https://blogs.damiendye.uk/en/tags/bind/ Recent content in Bind on Damien Dye's Blog Hugo en-GB Mon, 24 Aug 2026 09:00:00 +0100 https://blogs.damiendye.uk/en/dns/samba4-securing-ad-records-with-dnssec/ Mon, 24 Aug 2026 09:00:00 +0100 https://blogs.damiendye.uk/en/dns/samba4-securing-ad-records-with-dnssec/ Every domain-joined machine finds its DC by asking DNS for an SRV record, so the _msdcs locators are the most security-critical records you have. Signing them from a Samba4 DC: BIND with dlz_bind9, inline signing, a hidden primary, dynamic updates kept out of the locator zone, then forcing Windows and Linux clients to validate the signatures.