{"slug": "bind", "name": "BIND", "category": "networking", "category_name": "Networking and VPN", "description": "Open-source DNS server from ISC for authoritative and recursive name service.", "recommenders": 5, "commenters": 9, "warners": 1, "score": 4.18, "rising": -1.64, "first": "2025-11-20", "latest": "2026-08-10", "why": "HN commenters like BIND for its long, reliable track record, trouble-free DNSSEC and split internal/external views.", "why_is_quote": false, "has_verdict": true, "sentiment": {"recommend": 5, "neutral": 2, "compare": 1, "warn": 1}, "spark": [1, 0, 0, 0, 3, 1, 0, 0, 0, 0, 0, 0], "listed": true, "loved": ["Proven reliability", "Familiar standard"], "caveat": "Security history", "short_quote": "BIND has been really good to me and I love their `view \"external\"` and `view \"internal\"` scopes", "icon": true, "domain": null, "github_repo": null, "official_url": "https://www.isc.org/bind/", "pricing": "open source", "aliases": ["BIND", "BIND 9"], "verdict": [{"text": "HN commenters like BIND for its long, reliable track record", "cites": [{"id": 760304624, "item_id": 47519039, "url": "https://news.ycombinator.com/item?id=47519039", "by": "Adachi91", "date": "2026-03-25", "stance": "recommend", "quote": "BIND has been really good to me and I love their `view \"external\"` and `view \"internal\"` scopes", "excerpt": "I've been running BIND for quite a long time now, and I've been very happy with it, very few issues other than my own folly, since I'm not on a static IP in the past 15 years my IP has changed 4 times (1 time due to a router change, 3 times due to Comcast outages), I didn't catch the last IP swap for over a month. Which brings me to a rather big gripe about other resolvers not respecting TTL, 70% of https://www.whats", "context": "runs own DNS", "use_case": "self-hosted authoritative DNS", "switched_from": "", "story": "You Can Run a DNS Server"}, {"id": 760272544, "item_id": 47517034, "url": "https://news.ycombinator.com/item?id=47517034", "by": "icedchai", "date": "2026-03-25", "stance": "recommend", "quote": "BIND is still my go-to because I am familiar with it.", "excerpt": "I've been running authoritative and caching DNS servers since the 90's. BIND is still my go-to because I am familiar with it.", "context": "running DNS servers since the 90's", "use_case": "authoritative and caching DNS", "switched_from": "", "story": "You Can Run a DNS Server"}, {"id": 735862576, "item_id": 45991411, "url": "https://news.ycombinator.com/item?id=45991411", "by": "ralferoo", "date": "2025-11-20", "stance": "compare", "quote": "just by virtue that the majority of the internet's DNS is running on BIND that it's also the most battle tested of them all.", "excerpt": "Haven't all these issues been related to use as a resolver rather than running as an authoritative server? Personally, I'd also expect that just by virtue that the majority of the internet's DNS is running on BIND that it's also the most battle tested of them all. But sure, point taken - I hadn't really considered from a security issue perspective. It just seemed odd to me that someone seemingly dabbling in running D", "context": "", "use_case": "DNS server", "switched_from": "", "story": "Self-hosting DNS for no fun, but a little profit"}]}, {"text": ", trouble-free DNSSEC and split internal/external views.", "cites": [{"id": 766710624, "item_id": 47919414, "url": "https://news.ycombinator.com/item?id=47919414", "by": "aragilar", "date": "2026-04-27", "stance": "recommend", "quote": "modern bind9 seems to just handle DNSSEC with no issues when I've used it", "excerpt": "In addition to what other commenters have said, it's a copy of a post on their personal blog: https://www.potaroo.net/ispcol/2026-04/revocation.html On revocation, check out https://bugzilla.mozilla.org/buglist.cgi?product=CA%20Program&component=CA%20Certificate%20Compliance I don't think any CA hasn't had an issue with revocation at some point (e.g. Let's Encrypt had a major one in 2021, and refused to revoke), whic", "context": "", "use_case": "DNSSEC", "switched_from": "", "story": "Revocation of X.509 Certificates"}, {"id": 760304624, "item_id": 47519039, "url": "https://news.ycombinator.com/item?id=47519039", "by": "Adachi91", "date": "2026-03-25", "stance": "recommend", "quote": "BIND has been really good to me and I love their `view \"external\"` and `view \"internal\"` scopes", "excerpt": "I've been running BIND for quite a long time now, and I've been very happy with it, very few issues other than my own folly, since I'm not on a static IP in the past 15 years my IP has changed 4 times (1 time due to a router change, 3 times due to Comcast outages), I didn't catch the last IP swap for over a month. Which brings me to a rather big gripe about other resolvers not respecting TTL, 70% of https://www.whats", "context": "runs own DNS", "use_case": "self-hosted authoritative DNS", "switched_from": "", "story": "You Can Run a DNS Server"}]}, {"text": " The main complaint is a long history of security vulnerabilities.", "cites": [{"id": 737826512, "item_id": 46114157, "url": "https://news.ycombinator.com/item?id=46114157", "by": "Milpotel", "date": "2025-12-01", "stance": "warn", "quote": "it's just a badly engineered piece of software and had braindead vulnerabilities for decades", "excerpt": "> I guess wikipedia doesn't agree with you: Are you kidding? Bind has been the de facto standard for DNS servers for ages but it's just a badly engineered piece of software and had braindead vulnerabilities for decades: https://www.cvedetails.com/vulnerability-list/vendor_id-64/product_id-144/ISC-Bind.html Already 20 years ago it was common knowledge to never use software that Paul Vixie had touched (bind, vixie-cron", "context": "", "use_case": "DNS server", "switched_from": "", "story": "DNS Firewalling with MISP and Technitium DNS Server"}, {"id": 735862576, "item_id": 45991411, "url": "https://news.ycombinator.com/item?id=45991411", "by": "ralferoo", "date": "2025-11-20", "stance": "compare", "quote": "just by virtue that the majority of the internet's DNS is running on BIND that it's also the most battle tested of them all.", "excerpt": "Haven't all these issues been related to use as a resolver rather than running as an authoritative server? Personally, I'd also expect that just by virtue that the majority of the internet's DNS is running on BIND that it's also the most battle tested of them all. But sure, point taken - I hadn't really considered from a security issue perspective. It just seemed odd to me that someone seemingly dabbling in running D", "context": "", "use_case": "DNS server", "switched_from": "", "story": "Self-hosting DNS for no fun, but a little profit"}]}], "praise": [{"label": "Proven reliability", "summary": "Long-time users report few issues, and one commenter calls it the most battle-tested DNS server.", "quotes": [{"id": 760304624, "item_id": 47519039, "url": "https://news.ycombinator.com/item?id=47519039", "by": "Adachi91", "date": "2026-03-25", "stance": "recommend", "quote": "BIND has been really good to me and I love their `view \"external\"` and `view \"internal\"` scopes", "excerpt": "I've been running BIND for quite a long time now, and I've been very happy with it, very few issues other than my own folly, since I'm not on a static IP in the past 15 years my IP has changed 4 times (1 time due to a router change, 3 times due to Comcast outages), I didn't catch the last IP swap for over a month. Which brings me to a rather big gripe about other resolvers not respecting TTL, 70% of https://www.whats", "context": "runs own DNS", "use_case": "self-hosted authoritative DNS", "switched_from": "", "story": "You Can Run a DNS Server"}, {"id": 760272544, "item_id": 47517034, "url": "https://news.ycombinator.com/item?id=47517034", "by": "icedchai", "date": "2026-03-25", "stance": "recommend", "quote": "BIND is still my go-to because I am familiar with it.", "excerpt": "I've been running authoritative and caching DNS servers since the 90's. BIND is still my go-to because I am familiar with it.", "context": "running DNS servers since the 90's", "use_case": "authoritative and caching DNS", "switched_from": "", "story": "You Can Run a DNS Server"}, {"id": 735862576, "item_id": 45991411, "url": "https://news.ycombinator.com/item?id=45991411", "by": "ralferoo", "date": "2025-11-20", "stance": "compare", "quote": "just by virtue that the majority of the internet's DNS is running on BIND that it's also the most battle tested of them all.", "excerpt": "Haven't all these issues been related to use as a resolver rather than running as an authoritative server? Personally, I'd also expect that just by virtue that the majority of the internet's DNS is running on BIND that it's also the most battle tested of them all. But sure, point taken - I hadn't really considered from a security issue perspective. It just seemed odd to me that someone seemingly dabbling in running D", "context": "", "use_case": "DNS server", "switched_from": "", "story": "Self-hosting DNS for no fun, but a little profit"}]}, {"label": "Familiar standard", "summary": "Commenters value familiarity with it and note that most DNS tutorials target BIND.", "quotes": [{"id": 760272544, "item_id": 47517034, "url": "https://news.ycombinator.com/item?id=47517034", "by": "icedchai", "date": "2026-03-25", "stance": "recommend", "quote": "BIND is still my go-to because I am familiar with it.", "excerpt": "I've been running authoritative and caching DNS servers since the 90's. BIND is still my go-to because I am familiar with it.", "context": "running DNS servers since the 90's", "use_case": "authoritative and caching DNS", "switched_from": "", "story": "You Can Run a DNS Server"}, {"id": 735862576, "item_id": 45991411, "url": "https://news.ycombinator.com/item?id=45991411", "by": "ralferoo", "date": "2025-11-20", "stance": "compare", "quote": "just by virtue that the majority of the internet's DNS is running on BIND that it's also the most battle tested of them all.", "excerpt": "Haven't all these issues been related to use as a resolver rather than running as an authoritative server? Personally, I'd also expect that just by virtue that the majority of the internet's DNS is running on BIND that it's also the most battle tested of them all. But sure, point taken - I hadn't really considered from a security issue perspective. It just seemed odd to me that someone seemingly dabbling in running D", "context": "", "use_case": "DNS server", "switched_from": "", "story": "Self-hosting DNS for no fun, but a little profit"}]}, {"label": "Flexible deployment", "summary": "Commenters run it for local homelab DNS, resolving servers and master servers.", "quotes": [{"id": 756930514, "item_id": 47308157, "url": "https://news.ycombinator.com/item?id=47308157", "by": "ErneX", "date": "2026-03-09", "stance": "recommend", "quote": "I use bind 9 and nginx for that.", "excerpt": "I run (among many other VMs) TrueNAS on a VM of an xcp-ng host (Supermicro board with a Xeon and ECC ram). Passing a dedicated SAS controller to it. Before that I was using esxi but migrated all my VMs and hosts to xcp-ng. TrueNAS has been pretty good so far, been running this for many years already. I also have another xcp-ng host for other VMs running on a Dell OptiPlex Micro. OP should configure DNS locally and re", "context": "homelab user", "use_case": "local DNS", "switched_from": "", "story": "My Homelab Setup"}, {"id": 736628320, "item_id": 46039270, "url": "https://news.ycombinator.com/item?id=46039270", "by": "thatcks", "date": "2025-11-24", "stance": "recommend", "quote": "we also wanted to switch from our previous OpenBSD setup to Bind, where we were already running Bind on Ubuntu", "excerpt": "The computers that moved from OpenBSD to Ubuntu were our local resolving DNS servers. These don't use PF and we also wanted to switch from our previous OpenBSD setup to Bind, where we were already running Bind on Ubuntu for our DNS master servers. The gory details were written up here: https://utcc.utoronto.ca/~cks/space/blog/sysadmin/UsingBindNowForResolvers We may at some point switch our remaining OpenBSD DHCP ser", "context": "sysadmin, author of the article", "use_case": "DNS resolvers", "switched_from": "", "story": "Moving from OpenBSD to FreeBSD for firewalls"}]}, {"label": "Split views", "summary": "A long-time user praises its internal and external view scopes.", "quotes": [{"id": 760304624, "item_id": 47519039, "url": "https://news.ycombinator.com/item?id=47519039", "by": "Adachi91", "date": "2026-03-25", "stance": "recommend", "quote": "BIND has been really good to me and I love their `view \"external\"` and `view \"internal\"` scopes", "excerpt": "I've been running BIND for quite a long time now, and I've been very happy with it, very few issues other than my own folly, since I'm not on a static IP in the past 15 years my IP has changed 4 times (1 time due to a router change, 3 times due to Comcast outages), I didn't catch the last IP swap for over a month. Which brings me to a rather big gripe about other resolvers not respecting TTL, 70% of https://www.whats", "context": "runs own DNS", "use_case": "self-hosted authoritative DNS", "switched_from": "", "story": "You Can Run a DNS Server"}]}, {"label": "DNSSEC support", "summary": "One commenter says modern bind9 handles DNSSEC with no issues.", "quotes": [{"id": 766710624, "item_id": 47919414, "url": "https://news.ycombinator.com/item?id=47919414", "by": "aragilar", "date": "2026-04-27", "stance": "recommend", "quote": "modern bind9 seems to just handle DNSSEC with no issues when I've used it", "excerpt": "In addition to what other commenters have said, it's a copy of a post on their personal blog: https://www.potaroo.net/ispcol/2026-04/revocation.html On revocation, check out https://bugzilla.mozilla.org/buglist.cgi?product=CA%20Program&component=CA%20Certificate%20Compliance I don't think any CA hasn't had an issue with revocation at some point (e.g. Let's Encrypt had a major one in 2021, and refused to revoke), whic", "context": "", "use_case": "DNSSEC", "switched_from": "", "story": "Revocation of X.509 Certificates"}]}], "caveats": [{"label": "Security history", "summary": "One critic calls it badly engineered with decades of serious vulnerabilities; another acknowledges the security issues, though suggests they mostly affect resolver use.", "quotes": [{"id": 737826512, "item_id": 46114157, "url": "https://news.ycombinator.com/item?id=46114157", "by": "Milpotel", "date": "2025-12-01", "stance": "warn", "quote": "it's just a badly engineered piece of software and had braindead vulnerabilities for decades", "excerpt": "> I guess wikipedia doesn't agree with you: Are you kidding? Bind has been the de facto standard for DNS servers for ages but it's just a badly engineered piece of software and had braindead vulnerabilities for decades: https://www.cvedetails.com/vulnerability-list/vendor_id-64/product_id-144/ISC-Bind.html Already 20 years ago it was common knowledge to never use software that Paul Vixie had touched (bind, vixie-cron", "context": "", "use_case": "DNS server", "switched_from": "", "story": "DNS Firewalling with MISP and Technitium DNS Server"}, {"id": 735862576, "item_id": 45991411, "url": "https://news.ycombinator.com/item?id=45991411", "by": "ralferoo", "date": "2025-11-20", "stance": "compare", "quote": "just by virtue that the majority of the internet's DNS is running on BIND that it's also the most battle tested of them all.", "excerpt": "Haven't all these issues been related to use as a resolver rather than running as an authoritative server? Personally, I'd also expect that just by virtue that the majority of the internet's DNS is running on BIND that it's also the most battle tested of them all. But sure, point taken - I hadn't really considered from a security issue perspective. It just seemed odd to me that someone seemingly dabbling in running D", "context": "", "use_case": "DNS server", "switched_from": "", "story": "Self-hosting DNS for no fun, but a little profit"}]}], "who": [{"by": "Adachi91", "context": "runs own DNS", "url": "https://news.ycombinator.com/item?id=47519039", "date": "2026-03-25"}, {"by": "icedchai", "context": "running DNS servers since the 90's", "url": "https://news.ycombinator.com/item?id=47517034", "date": "2026-03-25"}, {"by": "ErneX", "context": "homelab user", "url": "https://news.ycombinator.com/item?id=47308157", "date": "2026-03-09"}, {"by": "simoncion", "context": "runs a home-built router", "url": "https://news.ycombinator.com/item?id=46469748", "date": "2026-01-02"}, {"by": "thatcks", "context": "sysadmin, author of the article", "url": "https://news.ycombinator.com/item?id=46039270", "date": "2025-11-24"}], "tags": ["for authoritative DNS", "for caching resolvers", "for homelabs", "for Linux servers"], "use_cases": ["dns server", "dnssec", "self-hosted authoritative dns", "authoritative and caching dns", "local dns", "home dns resolver"], "compared": [{"slug": "powerdns", "name": "PowerDNS", "co": 2, "switched_from": 0, "switched_to": 1}, {"slug": "djbdns", "name": "djbdns", "co": 1, "switched_from": 0, "switched_to": 1}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=47453738", "title": "You Can Run a DNS Server", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=49249150", "title": "Illinois Just Passed a Law That Puts Linux on the Hook for Age Verification", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47903959", "title": "Revocation of X.509 Certificates", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47298743", "title": "My Homelab Setup", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46465327", "title": "IPv6 just turned 30 and still hasn't taken over the world", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46066736", "title": "DNS Firewalling with MISP and Technitium DNS Server", "mentions": 1}], "sentiment_by_month": {"2025-11": {"compare": 1, "recommend": 1}, "2025-12": {"warn": 1}, "2026-01": {"neutral": 1}, "2026-02": {}, "2026-03": {"recommend": 3}, "2026-04": {"recommend": 1}, "2026-05": {}, "2026-06": {}, "2026-07": {}, "2026-08": {"neutral": 1}, "2026-09": {}, "2026-10": {}}, "quotes": [{"id": 788025905, "item_id": 49251619, "url": "https://news.ycombinator.com/item?id=49251619", "by": "Melonai", "date": "2026-08-10", "stance": "neutral", "quote": "systemd will gladly run your BIND, ISC DHCP and NetworkManager for you if you tell it to, no? In fact we do so at my place of work.", "excerpt": "Maybe I'm about to be too pedantic, but I never quite got the argument of systemd being massively bloated based on examples of it including DNS and DHCP. Sure it's a mono-repository that includes all these services, but in the end you do run them separately? The actual \"systemd, the init system\" doesn't have DNS, DHCP or a user birthday database built-in, those are contained in their own services, namely systemd-reso", "context": "", "use_case": "DNS server", "switched_from": "", "story": "Illinois Just Passed a Law That Puts Linux on the Hook for Age Verification"}, {"id": 766710624, "item_id": 47919414, "url": "https://news.ycombinator.com/item?id=47919414", "by": "aragilar", "date": "2026-04-27", "stance": "recommend", "quote": "modern bind9 seems to just handle DNSSEC with no issues when I've used it", "excerpt": "In addition to what other commenters have said, it's a copy of a post on their personal blog: https://www.potaroo.net/ispcol/2026-04/revocation.html On revocation, check out https://bugzilla.mozilla.org/buglist.cgi?product=CA%20Program&component=CA%20Certificate%20Compliance I don't think any CA hasn't had an issue with revocation at some point (e.g. Let's Encrypt had a major one in 2021, and refused to revoke), whic", "context": "", "use_case": "DNSSEC", "switched_from": "", "story": "Revocation of X.509 Certificates"}, {"id": 760304624, "item_id": 47519039, "url": "https://news.ycombinator.com/item?id=47519039", "by": "Adachi91", "date": "2026-03-25", "stance": "recommend", "quote": "BIND has been really good to me and I love their `view \"external\"` and `view \"internal\"` scopes", "excerpt": "I've been running BIND for quite a long time now, and I've been very happy with it, very few issues other than my own folly, since I'm not on a static IP in the past 15 years my IP has changed 4 times (1 time due to a router change, 3 times due to Comcast outages), I didn't catch the last IP swap for over a month. Which brings me to a rather big gripe about other resolvers not respecting TTL, 70% of https://www.whats", "context": "runs own DNS", "use_case": "self-hosted authoritative DNS", "switched_from": "", "story": "You Can Run a DNS Server"}, {"id": 760272544, "item_id": 47517034, "url": "https://news.ycombinator.com/item?id=47517034", "by": "icedchai", "date": "2026-03-25", "stance": "recommend", "quote": "BIND is still my go-to because I am familiar with it.", "excerpt": "I've been running authoritative and caching DNS servers since the 90's. BIND is still my go-to because I am familiar with it.", "context": "running DNS servers since the 90's", "use_case": "authoritative and caching DNS", "switched_from": "", "story": "You Can Run a DNS Server"}, {"id": 756930514, "item_id": 47308157, "url": "https://news.ycombinator.com/item?id=47308157", "by": "ErneX", "date": "2026-03-09", "stance": "recommend", "quote": "I use bind 9 and nginx for that.", "excerpt": "I run (among many other VMs) TrueNAS on a VM of an xcp-ng host (Supermicro board with a Xeon and ECC ram). Passing a dedicated SAS controller to it. Before that I was using esxi but migrated all my VMs and hosts to xcp-ng. TrueNAS has been pretty good so far, been running this for many years already. I also have another xcp-ng host for other VMs running on a Dell OptiPlex Micro. OP should configure DNS locally and re", "context": "homelab user", "use_case": "local DNS", "switched_from": "", "story": "My Homelab Setup"}, {"id": 743515969, "item_id": 46469748, "url": "https://news.ycombinator.com/item?id=46469748", "by": "simoncion", "date": "2026-01-02", "stance": "neutral", "quote": "I know for a fact that BIND 9 prefers non-link-local IPv6 source addresses over IPv4 addresses", "excerpt": "> Problem with ULA is that it's functionally useless on a dual-stack network. Nope, it works just fine. I use it for stable local addressing and LAN host AAAA records and let my ISP-delegated global prefix drift as my ISP wishes it to. And -as it happens- the prose in that article about source address selection is incorrect. On Linux, source address preference appears to be application-specific. For example, curl pre", "context": "runs a home-built router", "use_case": "home DNS resolver", "switched_from": "", "story": "IPv6 just turned 30 and still hasn't taken over the world"}, {"id": 737826512, "item_id": 46114157, "url": "https://news.ycombinator.com/item?id=46114157", "by": "Milpotel", "date": "2025-12-01", "stance": "warn", "quote": "it's just a badly engineered piece of software and had braindead vulnerabilities for decades", "excerpt": "> I guess wikipedia doesn't agree with you: Are you kidding? Bind has been the de facto standard for DNS servers for ages but it's just a badly engineered piece of software and had braindead vulnerabilities for decades: https://www.cvedetails.com/vulnerability-list/vendor_id-64/product_id-144/ISC-Bind.html Already 20 years ago it was common knowledge to never use software that Paul Vixie had touched (bind, vixie-cron", "context": "", "use_case": "DNS server", "switched_from": "", "story": "DNS Firewalling with MISP and Technitium DNS Server"}, {"id": 736628320, "item_id": 46039270, "url": "https://news.ycombinator.com/item?id=46039270", "by": "thatcks", "date": "2025-11-24", "stance": "recommend", "quote": "we also wanted to switch from our previous OpenBSD setup to Bind, where we were already running Bind on Ubuntu", "excerpt": "The computers that moved from OpenBSD to Ubuntu were our local resolving DNS servers. These don't use PF and we also wanted to switch from our previous OpenBSD setup to Bind, where we were already running Bind on Ubuntu for our DNS master servers. The gory details were written up here: https://utcc.utoronto.ca/~cks/space/blog/sysadmin/UsingBindNowForResolvers We may at some point switch our remaining OpenBSD DHCP ser", "context": "sysadmin, author of the article", "use_case": "DNS resolvers", "switched_from": "", "story": "Moving from OpenBSD to FreeBSD for firewalls"}, {"id": 735862576, "item_id": 45991411, "url": "https://news.ycombinator.com/item?id=45991411", "by": "ralferoo", "date": "2025-11-20", "stance": "compare", "quote": "just by virtue that the majority of the internet's DNS is running on BIND that it's also the most battle tested of them all.", "excerpt": "Haven't all these issues been related to use as a resolver rather than running as an authoritative server? Personally, I'd also expect that just by virtue that the majority of the internet's DNS is running on BIND that it's also the most battle tested of them all. But sure, point taken - I hadn't really considered from a security issue perspective. It just seemed odd to me that someone seemingly dabbling in running D", "context": "", "use_case": "DNS server", "switched_from": "", "story": "Self-hosting DNS for no fun, but a little profit"}]}