(:redirect nsd/configure:)

Configuring nsd

nsd is an authoritative name server. nsd comes as part of openbsd base so no installation will be necessary.

Advantages of nsd:

Audited by the OpenBSD team

Simpler than BIND

Disadvantages of nsd:

More difficult to fork compared to delphinusdnsd

NOTICE: This guide assumes you have a basic understanding of TCP/IP networking, ?IPv4 and IPv6 addressing, the domain name system, ?resource records, and zone files.

Introduction

Please read through the nsd, nsd.conf, nsd-checkconf, and nsd-control man pages.

nsd.conf

Edit these sections in /var/nsd/etc/nsd.conf:

server:
        hide-version: yes
        verbosity: 2
        database: "" # disable database
        username: _nsd
        logfile: "/var/log/nsd.log"

You'll want to hide the version, change verbosity to 2 to get errors and warnings about failed transfers. We don't want a database so we leave it blank, we drop to the user _nsd after binding the ?socket, and we want to log to /var/log/nsd.log.

## bind to a specific address/port
        ip-address: 198.51.100.1
#       ip-address: 192.0.2.53@5678
        ip-address: 2001:db8::

We bind to our public IPv4 address 198.51.100.1 and our public IPv6 address 2001:db8:: (substitute these with your real public IP addresses).

Note: If you forget your real public IP addresses, you can check ?ifconfig, your ?hostname.if0, or check your BuyVM or VMM install guides.

remote-control:
        control-enable: yes
        control-interface: /var/run/nsd.sock

This will allow using nsd-control to control the server.

Master-Only Server

The DNS system requires you to specify master and slave servers. Internet standards require every zone to have at least two name servers, so you'll normally need to configure both a master and a slave.

To start off, we'll configure just a master name server. This will let us quickly test to see if our name server is working:

## master zone example
zone:
       name: "example.ircnow.org"
       zonefile: "master/example.ircnow.org"
#       notify: 192.0.2.1 NOKEY
#       provide-xfr: 192.0.2.1 NOKEY

We'll uncomment the zone. The name is the name of our ?domain or subdomain. It might look like username.fruit.ircnow.org or it could be a domain you registered, such as example.com. The zonefile might look like "master/username.fruit.ircnow.org" or "master/example.com" if you registered your own domain.

Write the Zone File

Write your DNS zone into the zone that you specified above, /var/nsd/zones/master/example.ircnow.org:

$ORIGIN example.ircnow.org.
example.ircnow.org.     3600   SOA   ns1.example.ircnow.org. admin.example.ircnow.org. (
                            2021020301   ; serial YYYYMMDDnn
                            1800        ; refresh
                            3600         ; retry
                            86400       ; expire
                            3600 )      ; minimum TTL
        3600    IN      MX      10 mail
        3600    IN      A       198.51.100.1
        3600    IN      AAAA    2001:db8::
        3600    IN      NS      ns1
        3600    IN      NS      ns2
ns1     3600    IN      A       198.51.100.1
        3600    IN      AAAA    2001:db8::
ns2     3600    IN      A       198.51.100.1
        3600    IN      AAAA    2001:db8::
www     3600    IN      A       198.51.100.1
        3600    IN      AAAA    2001:db8::
irc     3600    IN      A       198.51.100.1
        3600    IN      AAAA    2001:db8::
imap    3600    IN      A       198.51.100.1
        3600    IN      AAAA    2001:db8::
smtp    3600    IN      A       198.51.100.1
        3600    IN      AAAA    2001:db8::
mail    3600    IN      A       198.51.100.1
        3600    IN      AAAA    2001:db8::

For an explanation of how to interpret this zone file, please see the section on DNS zones.

Start NSD and Test

At this point, we can start nsd:

$ doas rcctl enable nsd
$ doas rcctl start nsd

If all was configured correctly, we should now be able to query our nameserver with ?host or dig:

$ host www.example.ircnow.org example.ircnow.org
Using domain server:
Name: example.ircnow.org
Address: 198.51.100.1#53
Aliases: 
www.example.ircnow.org has address 198.51.100.1
www.example.ircnow.org has IPv6 address 2001:db8::

This will query the name server example.ircnow.org for the resource records in www.example.ircnow.org.

Delegate Zone

Once you've confirmed nsd works, you want to delegate authority for the zone to your nameserver. If you're using an ircnow.org subdomain, you'll need to ask the sysadmin in charge to finish this step. If you registered a domain elsewhere, make sure that the nameserver for the domain points to your nameserver (ns1.example.com and ns2.example.com) and that the glue records are defined.

Troubleshooting

If at any step you are not getting proper results, you should first check the conf and zones using these helpful tools:

$ doas nsd-checkconf /var/nsd/etc/nsd.conf
/var/nsd/etc/nsd.conf:34: at 'name:': error: syntax error
read /var/nsd/etc/nsd.conf failed: 1 errors in configuration file

The error is found on line 34 of /var/nsd/etc/nsd.conf:

#zone:
       name: "example.ircnow.org"
       zonefile: "master/example.ircnow.org"

Here we forgot to uncomment zone:. Once that is done, try again. If there are no errors, nsd-checkconf will not return any output -- no news is good news!

You'll also want to check if the zone is valid:

$ doas nsd-checkzone example.ircnow.org /var/nsd/zones/master/example.ircnow.org
[2021-02-02 03:49:14.921] nsd-checkzone[32265]: error: /var/nsd/zones/master/example.ircnow.org:8: out of zone data: out.of.zone.com. is outside the zone for fqdn example.ircnow.org.

The error is on line 8 of /var/nsd/zones/master/example.ircnow.org:

out.of.zone.example.com.        3600    IN      A       10.0.0.1

Here we specify a ?FQDN out.of.zone.example.com. which is outside of the zone for this file (example.ircnow.org). This is invalid so nsd refuses to look any further and quits. In this case, we need to delete this line (or perhaps move it to the proper zone file). Once that is done, run the test again:

$ doas nsd-checkzone example.ircnow.org /var/nsd/zones/master/example.ircnow.org
zone example.ircnow.org is ok

You can also run nsd in the foreground or view the logs:

$ doas nsd -d -V 3 
/var/nsd/etc/nsd.conf:34: at 'name:': error: syntax error
read /var/nsd/etc/nsd.conf failed: 1 errors in configuration file
[2021-02-02 03:33:50.261] nsd[93210]: error: could not read config: /var/nsd/etc/nsd.conf

This is the same error message as before when we ran nsd-checkconf above.

Suppose we had deleted /var/nsd/zones/master/example.ircnow.org. When we check /var/log/nsd.log, we see:

[2021-02-02 07:31:43.898] nsd[37575]: info: zonefile master/example.ircnow.org does not exist

Tip: Whenever you encounter an error with nsd, always check /var/log/nsd.log.