Уличная магия BIND

# cat named.conf
include "/etc/bind/rndc.key";

key xfer_key {
    algorithm hmac-sha512;
    secret "xxx";
};

server 10.2.0.3 {
    keys {
        xfer_key;
    };
};

acl good_guys {
    10.0.0.0/8;
    192.168.192.0/24;
    127.0.0.1;
};

acl blackhole_nets {
    0.0.0.0/8;
    1.0.0.0/8;
    2.0.0.0/8;
    192.0.2.0/24;
    224.0.0.0/3;
    10.0.0.0/8;
    172.16.0.0/12;
    192.168.0.0/16;
};

options {
    directory "/etc/bind";
    pid-file "/var/run/bind/named.pid";
    
    listen-on {
        127.0.0.1;
	x.x.x.x;
    };
    
    listen-on-v6 {
        none;
    };
    
    allow-query {
        any;
    };
    
    allow-recursion {
        good_guys;
    };
    
    allow-transfer {
        good_guys;
    };
    
    also-notify {
        10.2.0.3;
    };
    
    dnssec-enable yes;
    dnssec-validation yes;
    dnssec-lookaside auto;
    session-keyfile "session.key";
    
    notify explicit;
    statistics-file "named.stats";
    memstatistics-file "named.memstats";
    zone-statistics no;
    transfers-in 10;
    transfers-per-ns 2;
    max-transfer-time-in 120;
    transfer-format many-answers;
    
    interface-interval 60;
    random-device "/dev/urandom";
    
    max-cache-size 512m;
    tcp-listen-queue 600;
    flush-zones-on-shutdown yes;
    
    minimal-responses yes;
    
    # TTLs
    lame-ttl 180;
    max-ncache-ttl 1800;
    max-cache-ttl 3600;
    
    version "Hackers go away ;)";
};

controls {
    inet 127.0.0.1 allow { localhost; } keys { "rndc-key"; };
};

logging {
    channel myqueries {
        file "logs/named.queries" versions 5 size 10m;
        severity dynamic;
        print-time yes;
        print-category yes;
        print-severity yes;
    };
    
    channel mydefault {
        file "logs/named.default" versions 5 size 10m;
        severity dynamic;
        print-time yes;
        print-category yes;
        print-severity yes;
    };
    
    channel mydnssec {
        file "logs/named.dnssec" versions 5 size 10m;
        print-time yes;
        print-category yes;
        print-severity yes;
        severity debug 4;
    };
    
    channel null {
        null;
    };

    category default {
        mydefault;
    };
    
    category dnssec {
        mydnssec;
    };
};

zone "." {
    type hint;
    file "named.cache";
};

zone "localhost" {
    type master;
    file "misc/localhost.zone";
    allow-update { none; };
    notify no;
};

zone "127.in-addr.arpa" {
    type master;
    file "misc/127.zone";
    allow-update { none; };
    notify no;
};

zone "domain.ru" {
    type master;
    
    auto-dnssec maintain;
    inline-signing yes;
    key-directory "dnssec-keys/";
    
    file "master/domain.ru.zone";
};

# cat domain.ru.zone
$TTL 86400
@                       IN      SOA ns1.domain.ru. admin.domain.ru. (
                                    2012120501 ; Serial
                                    1800 ; Refresh
                                    900 ; Retry
                                    2592000 ; Expire
                                    900 ; Min
                                )

@                       IN      NS      ns1
@                       IN      NS      ns2

@                       IN      MX      10 mx

ns1                     IN      A       x.x.x.x
ns2                     IN      A       x.x.x.x

@                       IN      A       x.x.x.x
www                     IN      A       x.x.x.x

mx                      IN      A       x.x.x.x

; SPF
@                       IN      TXT     "v=spf1 ip4:x.x.x.x/28 -all"

; DKIM
_adsp._domainkey        IN      TXT     "dkim=discardable"
$INCLUDE "master/20121201.txt"

20121201._domainkey IN TXT (    "v=DKIM1; k=rsa; ".....