Docker - DNS Server

net.ipv4.ip_forward = 1
net.ipv4.conf.all.proxy_arp = 1
net.ipv6.conf.all.forwarding=1

// Default contents of /etc/bind/named.conf
// This is the primary configuration file for the BIND DNS server named.
//
// Please read /usr/share/doc/bind9/README.Debian.gz for information on the
// structure of BIND configuration files in Debian, *BEFORE* you customize
// this configuration file.
//
// If you are just adding zones, please do that in /etc/bind/named.conf.local

include "/etc/bind/named.conf.options";
include "/etc/bind/named.conf.local";
include "/etc/bind/named.conf.default-zones";

 acl "trusted" {
  192.168.1/24;
  127.0.0.1;
  localhost;
  localnets;
  ::1;
  fe80::/64;
  2404:e80:943d:178::/64;
  };

tls quad9-tls { remote-hostname "dns.quad9.net"; };
tls cloudflare-tls { remote-hostname "one.one.one.one"; };
tls google-tls { remote-hostname "dns.google"; };

options {

  directory "/var/bind";

  auth-nxdomain no; # conform to RFC1035

  // dnssec-validation auto; //set to auto by default
  //bind now uses dnssec by default

  recursion yes;
  allow-recursion {
    trusted;
    };
    
    /*  forwarders {
    //quad9 with basic malware blocking, no ECS
    9.9.9.9;
    149.112.112.112;
    2620:fe::fe;
    2620:fe::9;
    //Cloudflare basic
    //1.1.1.1;
    //1.0.0.1;
    //Cloudflare with basic malware blocking
    1.1.1.2;
    1.0.0.2;
    2620:4700:4700::1111;
    2620:4700:4700::1001;
    //Opendns basic
    208.67.222.222;
    208.67.220.220;
    2620:0:ccc::2;
    2620:0:ccd::2;
    }; */

forwarders port 853 {
    9.9.9.9 tls quad9-tls;
    149.112.112.112 tls quad9-tls;
    2620:fe::fe tls quad9-tls;
    2620:fe::9 tls quad9-tls;

    1.1.1.1 tls cloudflare-tls;
    1.0.0.1 tls cloudflare-tls;
    2606:4700:4700::1111 tls cloudflare-tls;
    2606:4700:4700::1001 tls cloudflare-tls;

    8.8.8.8 tls google-tls;
    8.8.4.4 tls google-tls;
    2001:4860:4860::8844 tls google-tls;
    2001:4860:4860::8888 tls google-tls;
  };

  allow-query { 
    trusted;
    };

  allow-transfer {
    trusted;
    };
        
  //listen-on { any; };
  //listen-on-v6 { none; };

};

logging {
    channel bind.log {
        file "/var/log/named/bind.log" versions 10 size 20m;
        severity notice;
        print-category yes;
        print-severity yes;
        print-time yes;
    };
  
        category queries { bind.log; };
        category default { bind.log; };
        category config { bind.log; };
};

// key "rndc-key" {
//   algorithm hmac-md5;
//   secret "LBLC2Dg8v6hYNE/ecnd6Ag==";
// };

zone "kptree.net" {
  type master;
  file "/etc/bind/db.kptree.net";
  allow-transfer { trusted; };
  also-notify { 192.168.1.2; };
//  allow-update { key rndc-key; };
};

zone "1.168.192.in-addr.arpa" {
  type master;
  file "/etc/bind/db.1.168.192";
  allow-transfer { trusted; };
  also-notify { 192.168.1.2; };
//  allow-update { key rndc-key; };
};
 

zone "." IN {
        type hint;
        file "named.ca";
};

zone "localhost" IN {
        type master;
        file "pri/localhost.zone";
        allow-update { none; };
        notify no;
};

zone "127.in-addr.arpa" IN {
        type master;
        file "pri/127.zone";
        allow-update { none; };
        notify no;
}; 

// Copy this file to /etc/bind/named.conf if you want to run bind as a
// recursive DNS resolver. If you want to run an authoritative nameserver
// instead, see /etc/bind/named.conf.authoritative.
//
// BIND supports using the same daemon as both authoritative nameserver and
// recursive resolver; it supports this because it is the oldest and original
// nameserver and so was designed before it was realized that combining these
// functions is inadvisable.
//
// In actual fact, combining these functions is a very bad idea. It is thus
// recommended that you run a given instance of BIND as either an authoritative
// nameserver or recursive resolver, not both. The example configuration herein
// provides a starting point for running a recursive resolver.
//
//
// *** IMPORTANT ***
// You should note that running an open DNS resolver (that is, a resolver which
// answers queries from any globally routable IP) makes the resolver vulnerable
// to abuse in the form of reflected DDoS attacks.
//
// These attacks are now widely prevalent on the open internet. Even if
// unadvertised, attackers can and will find your resolver by portscanning the
// global IPv4 address space.
//
// In one case the traffic generated using such an attack reached 300 Gb/s (!).
//
// It is therefore imperative that you take care to configure the resolver to
// only answer queries from IP address space you trust or control. See the
// "allow-recursion" directive below.
//
// Bear in mind that with these attacks, the "source" of a query will actually
// be the intended target of a DDoS attack, so this only protects other networks
// from attack, not your own; ideally therefore you should firewall DNS traffic
// at the borders of your network to eliminate spoofed traffic.
//
// This is a complex issue and some level of understanding of these attacks is
// advisable before you attempt to configure a resolver.

options {
        directory "/var/bind";

        // Specify a list of CIDR masks which should be allowed to issue recursive
        // queries to the DNS server. Do NOT specify 0.0.0.0/0 here; see above.
        allow-recursion {
                127.0.0.1/32;
        };

        // If you want this resolver to itself resolve via means of another recursive
        // resolver, uncomment this block and specify the IP addresses of the desired
        // upstream resolvers.
        //forwarders {
        //      123.123.123.123;
        //      123.123.123.123;
        //};

        // By default the resolver will attempt to perform recursive resolution itself
        // if the forwarders are unavailable. If you want this resolver to fail outright
        // if the upstream resolvers are unavailable, uncomment this directive.
        //forward only;
        
        // Configure the IPs to listen on here.
        listen-on { 127.0.0.1; };
        listen-on-v6 { none; };

        // If you have problems and are behind a firewall:
        //query-source address * port 53;

        pid-file "/var/run/named/named.pid";

        // Removing this block will cause BIND to revert to its default behaviour
        // of allowing zone transfers to any host (!). There is no need to allow zone
        // transfers when operating as a recursive resolver.
        allow-transfer { none; };
};

// Briefly, a zone which has been declared delegation-only will be effectively
// limited to containing NS RRs for subdomains, but no actual data beyond its
// own apex (for example, its SOA RR and apex NS RRset). This can be used to
// filter out "wildcard" or "synthesized" data from NAT boxes or from
// authoritative name servers whose undelegated (in-zone) data is of no
// interest.
// See http://www.isc.org/products/BIND/delegation-only.html for more info

//zone "COM" { type delegation-only; };
//zone "NET" { type delegation-only; };

zone "." IN {
        type hint;
        file "named.ca";
};

zone "localhost" IN {
        type master;
        file "pri/localhost.zone";
        allow-update { none; };
        notify no;
};

zone "127.in-addr.arpa" IN {
        type master;
        file "pri/127.zone";
        allow-update { none; };
        notify no;
};
 

FROM alpine:latest

ARG S6_OVERLAY_VERSION=3.1.6.2

ADD https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-noarch.tar.xz /tmp
RUN tar -C / -Jxpf /tmp/s6-overlay-noarch.tar.xz
ADD https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-x86_64.tar.xz /tmp
RUN tar -C / -Jxpf /tmp/s6-overlay-x86_64.tar.xz

#ENV S6_KEEP_ENV=1 
#this keeps the environment variables

ENTRYPOINT ["/init"]

#add UID & GID
RUN \
addgroup -g 99 named && \
adduser -G named -u 99  -G named -D -S -h /dev/null named

RUN apk update && \
apk --no-cache add \
bind \
bind-dnssec-tools \
&& \
apk upgrade
#util-linux \
#vim \
#less \

COPY user/* /etc/s6-overlay/s6-rc.d/user/contents.d/

COPY s6-rc.d /etc/s6-overlay/s6-rc.d/

EXPOSE 53/tcp
EXPOSE 53/udp
EXPOSE 953/tcp

---
services:
  bind:
    build: ./
    image: bind:latest
    tty: true
    stdin_open: true
    container_name: kptr-dns-1
    restart: 'always' # always | unless-stopped | no | on-failure [:max-retries]
    volumes:
      - '/mnt/docker_store/bind9/.config:/app/'
      - '/mnt/docker_store/bind9/.config/etc/bind:/etc/bind/'
      - '/mnt/docker_store/bind9/.config/var/bind:/var/bind/'
      - '/mnt/docker_store/bind9/.config/var/log:/var/log/'
    network_mode: host

    command: /bin/sh

• DNSSEC with BIND 9 A Beginner's Guide to DNSSEC with BIND 9
• APNIC How to: Deploying DNSSEC with BIND and Ubuntu Server

tls cloudflare-tls { remote-hostname "one.one.one.one"; };
tls quad9-tls { remote-hostname "dns.quad9.net"; };
tls google-tls { remote-hostname "dns.google"; };
options {
    ...
    forwarders port 853 {
        1.1.1.1 tls cloudflare-tls;
        1.0.0.1 tls cloudflare-tls;
        2606:4700:4700::1111 tls cloudflare-tls;
        2606:4700:4700::1001 tls cloudflare-tls;

        9.9.9.9 tls quad9-tls;
        149.112.112.112 tls quad9-tls;
        2620:fe::fe tls quad9-tls;
        2620:fe::9 tls quad9-tls;

        8.8.8.8 tls google-tls;
        8.8.4.4 tls google-tls;
        2001:4860:4860::8844 tls google-tls;
        2001:4860:4860::8888 tls google-tls;
    };
};