Example working /etc/named.conf

# Subject: example working /etc/named.conf
# Date: 2024_10_10


//
// named.conf
//
// Provided by Mageia bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//

// #LOCAL local changes (variations from default as-installed version) marked by #LOCAL
// #LOCAL configuration for a  private DNS nameserver running in RFC-1918 private subnet
// #LOCAL serving a local DNS domain ".home" and also cacheing DNS server to Internet systems

// Access lists (ACL's) should be defined here		// #LOCAL
include "/etc/named/bogon_acl.conf";			// #LOCAL
include "/etc/named/named_trusted_networks_acl.conf";	// #LOCAL

// Define logging channels				// #LOCAL
include "/etc/named/logging.conf";			// #LOCAL


options {
// #LOCAL	listen-on port 53 { 127.0.0.1; };
// #LOCAL	listen-on-v6 port 53 { ::1; };
	listen-on port 53 { any; };			// #LOCAL
	listen-on-v6 port 53 { any; };			// #LOCAL
	directory 	"/var/named";
	dump-file 	"/var/named/data/cache_dump.db";
	statistics-file "/var/named/data/named_stats.txt";
	memstatistics-file "/var/named/data/named_mem_stats.txt";
	secroots-file	"/var/named/data/named.secroots";
	recursing-file	"/var/named/data/named.recursing";
// #LOCAL	allow-query     { localhost; };
	allow-query     { trusted_networks; };
	allow-recursion { trusted_networks; };

	/*
	 - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
	 - If you are building a RECURSIVE (caching) DNS server, you need to enable
	   recursion.
	 - If your recursive DNS server has a public IP address, you MUST enable access
	   control to limit queries to your legitimate users. Failing to do so will
	   cause your server to become part of large scale DNS amplification
	   attacks. Implementing BCP38 within your network would greatly
	   reduce such attack surface
	*/
	recursion yes;

	/* Enable serving of DNSSEC related data - enable on both authoritative
 	   and recursive servers DNSSEC aware servers */
// #LOCAL 2023_10_09 - comment out "dnssec-enable yes;" because named fails to start when set to "yes"
//	dnssec-enable yes;
	/* Enable DNSSEC validation on recursive servers */
	dnssec-validation auto;

	managed-keys-directory "/var/named/dynamic";

	pid-file "/run/named/named.pid";
	session-keyfile "/run/named/session.key";

	/* https://fedoraproject.org/wiki/Changes/CryptoPolicy */
	include "/etc/crypto-policies/back-ends/bind.config";
};

// #LOCAL	logging {
// #LOCAL	        channel default_debug {
// #LOCAL	                file "data/named.run";
// #LOCAL	                severity dynamic;
// #LOCAL	        };
// #LOCAL	};

zone "." IN {
	type hint;
	file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named/named.home.zones";			// #LOCAL