BIND 9

Cover multiple DNS roles and DNSSEC operations

named can act as an authoritative server, recursive resolver, DNS forwarder, or combine those roles. It also provides views for split-horizon DNS, automatic DNSSEC zone signing and key management, and catalog zones for provisioning zone data across a server fleet.

Sources: [1]

Use bundled tools for inspection, updates, and administration

The distribution includes dig and delv for DNS lookups, nsupdate for dynamic updates, and rndc for remote administration. Response policy zones, response-rate limiting, and recursive-query limits provide controls for malicious data and denial-of-service pressure.

Sources: [1]

Fits teams that need direct control over DNS infrastructure

BIND 9 fits organizations operating authoritative or caching DNS and environments that require detailed policy through DNSSEC, split-horizon DNS, or catalog zones. It is also useful when diagnostic, update, and administration tools should come from the same project.

Plan role separation, build dependencies, and the contribution path

Building from source requires a C11 compiler, Meson 1.3.0 or newer, Ninja or Samurai, OpenSSL, libuv, Userspace RCU, and other dependencies. DoH, LMDB, GeoIP2, and DNSTAP add optional library requirements depending on the selected features.

The GitHub repository has archived=false, but its description identifies it as a mirror of ISC GitLab. Issues and merge requests should go to GitLab. Production DNS deployments also need an explicit design for separating authoritative and recursive roles, access control, and security updates.

Sources: [1][2]