How to configure domain blocking in BIND

BIND allows you to define restricted-name lists, preventing specific domains from being registered or resolved locally. This helps block addresses commonly used in attacks, reducing risks such as DNS Hijacking and DNS Spoofing.

How DNS manipulation works#

Attackers abuse DNS manipulation to trick users and redirect traffic. They create fake records for legitimate domains and send victims to fraudulent pages that mimic original websites.

What attackers need#

• A DNS zone for the target domain: to imitate legitimate names.
• An IP address: traffic is redirected to attacker-controlled infrastructure.
• DNS zone creation: manually through .db files or control panel.
• Record tampering: DNS records point to malicious IPs.
• Victim redirection: user lands on fake site thinking it is legitimate.

Practical example#

If a server uses 192.168.0.1 and zone domain.com is tampered with, victims can be redirected to a fake clone site. This can scale to entire networks when modem/Wi-Fi DNS is compromised.

Impact of DNS manipulation#

• Phishing: credential and banking data theft.
• Data collection: cookies, history, and system fingerprinting.
• Malware delivery: malicious payloads served through fake pages.

Protection with BIND block lists#

An effective defense is defining blocked zones in BIND to stop malicious domain use. Attempts to include/query suspicious names can be denied by policy.

Step-by-step configuration#

Go to BIND directory:

cd /etc/bind

Create zones directory:

mkdir zones

Create blockeddomains.db with:

;
; File used to block domains in Bind9
$TTL    3600
@       IN      SOA     ns01.HOSTNAME.local. root.HOSTNAME.local. (
                        2014052101 ; Serial
                        7200       ; Refresh
                        120        ; Retry
                        2419200    ; Expire
                        3600)      ; Default TTL
;
    A       127.0.0.1
*       IN      A       127.0.0.1
mail    IN      A       127.0.0.1
ftp     IN      A       127.0.0.1
webmail IN      A       127.0.0.1
panel   IN      A       127.0.0.1
www     IN      A       127.0.0.1

Replace HOSTNAME with your server hostname (e.g., NS01).

Set permissions:

chmod +x blockeddomains.db
chown root.bind blockeddomains.db

Block file configuration#

In /etc/bind, create blocked_domain_acl.conf:

zone "domain.com.br" { type master; file "/etc/bind/zones/blockeddomains.db"; };

Include in named.conf:

include "/etc/bind/blocked_domain_acl.conf";

Restart BIND:

service bind9 restart

Zone testing#

Test with dig:

dig +short @SERVER_IP domain.com.br

If no answer is returned, blocking is active. For valid domains, BIND should return authorized IP addresses.

See also

Development BIND9 + WHMCS troubleshooting: DNS syntax, high-performance cron, and eNom integration

Email sysadmin chronicles: fixing cascading Dovecot and BIND9 errors

Infrastructure Case Study (RCA): Investigating a Global Email Routing Outage Post-Migration in cPanel

This post is licensed under CC BY-NC.