centos 7, named service, how to setting up primary + secondary named service .

AI Mode reply for go on, show cache-only role, how to config it

A Cache-Only DNS server does not host any authoritative zone files (master or slave) and has no records of its own.

Its sole purpose is to receive recursive queries from your clients, look up the answers from the global internet (or upstream forwarders), and store the results in its local memory (cache). When a second client requests the same website, the server answers instantly from its memory without using any internet bandwidth.

Here is how to configure a clean, standalone Cache-Only server.

Step 1: Install BIND

Run this on your dedicated cache server:

bash

yum install bind bind-utils -y

Use code with caution.

Step 2: Configure /etc/named.conf

Replace the contents of your /etc/named.conf with this optimized layout. Notice that all local master/slave zones are deleted, leaving only the global root hints zone (.).

named

// 1. Define who is allowed to use this cache server
acl "trusted_lan" {
    localhost;
    192.168.1.0/24;       # Your internal client subnet
};

options {
    # Listen on localhost and this server's specific IP (e.g., 192.168.1.30)
    listen-on port 53 { 127.0.0.1; 192.168.1.30; };
    directory       "/var/named";
    dump-file       "/var/named/data/cache_dump.db";
    statistics-file "/var/named/data/named_stats.txt";
    memstatistics-file "/var/named/data/named_mem_stats.txt";
    
    # --- Cache Security Settings ---
    allow-query       { "trusted_lan"; };  # Only trusted clients can query this server
    allow-recursion   { "trusted_lan"; };  # Only trusted clients can trigger recursion
    allow-query-cache { "trusted_lan"; };  # Only trusted clients can read the cache
    
    # Disable zone transfers entirely since this server holds no zones
    allow-transfer    { none; };

    # --- Upstream Forwarders ---
    # Speeds up resolution by leveraging fast public caches
    forwarders {
        1.1.1.1;   # Cloudflare
        8.8.8.8;   # Google
    };
    forward first; # Try forwarders first; fall back to root servers if they fail

    dnssec-validation yes;
};

logging {
    channel default_debug {
        file "data/named.run";
        severity dynamic;
    };
};

# The global root hints file required for recursion fallback
zone "." IN {
    type hint;
    file "named.ca";
};

Use code with caution.

Step 3: Start and Secure the Service

1. Open Firewall ports

bash

firewall-cmd --permanent --add-service=dns
firewall-cmd --reload

Use code with caution.

2. Validate configuration syntax

bash

named-checkconf /etc/named.conf

Use code with caution.

(If it returns no output, your syntax is flawless).

3. Enable and start BIND

bash

systemctl enable named
systemctl start named

Use code with caution.

Step 4: Verification

To see the cache mechanism actively working, run a lookup twice on an internal client machine:

bash

# First lookup (Fetches from the internet/upstream)
dig @192.168.1.30 wikipedia.org | grep "Query time"

# Second lookup (Fetches immediately from this server's RAM cache)
dig @192.168.1.30 wikipedia.org | grep "Query time"

Use code with caution.

Result: The first query might take 30 msec to 100 msec. The second identical query should drop to 0 msec or 1 msec, proving that the Cache-Only role is operating correctly.