7.6. Common Mistakes to Avoid

It is very common for beginners to make mistakes when editing BIND configuration files. Be sure to avoid the following issues:

Take care to increment the serial number when editing a zone file.
If the serial number is not incremented, the master nameserver has the correct, new information, but the slave nameservers are never notified of the change and do not attempt to refresh their data of that zone.
Be careful to use ellipses and semi-colons correctly in the /etc/named.conf file.
An omitted semi-colon or unclosed ellipse section can cause named to refuse to start.
Remember to place periods (.) in zone files after all FQDNs and omit them on hostnames.
A period at the end of a domain name denotes a fully qualified domain name. If the period is omitted, then named appends the name of the zone or the $ORIGIN value to complete it.
If a firewall is blocking connections from the named daemon to other nameservers, the recommended best practice is to change the firewall settings whenever possible.
Warning: Avoid Using Fixed UDP Source Ports
Recent research in DNS security has shown that using a fixed UDP source port for DNS queries is a potential security vulnerability that could allow an attacker to more easily conduct cache-poisoning attacks. Due to this security threat, Red Hat issued a security update^[3] for all versions of Red Hat Enterprise Linux which updated the default sample caching-nameserver configuration files so that they do not specify a fixed query-source port, thus causing the BIND nameserver to use a new, randomly-selected source port for each DNS query by default. This method had previously only been used during named service startup.
DNS resolving is at risk whenever named is configured to use a static UDP source port. To avoid this risk, we recommend configuring your firewall to allow queries from a random UDP source port.
BIND administrators with existing configurations who wish to take advantage of randomized UDP source ports should check their configuration files to ensure that they have not specified fixed query-source ports.

^[3] The security update was RHSA-2008:0533.

7.6. Common Mistakes to Avoid

Warning: Avoid Using Fixed UDP Source Ports