BIND 9 (ISC BIND) 9.20 on Ubuntu 24.04 LTS by cloudimg

## BIND 9 (ISC BIND) 9.20 on Ubuntu 24.04 LTS by cloudimg

BIND 9 is the internet's most widely deployed DNS software, developed by Internet Systems Consortium. This cloudimg image runs the current stable ESV branch, BIND 9.20, from the official ISC packages on Ubuntu 24.04 LTS, as a full authoritative DNS server with DNSSEC, zone management, and the rndc control channel. named runs under systemd as the unprivileged bind user, and unattended security upgrades keep the 9.20 branch patched. Backed by 24/7 expert support.

A Non Open Resolver

An open recursive resolver is a well known DNS amplification and reflection DDoS vector. This image ships as a pure authoritative server with recursion switched off, so no client, local or remote, can use it to recursively resolve arbitrary external names. A recursive query for an external name is answered with REFUSED. The BIND version is not leaked, zone transfers are disabled by default, and response rate limiting is enabled. You can scope recursion to your own trusted networks when you need it.

A Per Instance Control Key

The rndc control key is the equivalent of a remote control password for the DNS server, so this image never ships a fixed control key. On the first boot of every VM a fresh per instance rndc key is generated and the control channel is bound to 127.0.0.1 port 953 only. The key details are written to a root only file.

Resolves Out Of The Box

The image ships one example authoritative zone so a dig query resolves immediately, plus a documented template for adding your own zones. Zone files, DNSSEC keys, and journals live on a dedicated 20 GiB Azure data disk mounted at /var/lib/bind, independently resizable and separate from the OS disk.

What is Included

* BIND 9.20 current stable ESV from the official ISC packages, run under systemd as the bind user

* Responsible non open resolver defaults: recursion off, version none, no zone transfers, response rate limiting

* One example authoritative zone that resolves out of the box, plus a template for your own zones

* A per instance rndc control key generated on first boot, control channel bound to loopback only

* Zone files and DNSSEC keys on a dedicated Azure data disk at /var/lib/bind

* A tiny nginx health endpoint on port 80 for Azure Load Balancer probes

Use Cases

Authoritative DNS for your own domains, an internal split horizon DNS server, a hidden primary feeding your secondaries, and a fully controlled alternative to hosted DNS services.

BIND 9 is licensed under the Mozilla Public License 2.0. cloudimg is not affiliated with or endorsed by Internet Systems Consortium (ISC). All product and company names are trademarks or registered trademarks of their respective holders and are used only to identify the software.