I wonder how the ratio between "thanks" vs "your software sucks" commentary on the BIND family has been, through the years.
I think they fixed those issues after a major rewrite. But at least from the security point of view it was considered really bad. Functionally it did the job, but considering that DNS servers are frequently used on the open web, they're still major attack vectors.
I know coming up the recommendation was always "use something else if you can, use BIND if you have to". It's nice to hear they've improved things to the point that using it doesn't mean tons of extra labor for the security department! On the other hand, that reputation has allowed a lot of other good "supports 75% of everything and 100% of anything you're likely to need" implementations to flourish, which is also good.
Also, dealing with zone files just gets annoying, especially compared to DNS servers that support database backends.
personally I have been very happy with powerdns for a very long time. BIND works, but IMO is more of a legacy application compared to modern alternatives.
https://cr.yp.to/djbdns/blurb/unbind.html
[EDIT]: https://www.google.com/search?channel=fs&client=ubuntu&q=bin...
Current is 9.17:
https://downloads.isc.org/isc/bind9/cur/
Full history is here:
https://gitlab.isc.org/isc-projects/bind9/-/blob/main/HISTOR...
Anyone familiar with the interim changes, care to synopsize?
===
nsupdate -k your.keyfile
server ns.your.zone
update add foo.your.zone. 3600 IN A 1.2.3.4
send
===
You can script it too if you want
https://github.com/imoverclocked/xmdns
Basically, you:
1) setup a list of views (named.views) and edit the acls to match views based on how your dns servers will see your clients (named.acls) 2) setup a list of ip networks that you are going to resolve (res/db/net_list.xml) 3) modify you hosts with potentially single or multiple networks as necessary (res/db/host_list.xml)
There are some helper scripts in the root of the repo that bring you through the workflow of updating host_list.xml and generating your views.
Some nice things about this: you can set a per-network preference for what networks you try to connect to a host first if the host is multi-homed. This is useful for hopping over local links first and then traversing external hops if necessary.
When I ran it (7 years ago), the model was starting to slow down with several thousand nodes and ~30 networks because I just use xsltproc (command line tool) instead of writing something a little more streamlined.
https://github.com/StackExchange/dnscontrol/releases/tag/v3....
(and if I do say-so myself... the way we implemented it is pretty darn elegant)
For those who might be interested in learning more about using BIND and DNS administration, the ISC are currently running a series of monthly webinars on various aspects of BIND: https://www.isc.org/blogs/bind-management-webinar-series-202...
