble-format ip6.arpa zone only when reverse lookups are required.
Free tools Windows power users keep installed
One-click scans. No signup required.
Use views for split DNS
A view lets BIND answer according to the requesting client’s address. This is useful when employees or household devices need full internal records while a guest VLAN should receive limited data or no recursion. View ACLs are evaluated in configuration order, and every zone used by a view must be declared inside that view.
acl "trusted" {
127.0.0.1;
192.168.50.0/24;
};
acl "guests" {
192.168.60.0/24;
};
options {
directory "/var/named";
listen-on { 192.168.50.10; };
forwarders { 192.0.2.53; };
};
view "internal" {
match-clients { trusted; };
recursion yes;
allow-query { trusted; };
allow-recursion { trusted; };
zone "home.arpa" {
type primary;
file "/var/named/home.arpa.zone";
};
zone "50.168.192.in-addr.arpa" {
type primary;
file "/var/named/50.168.192.in-addr.arpa.zone";
};
};
view "guest" {
match-clients { guests; };
recursion no;
allow-query { guests; };
zone "home.arpa" {
type primary;
file "/var/named/empty.home.arpa.zone";
};
};The guest zone file could contain only the records you deliberately expose, or an SOA with no host records. If guest clients should not use this server at all, omit the guest view and enforce refusal with ACLs and the firewall instead. Do not declare the same zone outside the views while also declaring it inside them; duplicate or misplaced declarations commonly produce startup errors or surprising answers.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Validate configuration and zone files before reloading
- Check the overall configuration. On a conventional Red Hat installation, run
sudo named-checkconf /etc/named.conf. On Debian or Ubuntu, pass the actual main file, commonly/etc/bind/named.conf. - Check every zone file:
sudo named-checkzone home.arpa /var/named/home.arpa.zoneandsudo named-checkzone 50.168.192.in-addr.arpa /var/named/50.168.192.in-addr.arpa.zone. Adapt paths to your distribution. - Correct missing semicolons, unmatched braces, invalid owner names, duplicate zones, bad view ordering, and unreadable files before touching the running daemon.
- Reload through the service manager, for example
sudo systemctl reload namedorsudo systemctl reload bind9. You can also usesudo rndc reloadwhen the control channel is configured. - Inspect the service journal immediately after reloading:
sudo journalctl -u named -eorsudo journalctl -u bind9 -e.
A successful syntax check means the parser accepted the files; it does not prove that the daemon can read every zone, bind every address, reach forwarders, or pass firewall rules.
Test from an allowed client and an unapproved network
Forward and reverse queries
dig @192.168.50.10 nas.home.arpa A
dig @192.168.50.10 ns1.home.arpa AAAA
dig @192.168.50.10 -x 192.168.50.20
dig @192.168.50.10 example.net AThe first three commands test local authoritative data. The last tests recursion or forwarding and should be run only from an approved client. Use the server address after @ so the test cannot silently go to a different resolver.
Check the boundary
Run the same tests from a guest, internet, or otherwise unapproved network. Depending on firewall policy, the result should be a DNS REFUSED response or a timeout because packets are dropped. A timeout can indicate filtering; a refusal proves that BIND received the request and rejected it. Neither result should expose recursive answers to an untrusted source.
Confirm listening sockets
Use the operating system’s socket tools, such as ss -lntup | grep ':53', and verify that BIND is listening only on intended addresses. Check both UDP and TCP: ordinary DNS commonly begins over UDP, while large responses, DNSSEC, and retries can require TCP.
Permit DNS through the firewall without widening access
Allow inbound UDP and TCP port 53 only from the trusted IPv4 and IPv6 prefixes. Permit outbound traffic to the configured forwarders if forwarding is used. Keep management channels such as SSH or the BIND control channel restricted to an administrator network; DNS ACLs do not protect those services.
Apply the same boundary at network firewalls, security groups, and host firewalls. A correct allow-query setting cannot stop an unwanted client from consuming bandwidth or reaching another service if the packet is allowed through a perimeter firewall.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsTroubleshoot the failure that matches the symptom
| Symptom | Likely causes | Checks and fixes |
|---|---|---|
| Named will not start | Syntax error, duplicate zone, invalid view order, wrong path, or unreadable file | Run named-checkconf, then named-checkzone; inspect the service journal; verify ownership and mandatory-access-control labels. |
| Client receives REFUSED | Source address is absent from the ACL, or recursive access is not allowed | Confirm the actual client source address, then review both allow-query and allow-recursion. Check that the intended view matches first. |
| Client times out | Wrong listen address, blocked UDP/TCP 53, stopped service, or a route problem | Check service status, listening sockets, host and perimeter firewalls, and the address used in the dig @server command. |
| Internal name returns NXDOMAIN | Client queried another resolver, zone failed to load, owner name has the wrong origin, or the serial was not increased | Query the BIND address explicitly, inspect logs, validate the zone, confirm trailing dots and record owners, and increment the SOA serial after edits. |
| Reverse lookup fails | Incorrect reverse-zone boundary or missing PTR | For 192.168.50.0/24, use 50.168.192.in-addr.arpa; add the PTR and test with dig -x. |
| Public names fail | Forwarders unreachable, egress blocked, bad upstream address, or unintended forward only; |
Test reachability from the DNS host, review logs, verify port 53 egress, and remove or intentionally retain forward only; according to policy. |
| Views return the wrong data | ACL order selects another view, or a zone is missing from a view | Put the most specific client matches first, ensure each view contains its own zone declarations, and test from each network. |
Operate the private resolver safely
- Keep recursion limited to trusted networks even when authoritative zones are publicized elsewhere.
- Do not publish private addresses in public DNS zones.
- Review ACLs whenever VLANs, VPNs, or IPv6 prefixes change; an old broad subnet can silently expand access.
- Monitor logs for unexpected source addresses, repeated refusals, and forwarding failures.
- Back up the main configuration, ACL definitions, zone files, and any view-specific files. Include the SOA serial in change records.
- Apply operating-system and BIND security updates through the distribution’s supported channels, then rerun configuration and zone checks before reloading.
- Keep the DNS host’s clock accurate. SOA serials are independent of wall-clock enforcement, but reliable time makes dated serial conventions and log analysis meaningful.
A private BIND deployment is complete when approved clients can resolve the intended internal records and permitted external names, reverse lookups work where defined, and an unapproved network cannot use the server for recursion. The ACL, listener addresses, views, and firewall should all enforce that same boundary rather than relying on any single control.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
